1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
|
--[[
Filter module for Alpine Wall
Copyright (C) 2012 Kaarle Ritvanen
Licensed under the terms of GPL2
]]--
module(..., package.seeall)
require 'awall'
require 'awall.host'
require 'awall.model'
require 'awall.object'
require 'awall.optfrag'
require 'awall.util'
local model = awall.model
local combinations = awall.optfrag.combinations
local extend = awall.util.extend
Log = awall.object.class(awall.object.Object)
function Log:matchopts()
return self.limit and '-m limit --limit '..self.limit..'/second'
end
function Log:target() return string.upper(self.mode or 'log') end
local Filter = model.class(model.Rule)
function Filter:init(...)
model.Rule.init(self, unpack(arg))
-- alpine v2.4 compatibility
if util.contains({'logdrop', 'logreject'}, self.action) then
self:warning('Deprecated action: '..self.action)
self.action = string.sub(self.action, 4, -1)
end
local function log(spec, default)
if spec == nil then spec = default end
if spec == false then return end
if spec == true then spec = '_default' end
return self.root.log[spec] or self:error('Invalid log: '..spec)
end
self.log = log(self.log, self.action ~= 'accept')
local limit = self:limit()
if limit then self[limit].log = log(self[limit].log, true) end
end
function Filter:destoptfrags()
local ofrags = model.Rule.destoptfrags(self)
if not self.dnat then return ofrags end
ofrags = combinations(ofrags, {{family='inet6'}})
local natof = self:create(model.Zone, {addr=self.dnat}):optfrags('out')
assert(#natof == 1)
table.insert(ofrags, natof[1])
return ofrags
end
function Filter:trules()
local res = {}
local function extrarules(cls, extra)
local params = {}
for i, attr in ipairs({'in', 'out', 'src', 'dest',
'ipset', 'ipsec', 'service'}) do
params[attr] = self[attr]
end
if extra then for k, v in pairs(extra) do params[k] = v end end
return extend(res, self:create(cls, params):trules())
end
if self.dnat then
if self.action ~= 'accept' then
self:error('dnat option not allowed with '..self.action..' action')
end
if self['no-track'] then
self:error('dnat option not allowed with no-track')
end
if not self.dest then
self:error('Destination address must be specified with DNAT')
end
if string.find(self.dnat, '/') then
self:error('DNAT target cannot be a network address')
end
for i, attr in ipairs({'ipsec', 'ipset'}) do
if self[attr] then
self:error('dnat and '..attr..' options cannot be used simultaneously')
end
end
local dnataddr
for i, addr in ipairs(awall.host.resolve(self.dnat, self)) do
if addr[1] == 'inet' then
if dnataddr then
self:error(self.dnat..' resolves to multiple IPv4 addresses')
end
dnataddr = addr[2]
end
end
if not dnataddr then
self:error(self.dnat..' does not resolve to any IPv4 address')
end
extrarules('dnat', {['ip-range']=dnataddr, out=nil})
end
if self.action == 'tarpit' or self['no-track'] then
extrarules('no-track')
end
extend(res, model.Rule.trules(self))
if self['no-track'] and self.action == 'accept' then
extrarules('no-track', {reverse=true})
extrarules('filter', {reverse=true, action='accept', log=false})
end
return res
end
function Filter:limit()
local res
for i, limit in ipairs({'conn-limit', 'flow-limit'}) do
if self[limit] then
if res then
self:error('Cannot specify multiple limits for a single filter rule')
end
res = limit
end
end
return res
end
function Filter:position()
return self:limit() == 'flow-limit' and 'prepend' or 'append'
end
function Filter:target()
if self:limit() then return self:newchain('limit') end
if self.log then return self:newchain('log'..self.action) end
return model.Rule.target(self)
end
function Filter:extraoptfrags()
local res = {}
local function logchain(action, log, target)
extend(res, combinations({{chain=self:newchain('log'..action)}},
{{opts=log:matchopts(), target=log:target()},
{target=target}}))
end
local limit = self:limit()
if limit then
if self.action ~= 'accept' then
self:error('Cannot specify limit for '..self.action..' filter')
end
local chain = self:newchain('limit')
local limitlog = self[limit].log
extend(res,
combinations({{chain=chain,
opts='-m recent --name '..chain}},
{{opts='--update --hitcount '..self[limit].count..' --seconds '..self[limit].interval,
target=limitlog and self:newchain('logdrop') or 'DROP'},
{opts='--set',
target=self.log and self:newchain('log'..self.action) or 'ACCEPT'}}))
if limitlog then logchain('drop', limitlog, 'DROP') end
end
if self.log then logchain(self.action, self.log, model.Rule.target(self)) end
return res
end
local Policy = model.class(Filter)
function Policy:servoptfrags() return nil end
classes = {{'log', Log},
{'filter', Filter},
{'policy', Policy}}
defrules = {}
local fchains = {{chain='FORWARD'}, {chain='INPUT'}, {chain='OUTPUT'}}
local dar = combinations(fchains,
{{opts='-m state --state RELATED,ESTABLISHED'}})
for i, chain in ipairs({'INPUT', 'OUTPUT'}) do
table.insert(dar,
{chain=chain,
opts='-'..string.lower(string.sub(chain, 1, 1))..' lo'})
end
defrules.pre = combinations(dar,
{{table='filter', target='ACCEPT'}},
{{family='inet'}, {family='inet6'}})
local icmp = {{family='inet', table='filter', opts='-p icmp'}}
local icmp6 = {{family='inet6', table='filter', opts='-p icmpv6'}}
defrules['post-filter'] = combinations(icmp6,
{{chain='INPUT'}, {chain='OUTPUT'}},
{{target='ACCEPT'}})
extend(defrules['post-filter'],
combinations(icmp6, {{chain='FORWARD', target='icmp-routing'}}))
extend(defrules['post-filter'],
combinations(icmp, fchains, {{target='icmp-routing'}}))
local function icmprules(ofrag, oname, types)
extend(defrules['post-filter'],
combinations(ofrag,
{{chain='icmp-routing', target='ACCEPT'}},
util.map(types,
function(t)
return {opts='--'..oname..' '..t}
end)))
end
icmprules(icmp, 'icmp-type', {3, 11, 12})
icmprules(icmp6, 'icmpv6-type', {1, 2, 3, 4})
achains = combinations({{chain='tarpit'}},
{{opts='-p tcp', target='TARPIT'},
{target='DROP'}})
|
