path: root/awall-cli

#!/usr/bin/lua

--[[
Alpine Wall
Copyright (C) 2012-2013 Kaarle Ritvanen
See LICENSE file for license details
]]--

require 'alt_getopt'
require 'lfs'
require 'signal'
require 'stringy'

function help()
   io.stderr:write([[
Alpine Wall
Copyright (C) 2012-2013 Kaarle Ritvanen
This is free software with ABSOLUTELY NO WARRANTY,
available under the terms of the GNU General Public License, version 2

Usage:

Translate policy files to firewall configuration files:
    awall translate [-o|--output <dir>] [-V|--verify]

    The --verify option makes awall verify the configuration using the
    test mode of iptables-restore before overwriting the old files.

    Specifying the output directory allows testing awall policies
    without overwriting the current iptables and ipset configuration
    files. By default, awall generates the configuration to
    /etc/iptables and /etc/ipset.d, which are read by the init
    scripts.

Run-time activation of new firewall configuration:
    awall activate [-f|--force]

    This command genereates firewall configuration from the policy
    files and enables it. If the user confirms the new configuration
    by hitting RETURN within 10 seconds or the --force option is used,
    the configuration is saved to the files. Otherwise, the old
    configuration is restored.

Flush firewall configuration:
    awall flush

    This command deletes all firewall rules and configures it to drop
    all packets.

Enable/disable optional policies:
    awall {enable|disable} <policy>...

List optional policies:
    awall list [-a|--all]

    The 'enabled' status means that the policy has been enabled by the
    user. The 'disabled' status means that the policy is not in
    use. The 'required' status means that the policy has not been
    enabled by the user but is in use because it is required by
    another policy which is in use.

    Normally, the command lists only optional policies. Specifying
    --all makes it list all policies and more information about them.

Dump variable and zone definitions:
    awall dump [level]

    Verbosity level is an integer in range 0-5 and defaults to 0.

]])
   os.exit(1)
end

if not arg[1] then help() end

if not stringy.startswith(arg[1], '-') then
   mode = arg[1]
   table.remove(arg, 1)
end

opts, opind = alt_getopt.get_opts(
   arg,
   'afo:V',
   {all='a', force='f', ['output-dir']='o', verify='V'}
)
for switch, value in pairs(opts) do
   if switch == 'a' then all = true
   elseif switch == 'f' then force = true
   elseif switch == 'c' then verbose = true
   elseif switch == 'V' then verify = true
   elseif switch == 'o' then outputdir = value
   else assert(false) end
end

if not mode then
   mode = arg[opind]
   opind = opind + 1
end


require 'awall.util'
util = awall.util

if not util.contains({'translate', 'activate', 'fallback', 'flush',
		      'enable', 'disable', 'list', 'dump'},
		     mode) then help() end

pol_paths = {}
for i, cls in ipairs{'mandatory', 'optional', 'private'} do
   path = os.getenv('AWALL_PATH_'..string.upper(cls))
   if path then pol_paths[cls] = util.split(path, ':') end
end

if stringy.endswith(arg[0], '/awall-cli') then
   basedir = string.sub(arg[0], 1, -11)
   if not pol_paths.mandatory then
      pol_paths.mandatory = {'/etc/awall'}
   end
   table.insert(pol_paths.mandatory, basedir..'/json')
end

local uerror = require('awall.uerror')

if not uerror.call(
   function()
      
      require 'awall'

      policyset = awall.PolicySet.new(pol_paths)

      if mode == 'list' then
	 imported = policyset:load().policies
	 data = {}
	 
	 for i, name in util.sortedkeys(policyset.policies) do
	    policy = policyset.policies[name]

	    if all or policy.type == 'optional' then
	       if policy.enabled then status = 'enabled'
	       elseif util.contains(imported, name) then status = 'required'
	       else status = 'disabled' end

	       polinfo = {name, status, policy:load().description}

	       if all then
		  table.insert(polinfo, 2, policy.type)
		  table.insert(polinfo, 4, policy.path)
	       end

	       table.insert(data, polinfo)
	    end
	 end
	 
	 util.printtabular(data)
	 os.exit()
      end

      if util.contains({'disable', 'enable'}, mode) then
	 if opind > #arg then help() end
	 repeat
	    name = arg[opind]
	    policy = policyset.policies[name]
	    if not policy then uerror.raise('No such policy: '..name) end
	    policy[mode](policy)
	    opind = opind + 1
	 until opind > #arg
	 os.exit()
      end


      input = policyset:load()

      if mode == 'dump' then level = 0 + (arg[opind] or 0) end

      if mode ~= 'dump' or level > 3 then
	 awall.loadmodules(basedir)
	 config = awall.Config.new(input)
      end


      require 'awall.iptables'

      if mode == 'dump' then
	 require 'json'
	 expinput = input:expand()

	 function capitalize(cls)
	    return string.upper(string.sub(cls, 1, 1))..string.sub(cls, 2, -1)
	 end

	 for cls, objs in pairs(input.data) do
	    if level > 2 or (level == 2 and cls ~= 'service') or util.contains(
	       {'variable', 'zone'},
	       cls
	    ) then
	       if level == 0 then print(capitalize(cls)..'s:') end
	 
	       items = {}
	       for k, v in pairs(objs) do
		  exp = expinput[cls][k]
		  expj = json.encode(exp)
		  src = input.source[cls][k]

		  if level == 0 then table.insert(items, {k, expj, src})

		  else
		     data = {
			{capitalize(cls)..' '..k, json.encode(v)},
			{
			   '('..src..')',
			   util.compare(exp, v) and '' or '-> '..expj
			}
		     }

		     if level > 3 then
			obj = config.objects[cls][k]
			if type(obj) == 'table' and obj.info then
			   util.extend(data, obj:info())
			end
		     end
	       
		     table.insert(items, {k, data})
		  end
	       end
	       table.sort(items, function(a, b) return a[1] < b[1] end)

	       if level == 0 then util.printtabular(items)
	       else
		  util.printtabulars(
		     util.map(items, function(x) return x[2] end)
		  )
		  print()
	       end
	    end
	 end

	 if level > 4 then config:print() end

      elseif mode == 'translate' then
	 if verify then config:test() end
	 config:dump(outputdir)
   
      elseif mode == 'activate' then

	 awall.iptables.backup()

	 if not force then
	    signal.signal(
	       'SIGCHLD',
	       function()
		  if pid and lpc.wait(pid, 1) then os.exit(2) end
	       end
	    )
	    for i, sig in ipairs({'INT', 'TERM'}) do
	       signal.signal(
		  'SIG'..sig,
		  function()
		     interrupted = true
		     io.stdin:close()
		  end
	       )
	    end

	    require 'lpc'
	    pid, stdio, stdout = lpc.run(arg[0], 'fallback')
	    stdio:close()
	    stdout:close()
	 end

	 function kill()
	    signal.signal('SIGCHLD', 'default')
	    signal.kill(pid, 'SIGTERM')
	    lpc.wait(pid)
	 end

	 function revert()
	    awall.iptables.revert()
	    os.exit(1)
	 end

	 if uerror.call(config.activate, config) then

	    if not force then
	       io.stderr:write('New firewall configuration activated\n')
	       io.stderr:write('Press RETURN to commit changes permanently: ')
	       interrupted = not io.read()

	       kill()

	       if interrupted then
		  io.stderr:write(
		     '\nActivation canceled, reverting to the old configuration\n'
		  )
		  revert()
	       end
	    end

	    config:dump()

	 else
	    if not force then kill() end
	    revert()
	 end


      elseif mode == 'fallback' then
   
	 for i, sig in ipairs({'HUP', 'PIPE'}) do
	    signal.signal('SIG'..sig, function() end)
	 end

	 require 'lsleep'
	 lsleep.sleep(10)

	 io.stderr:write('\nTimeout, reverting to the old configuration\n')
	 awall.iptables.revert()

      elseif mode == 'flush' then awall.iptables.flush()

      else assert(false) end

   end
) then os.exit(1) end