1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
|
#!/usr/bin/lua
--[[
Alpine Wall
Copyright (C) 2012 Kaarle Ritvanen
Licensed under the terms of GPL2
]]--
require 'alt_getopt'
require 'lfs'
require 'signal'
require 'stringy'
short_opts = 'o:V'
long_opts = {['output-dir']='o', verify='V'}
function help()
io.stderr:write([[
Alpine Wall usage
Translate policy files to firewall configuration files:
awall translate [-o|--output <dir>] [-V|--verify]
The --verify option makes awall verify the configuration using the
test mode of iptables-restore before overwriting the old files.
Specifying the output directory allows testing awall policies
without overwriting the current iptables and ipset configuration
files. By default, awall generates the configuration to
/etc/iptables and /etc/ipset.d, which are read by the init
scripts.
Run-time activation of new firewall configuration:
awall activate
This command genereates firewall configuration from the policy
files and enables it. If the user confirms the new configuration
by hitting RETURN within 10 seconds, the configuration is saved to
the files. Otherwise, the old configuration is restored.
Enable/disable optional policies:
awall {enable|disable} <policy>...
List optional policies:
awall list
The 'enabled' status means that the policy has been enabled by the
user. The 'disabled' status means that the policy is not in
use. The 'required' status means that the policy has not been
enabled by the user but is in use because it is required by
another policy which is in use.
]])
os.exit()
end
params = {}
if stringy.endswith(arg[0], '/awall-cli') then
basedir = string.sub(arg[0], 1, -11)
params.i = {basedir..'/json'}
params.I = {}
short_opts = short_opts..'i:I:'
long_opts['input-dir'] = 'i'
long_opts['import-path'] = 'I'
end
if not arg[1] then help() end
if not stringy.startswith(arg[1], '-') then
mode = arg[1]
table.remove(arg, 1)
end
opts, opind = alt_getopt.get_opts(arg, short_opts, long_opts)
for switch, value in pairs(opts) do
if switch == 'V' then verify = true
elseif switch == 'o' then
iptdir = value
ipsfile = value..'/ipset'
else table.insert(params[switch], value) end
end
if not mode then
mode = arg[opind]
opind = opind + 1
end
require 'awall.util'
if not awall.util.contains({'translate', 'activate', 'fallback',
'enable', 'disable', 'list'},
mode) then help() end
require 'awall'
policyset = awall.PolicySet.new(params.i, params.I)
if mode == 'list' then
for name, status, desc in policyset:list() do
print(name, status, desc)
end
os.exit()
end
if awall.util.contains({'disable', 'enable'}, mode) then
if opind > #arg then help() end
repeat
policyset[mode](policyset, arg[opind])
opind = opind + 1
until opind > #arg
os.exit()
end
require 'awall.iptables'
awall.loadmodules(basedir)
config = awall.Config.new(policyset)
if mode == 'translate' then
if verify then config:test() end
config:dump(iptdir, ipsfile)
elseif mode == 'activate' then
awall.iptables.backup()
signal.signal('SIGCHLD',
function() if pid and lpc.wait(pid, 1) then os.exit(2) end end)
for i, sig in ipairs({'INT', 'TERM'}) do
signal.signal('SIG'..sig, function()
interrupted = true
io.stdin:close()
end)
end
require 'lpc'
pid, stdio, stdout = lpc.run(arg[0], 'fallback')
stdio:close()
stdout:close()
config:activate()
io.stderr:write('New firewall configuration activated\n')
io.stderr:write('Press RETURN to commit changes permanently: ')
interrupted = not io.read()
signal.signal('SIGCHLD', 'default')
signal.kill(pid, 'SIGTERM')
lpc.wait(pid)
if interrupted then
io.stderr:write('\nActivation canceled, reverting to the old configuration\n')
awall.iptables.revert()
else config:dump() end
elseif mode == 'fallback' then
for i, sig in ipairs({'HUP', 'PIPE'}) do
signal.signal('SIG'..sig, function() end)
end
require 'lsleep'
lsleep.sleep(10)
io.stderr:write('\nTimeout, reverting to the old configuration\n')
awall.iptables.revert()
else assert(false) end
|
