netfilter-script.c

linux防火墙源代码 需要用的人自己下载看看 程序比较简单啊

/*---[ netfilter-script.c ]-------------------------------------------
 * Copyright (C) 2000-2004 Tomas Junnonen ([e-mail])
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 2 of the License, or
 * (at your option) any later version.
 *
 * Functions to write the netfilter shell scripts
 *--------------------------------------------------------------------*/

#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <stdio.h>   
#include <errno.h>
#include <time.h>

#include "wizard.h"
#include "netfilter-script.h"
#include "util.h"
#include "preferences.h"
#include "policyview.h"
#include "scriptwriter.h"

static void
write_outbound_script ()
{
	gchar *scriptpath = POLICY_OUT_DIR "/setup";
	FILE *script = fopen (scriptpath, "w");

        if (script == NULL) {
                perror(scriptpath);
                g_printerr("Script not written!");
		return;
	}
	chmod (scriptpath, 00440);

	fprintf (script, "# Initialize\n");
	fprintf (script, "$IPT -N OUTBOUND 2> /dev/null\n"
	                 "$IPT -F OUTBOUND\n\n");

	fprintf (script, "# Allow ICMP packets out\n");
	fprintf (script, "$IPT -A OUTBOUND -p icmp -j ACCEPT\n\n");

	fprintf (script, "# Temoporarily set the field separator for CSV format\n"
			 "OLDIFS=$IFS\n"
			 "IFS=','\n\n");

	fprintf (script, "# Allow response traffic\n"
			 "$IPT -A OUTBOUND -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT\n"
			 "$IPT -A OUTBOUND -p udp -m state --state ESTABLISHED,RELATED -j ACCEPT\n\n");

	fprintf (script, "if [ \"$OUTBOUND_POLICY\" == \"permissive\" ]; then\n");
	fprintf (script, "	# Hosts to which traffic is denied\n"
	                 "	while read host garbage\n"
	                 "		do\n"
	                 "			$IPT -A OUTBOUND -d $host -j LSO\n"
	                 "		done < "POLICY_OUT_DENY_TO"\n\n");

	fprintf (script, "	# Hosts from which traffic is denied\n"
	                 "	while read host garbage\n"
	                 "		do\n"
	                 "			$IPT -A OUTBOUND -s $host -j LSO\n"
	                 "		done < "POLICY_OUT_DENY_FROM"\n\n");

	fprintf (script, "	# Services denied\n"
	                 "	while read service ports target garbage\n"
	                 "		do\n"
			 "			IFS=' '\n"
			 "			for port in `echo $ports`; do\n"
			 "				scrub_parameters\n"
	                 "				$IPT -A OUTBOUND -p tcp -s $target --dport $port -j LSO\n"
	                 "				$IPT -A OUTBOUND -p udp -s $target --dport $port -j LSO\n"
			 "			done\n"
			 "			IFS=','\n"
	                 "		done < "POLICY_OUT_DENY_SERVICE"\n\n");

	fprintf (script, "	$IPT -A OUTBOUND -j ACCEPT # Default permissive policy \n");
	fprintf (script, "else\n");
	fprintf (script, "	# Hosts to which traffic is allowed\n"
	                 "	while read host garbage\n"
	                 "		do\n"
	                 "			$IPT -A OUTBOUND -d $host -j ACCEPT\n"
	                 "		done < "POLICY_OUT_ALLOW_TO"\n\n");

	fprintf (script, "	# Hosts from which traffic is allowed\n"
	                 "	while read host garbage\n"
	                 "		do\n"
	                 "			$IPT -A OUTBOUND -s $host -j ACCEPT\n"
	                 "		done < "POLICY_OUT_ALLOW_FROM"\n\n");

	fprintf (script, "	# Services allowed\n"
	                 "	while read service ports target garbage\n"
	                 "		do\n"
			 "			IFS=' '\n"
			 "			for port in `echo $ports`; do\n"
			 "				scrub_parameters\n"
	                 "				$IPT -A OUTBOUND -p tcp -s $target --dport $port -j ACCEPT\n"
	                 "				$IPT -A OUTBOUND -p udp -s $target --dport $port -j ACCEPT\n"
			 "			done\n"
			 "			IFS=','\n"
	                 "		done < "POLICY_OUT_ALLOW_SERVICE"\n\n");

	fprintf (script, "	$IPT -A OUTBOUND -j LSO # Default restrictive policy\n");
	fprintf (script, "fi\n\n");

	fprintf (script, "# Restore system field separator\n"
			 "IFS=$OLDIFS\n\n");

	fclose (script);
}

static void
write_inbound_script ()
{
	gchar *scriptpath = POLICY_IN_DIR "/setup";
	FILE *script = fopen (scriptpath, "w");

        if (script == NULL) {
                perror(scriptpath);
                g_printerr("Script not written!");
		return;
	}
	chmod (scriptpath, 00440);

	fprintf (script, "# Initialize\n");
	fprintf (script, "$IPT -N INBOUND 2> /dev/null\n"
	                 "$IPT -F INBOUND\n\n");

	fprintf (script, "# Temoporarily set the field separator for CSV format\n"
			 "OLDIFS=$IFS\n"
			 "IFS=','\n\n");

	fprintf (script, "# Allow response traffic\n"
			 "$IPT -A INBOUND -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT\n"
			 "$IPT -A INBOUND -p udp -m state --state ESTABLISHED,RELATED -j ACCEPT\n\n");

	fprintf (script, "# Hosts from which connections are always allowed\n"
	                 "while read host garbage\n"
	                 "	do\n"
	                 "		$IPT -A INBOUND -s $host -j ACCEPT\n"
	                 "	done < "POLICY_IN_ALLOW_FROM"\n\n");

	fprintf (script, "# Services allowed\n"
	                 "while read service ports target garbage\n"
	                 "	do\n"
			 "		IFS=' '\n"
			 "		for port in `echo $ports`; do\n"
			 "			scrub_parameters\n"
			 "			case \"$port\" in\n"
			 "			  # Override broadcast blocking for Samba share discovery\n"
			 "			  \"1900\" ) $IPT -I INPUT -p tcp -s $target --dport 1900 -j ACCEPT\n"
			 "			           $IPT -I INPUT -p udp -s $target --dport 1900 -j ACCEPT;;\n"
			 "			  # Default service handler\n"
			 "			  * ) $IPT -A INBOUND -p tcp -s $target --dport $port -j ACCEPT\n"
			 "			      $IPT -A INBOUND -p udp -s $target --dport $port -j ACCEPT;;\n"
			 "			esac\n"
			 "		done\n"
			 "		IFS=','\n"
	                 "	done < "POLICY_IN_ALLOW_SERVICE"\n\n");

	fprintf (script, "$IPT -A INBOUND -j LSI\n");

	fprintf (script, "# Restore system field separator\n"
			 "IFS=$OLDIFS\n\n");
	fclose (script);
}

static void
write_sysctl_tuning_script ()
{
	gchar *scriptpath = FIRESTARTER_SYSCTL_SCRIPT;
	FILE *script = fopen (scriptpath, "w");

        if (script == NULL) {
                perror(scriptpath);
                g_printerr("Script not written!");
		return;
	}
	chmod (scriptpath, 00440);

   fprintf (script, "# --------( Sysctl Tuning - Recommended Parameters )--------\n\n");
   
	fprintf (script, "# Turn off IP forwarding by default\n");
	fprintf (script, "# (this will be enabled if you require masquerading)\n\n");
	fprintf (script, "if [ -e /proc/sys/net/ipv4/ip_forward ]; then\n"
	"  echo 0 > /proc/sys/net/ipv4/ip_forward\nfi\n\n");
	
	fprintf (script, "# Do not log 'odd' IP addresses (excludes 0.0.0.0 & 255.255.255.255)\n\n");
	fprintf (script, "if [ -e /proc/sys/net/ipv4/conf/all/log_martians ]; then\n"
	"  echo 0 > /proc/sys/net/ipv4/conf/all/log_martians\nfi\n\n");	

   fprintf (script, "\n# --------( Sysctl Tuning - TCP Parameters )--------\n\n");
   
	fprintf (script, "# Turn off TCP Timestamping in kernel\n");
	fprintf (script, "if [ -e /proc/sys/net/ipv4/tcp_timestamps ]; then\n"
	"  echo 0 > /proc/sys/net/ipv4/tcp_timestamps\nfi\n\n");    

	fprintf (script, "# Set TCP Re-Ordering value in kernel to '5'\n");
	fprintf (script, "if [ -e /proc/sys/net/ipv4/tcp_reordering ]; then\n"
	"  echo 5 > /proc/sys/net/ipv4/tcp_reordering\nfi\n\n");
 
	fprintf (script, "# Turn off TCP ACK in kernel\n");
	fprintf (script, "if [ -e /proc/sys/net/ipv4/tcp_sack ]; then\n"
	"  echo 0 > /proc/sys/net/ipv4/tcp_sack\nfi\n\n");

	fprintf (script, "#Turn off TCP Window Scaling in kernel\n");
	fprintf (script, "if [ -e /proc/sys/net/ipv4/tcp_window_scaling ]; then\n"
	"  echo 0 > /proc/sys/net/ipv4/tcp_window_scaling\nfi\n\n");

	fprintf (script, "#Set Keepalive timeout to 1800 seconds\n");
	fprintf (script, "if [ -e /proc/sys/net/ipv4/tcp_keepalive_time ]; then\n"
	"  echo 1800 > /proc/sys/net/ipv4/tcp_keepalive_time\nfi\n\n");

	fprintf (script, "#Set FIN timeout to 30 seconds\n");
	fprintf (script, "if [ -e /proc/sys/net/ipv4/tcp_fin_timeout ]; then\n"
	"  echo 30 > /proc/sys/net/ipv4/tcp_fin_timeout\nfi\n\n");

	fprintf (script, "# Set TCP retry count to 3\n");
	fprintf (script, "if [ -e /proc/sys/net/ipv4/tcp_retries1 ]; then\n"
	"  echo 3 > /proc/sys/net/ipv4/tcp_retries1\nfi\n\n");
    
/* note: ECN is now actually an RFC - this is just a stopgap measure until certain
 OS'es get their act together */
 
	fprintf (script, "#Turn off ECN notification in kernel\n");
	fprintf (script, "if [ -e /proc/sys/net/ipv4/tcp_ecn ]; then\n"
	"  echo 0 > /proc/sys/net/ipv4/tcp_ecn\nfi\n\n");
	
   fprintf (script, "\n# --------( Sysctl Tuning - SYN Parameters )--------\n\n");
   
	fprintf (script, "# Turn on SYN cookies protection in kernel\n");
	fprintf (script, "if [ -e /proc/sys/net/ipv4/tcp_syncookies ]; then\n"
	"  echo 1 > /proc/sys/net/ipv4/tcp_syncookies\nfi\n\n");
	
	fprintf (script, "# Set SYN ACK retry attempts to '3'\n");
	fprintf (script, "if [ -e /proc/sys/net/ipv4/tcp_synack_retries ]; then\n"
	"  echo 3 > /proc/sys/net/ipv4/tcp_synack_retries\nfi\n\n");

	fprintf (script, "# Set SYN backlog buffer to '64'\n");
	fprintf (script, "if [ -e /proc/sys/net/ipv4/tcp_max_syn_backlog ]; then\n"
	"  echo 64 > /proc/sys/net/ipv4/tcp_max_syn_backlog\nfi\n\n");
	
	fprintf (script, "# Set SYN retry attempts to '6'\n");
	fprintf (script, "if [ -e /proc/sys/net/ipv4/tcp_syn_retries ]; then\n"
	"  echo 6 > /proc/sys/net/ipv4/tcp_syn_retries\nfi\n\n");
	
   fprintf (script, "\n# --------( Sysctl Tuning - Routing / Redirection Parameters )--------\n\n");

/* under 2.4 - source route verification only has 0 (off) and 1 (RFC compliant) */

	fprintf (script, "# Turn on source address verification in kernel\n");
	fprintf (script, "if [ -e /proc/sys/net/ipv4/conf/all/rp_filter ]; then\n"
	"  for f in /proc/sys/net/ipv4/conf/*/rp_filter\n  do\n   echo 1 > $f\n  done\nfi\n\n");
	
	fprintf (script, "# Turn off source routes in kernel\n");
	fprintf (script, "if [ -e /proc/sys/net/ipv4/conf/all/accept_source_route ]; then\n"
	"  for f in /proc/sys/net/ipv4/conf/*/accept_source_route\n  do\n   echo 0 > $f\n  done\nfi\n\n");

	fprintf (script, "# Do not respond to 'redirected' packets\n");
	fprintf (script, "if [ -e /proc/sys/net/ipv4/secure_redirects ]; then\n"
	"  echo 0 > /proc/sys/net/ipv4/secure_redirects\nfi\n\n");
	
	fprintf (script, "# Do not reply to 'redirected' packets if requested\n");
	fprintf (script, "if [ -e /proc/sys/net/ipv4/send_redirects ]; then\n"
	"  echo 0 > /proc/sys/net/ipv4/send_redirects\nfi\n\n");
    
	fprintf (script, "# Do not reply to 'proxyarp' packets\n");