ftp.jcu.edu.au/2014.06.ftp.jcu.edu.au.tar/ftp.jcu.edu.au/v6.3.2b/SWBD63/fabos-6.3.2b-10.ppc.rpm/fabos-6.3.2b.10.cpio.gz/fabos-6.3.2b.10.cpio/fabos/libexec/createipfchains

Text File | 2010-11-10 | 5KB | 193 lines

#!/bin/sh
#
# Usage: createipfchains.sh
#
# script to enforce iptable rules
# follow these steps.
# 1. First get the Active, Standby CP status

echo_debug()
{
    if [ "$debug_on" = "1" ]; then
        echo $* 1>&2
    fi
}

iptab_create_default_rules()
{
    # ordering of rules is important, do not change arbitrarily

    ## TCP common rules
    echo "$IPTABLES -A $R_TCPCOMMON -p $PROTO_TCP -m $PROTO_TCP --dport 1024: -j ACCEPT" >> $RULE_FILE
    #echo "$IPTABLES -A $R_TCPCOMMON -p $PROTO_TCP -m $PROTO_TCP --dport 49152: -j ACCEPT" >> $RULE_FILE

    # UDP common rules
    # Never delete the ntp rule
    echo "$IPTABLES -A $R_UDPCOMMON -p $PROTO_UDP -m $PROTO_UDP --dport 1024: -j ACCEPT" >> $RULE_FILE
    #echo "$IPTABLES -A $R_UDPCOMMON -p $PROTO_UDP -m $PROTO_UDP --dport 49152: -j ACCEPT" >> $RULE_FILE

}

iptab_create_generic_rules()
{
    # Create tcp/udp rules for ports other than specified in policies
    echo "$IPTABLES -A $R_TCP -p tcp -j $R_TCPCOMMON" >> $RULE_FILE
    echo "$IPTABLES -A $R_UDP -p udp -j $R_UDPCOMMON" >> $RULE_FILE
}

iptab_create_policy_rules()
{

    echo_debug
    echo_debug "debug: entering iptab_create_policy_rules"
    echo_debug

    POLICYFILE=$1
    echo_debug "debug: policyfile=$POLICYFILE"
    LIMIT_RATE=20/minute
    BURST_RATE=20

    # check if text policy file exists. If not, exit.
    if [ ! -f $POLICYFILE ]; then
        exit 1
    fi

    OLD_IFS=$IFS
    # make the separator as newline
    IFS='
'
    for line in `cat $POLICYFILE`
    do
    # get protocol
        PROTO=${line%% *}
        echo_debug "debug proto: $PROTO"
        rem_line=${line#${PROTO} }
        echo_debug "debug: rem_line=$rem_line"

    # get port number
        PORT=${rem_line%% *}
        echo_debug debug port: $PORT

        rem_line=${rem_line#${PORT} }

        echo_debug debug: rem_line=$rem_line

        case "$PORT" in
            22)
                RULE=$R_SSH
                PROTOCHAIN=$R_TCP
                VIOLATED_APP="SSH"
                ;;

            23)
                RULE=$R_TELNET
                PROTOCHAIN=$R_TCP
                VIOLATED_APP="TELNET"
                ;;

            111)
                if [ "$PROTO"  = "tcp" ]; then
                    RULE=$R_APIRPCTCP
                    PROTOCHAIN=$R_TCP
                else
                    RULE=$R_APIRPCUDP
                    PROTOCHAIN=$R_UDP
                fi
                VIOLATED_APP="API"
                ;;
            897 | 898)
                RULE=$R_APIPMAP
                PROTOCHAIN=$R_TCP
                VIOLATED_APP="API"
                ;;

    # add ports for API in future if new API comes up

            *)
                if [ "$PROTO"  = "tcp" ]; then
                    RULE=$R_TCPCOMMON
                    PROTOCHAIN=$R_TCP
                    VIOLATED_APP="TCP"
                else
                    RULE=$R_UDPCOMMON
                    PROTOCHAIN=$R_UDP
                    VIOLATED_APP="UDP"
                fi
                ;;
        esac # end of case

        # check PROTOCHAIN and set the values.
        echo "$IPTABLES -A $PROTOCHAIN -p $PROTO -m $PROTO --dport $PORT -j $RULE" >> $RULE_FILE

        IFS=' '

        IPADDR=""
            for ARG in $rem_line
            do
                if [ "$ARG" = "DROP" ]; then
                    if [ "$IPADDR" == "" ]; then
                        if [ "$POLICY_TYPE" = "v4" ]; then
                            echo "$IPTABLES -A $RULE -p $PROTO -m $PROTO --dport $PORT \
                                    -m limit --limit $LIMIT_RATE --limit-burst $BURST_RATE -j ULOG --ulog-prefix \
                                "\"$VIOLATED_APP violation-port $PORT\"" --ulog-cprange 20 \
                                --ulog-nlgroup $NLGROUP" >> $RULE_FILE
                        fi
                        echo "$IPTABLES -A $RULE -p $PROTO -m $PROTO --dport $PORT -j DROP" >> $RULE_FILE
                        break
                    else
                        if [ "$POLICY_TYPE" = "v4" ]; then
                            echo "$IPTABLES -A $RULE -p $PROTO -m $PROTO --dport $PORT -s $IPADDR \
                                -m limit --limit $LIMIT_RATE  --limit-burst $BURST_RATE -j ULOG --ulog-prefix \
                                "\"$VIOLATED_APP violation-port $PORT\"" --ulog-cprange 20 \
                                --ulog-nlgroup $NLGROUP" >> $RULE_FILE
                        fi
                        echo "$IPTABLES -A $RULE -p $PROTO -m $PROTO --dport $PORT -s $IPADDR -j DROP" >> $RULE_FILE
                        break
                    fi
                elif [ "$ARG" = "ACCEPT" ]; then
                    if [ "$IPADDR" == "" ]; then
                        echo "$IPTABLES -A $RULE -p $PROTO -m $PROTO --dport $PORT -j ACCEPT" >> $RULE_FILE
                        break
                    else
                        echo "$IPTABLES -A $RULE -p $PROTO -m $PROTO --dport $PORT -s $IPADDR -j ACCEPT" >> $RULE_FILE
                        break
                    fi
                else
                    IPADDR=$ARG
                fi
            done #inner for loop
        IFS='
'
    done   # for

    IFS=$OLD_IFS

    echo_debug
    echo_debug "debug: exiting iptab_create_policy_rules"
    echo_debug
} # iptab_create_policy_rules

#////////////////////////////////////////
########################################
# This is the start of this script
########################################
#////////////////////////////////////////


export POLICY_TYPE=$1;

export NLGROUP=1


POLICYFILE="/etc/fabos/ipfpolicy."$POLICY_TYPE"."$CPSTATE".txt"

echo_debug "debug createrules time"

iptab_create_default_rules ;

iptab_create_policy_rules $POLICYFILE ;

iptab_create_generic_rules ;

exit 0