path: root/awall-cli

#!/usr/bin/lua

--[[
Alpine Wall
Copyright (C) 2012 Kaarle Ritvanen
Licensed under the terms of GPL2
]]--

require 'alt_getopt'
require 'lfs'
require 'signal'
require 'stringy'

short_opts = 'fo:V'
long_opts = {force='f', ['output-dir']='o', verify='V'}

function help()
   io.stderr:write([[
Alpine Wall usage

Translate policy files to firewall configuration files:
    awall translate [-o|--output <dir>] [-V|--verify]

    The --verify option makes awall verify the configuration using the
    test mode of iptables-restore before overwriting the old files.

    Specifying the output directory allows testing awall policies
    without overwriting the current iptables and ipset configuration
    files. By default, awall generates the configuration to
    /etc/iptables and /etc/ipset.d, which are read by the init
    scripts.

Run-time activation of new firewall configuration:
    awall activate [-f|--force]

    This command genereates firewall configuration from the policy
    files and enables it. If the user confirms the new configuration
    by hitting RETURN within 10 seconds or the --force option is used,
    the configuration is saved to the files. Otherwise, the old
    configuration is restored.

Flush firewall configuration:
    awall flush

    This command deletes all firewall rules and configures it to drop
    all packets.

Enable/disable optional policies:
    awall {enable|disable} <policy>...

List optional policies:
    awall list

    The 'enabled' status means that the policy has been enabled by the
    user. The 'disabled' status means that the policy is not in
    use. The 'required' status means that the policy has not been
    enabled by the user but is in use because it is required by
    another policy which is in use.

Dump variable and zone definitions:
    awall dump [level]

    Verbosity level is an integer in range 0-5 and defaults to 0.

]])
   os.exit()
end

params = {}

if stringy.endswith(arg[0], '/awall-cli') then
   basedir = string.sub(arg[0], 1, -11)
   params.i = {basedir..'/json'}
   params.I = {}

   short_opts = short_opts..'i:I:'
   long_opts['input-dir'] = 'i'
   long_opts['import-path'] = 'I'
end

if not arg[1] then help() end

if not stringy.startswith(arg[1], '-') then
   mode = arg[1]
   table.remove(arg, 1)
end

opts, opind = alt_getopt.get_opts(arg, short_opts, long_opts)
for switch, value in pairs(opts) do
   if switch == 'f' then force = true
   elseif switch == 'V' then verify = true
   elseif switch == 'o' then
      iptdir = value
      ipsfile = value..'/ipset'
   else table.insert(params[switch], value) end
end

if not mode then
   mode = arg[opind]
   opind = opind + 1
end


require 'awall.util'
util = awall.util

if not util.contains({'translate', 'activate', 'fallback', 'flush',
		      'enable', 'disable', 'list', 'dump'},
		     mode) then help() end


require 'awall'

policyset = awall.PolicySet.new(params.i, params.I)

if mode == 'list' then
   util.printtabular(policyset:list())
   os.exit()
end

if util.contains({'disable', 'enable'}, mode) then
   if opind > #arg then help() end
   repeat
      policyset[mode](policyset, arg[opind])
      opind = opind + 1
   until opind > #arg
   os.exit()
end


input = policyset:load()

if mode == 'dump' then level = 0 + (arg[opind] or 0) end

if mode ~= 'dump' or level > 3 then
   awall.loadmodules(basedir)
   config = awall.Config.new(input)
end


require 'awall.iptables'

if mode == 'dump' then
   require 'json'
   expinput = input:expand()

   function capitalize(cls)
      return string.upper(string.sub(cls, 1, 1))..string.sub(cls, 2, -1)
   end

   for cls, objs in pairs(input.data) do
      if level > 2 or (level == 2 and cls ~= 'service') or util.contains({'variable',
									  'zone'},
									 cls) then
	 if level == 0 then print(capitalize(cls)..'s:') end
	 
	 items = {}
	 for k, v in pairs(objs) do
	    exp = expinput[cls][k]
	    expj = json.encode(exp)
	    src = input.source[cls][k]

	    if level == 0 then table.insert(items, {k, expj, src})

	    else
	       data = {{capitalize(cls)..' '..k, json.encode(v)},
		       {'('..src..')',
			util.compare(exp, v) and '' or '-> '..expj}}

	       if level > 3 then
		  obj = config.objects[cls][k]
		  if type(obj) == 'table' and obj.info then
		     util.extend(data, obj:info())
		  end
	       end

	       table.insert(items, {k, data})
	    end
	 end
	 table.sort(items, function(a, b) return a[1] < b[1] end)

	 if level == 0 then util.printtabular(items)
	 else
	    util.printtabulars(util.map(items,
					function(x) return x[2] end))
	    print()
	 end
      end
   end

   if level > 4 then config:print() end

elseif mode == 'translate' then
   if verify then config:test() end
   config:dump(iptdir, ipsfile)      
   
elseif mode == 'activate' then

   if not force then
      awall.iptables.backup()

      signal.signal('SIGCHLD',
		    function()
		       if pid and lpc.wait(pid, 1) then os.exit(2) end
		    end)
      for i, sig in ipairs({'INT', 'TERM'}) do
	 signal.signal('SIG'..sig, function()
				      interrupted = true
				      io.stdin:close()
				   end)
      end

      require 'lpc'
      pid, stdio, stdout = lpc.run(arg[0], 'fallback')
      stdio:close()
      stdout:close()
   end
   
   config:activate()

   if not force then
      io.stderr:write('New firewall configuration activated\n')
      io.stderr:write('Press RETURN to commit changes permanently: ')
      interrupted = not io.read()

      signal.signal('SIGCHLD', 'default')
      signal.kill(pid, 'SIGTERM')
      lpc.wait(pid)
   end

   if interrupted then
      io.stderr:write('\nActivation canceled, reverting to the old configuration\n')
      awall.iptables.revert()

   else config:dump() end


elseif mode == 'fallback' then

   for i, sig in ipairs({'HUP', 'PIPE'}) do
      signal.signal('SIG'..sig, function() end)
   end

   require 'lsleep'
   lsleep.sleep(10)

   io.stderr:write('\nTimeout, reverting to the old configuration\n')
   awall.iptables.revert()

elseif mode == 'flush' then awall.iptables.flush()

else assert(false) end