Re: [Users] iptables and _updown

From: Andreas Steffen (andreas.steffen_at_strongsec.net)
Date: Tue Aug 06 2002 - 15:38:06 CEST


Oops, I forgot to append the attachment! Here it comes.

Regards

Andreas

======================================================================
Andreas Steffen e-mail: andreas.steffen_at_strongsec.com
strongSec GmbH phone: +41 76 340 25 56
Alter Zürichweg 20 home: http://www.strongsec.com
CH-8952 Schlieren (Switzerland)
==========================================[strong internet security]==


#! /bin/sh
#
# customized updown script
#

# logging of VPN connections
#
# tag put in front of each log entry:
TAG=vpn
#
# syslog facility and priority used:
FAC_PRIO=local0.notice
#
# to create a special vpn logging file, put the following line into
# the syslog configuration file /etc/syslog.conf:
#
# local0.notice -/var/log/vpn
#
# check interface version
case "$PLUTO_VERSION" in
1.[0]) # Older Pluto?!? Play it safe, script may be using new features.
        echo "$0: obsolete interface version \`$PLUTO_VERSION'," >&2
        echo "$0: called by obsolete Pluto?" >&2
        exit 2
        ;;
1.*) ;;
*) echo "$0: unknown interface version \`$PLUTO_VERSION'" >&2
        exit 2
        ;;
esac

# check parameter(s)
case "$1:$*" in
':') # no parameters
        ;;
ipfwadm:ipfwadm) # due to (left/right)firewall; for default script only
        ;;
custom:*) # custom parameters (see above CAUTION comment)
        ;;
*) echo "$0: unknown parameters \`$*'" >&2
        exit 2
        ;;
esac

# utility functions for route manipulation
# Meddling with this stuff should not be necessary and requires great care.
uproute() {
        doroute add
}
downroute() {
        doroute del
}
doroute() {
        parms="-net $PLUTO_PEER_CLIENT_NET netmask $PLUTO_PEER_CLIENT_MASK"
        parms2="dev $PLUTO_INTERFACE gw $PLUTO_NEXT_HOP"
        case "$PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK" in
        "0.0.0.0/0.0.0.0")
                # horrible kludge for obscure routing bug with opportunistic
                it="route $1 -net 0.0.0.0 netmask 128.0.0.0 $parms2 &&"
                it="$it route $1 -net 128.0.0.0 netmask 128.0.0.0 $parms2"
                route $1 -net 0.0.0.0 netmask 128.0.0.0 $parms2 &&
                        route $1 -net 128.0.0.0 netmask 128.0.0.0 $parms2
                ;;
        *) it="route $1 $parms $parms2"
                route $1 $parms $parms2
                ;;
        esac
        st=$?
        if test $st -ne 0
        then
                # route has already given its own cryptic message
                echo "$0: \`$it' failed" >&2
                if test " $1 $st" = " add 7"
                then
                        # another totally undocumented interface -- 7 and
                        # "SIOCADDRT: Network is unreachable" means that
                        # the gateway isn't reachable.
                        echo "$0: (incorrect or missing nexthop setting??)" >&2
                fi
        fi
        return $st
}

# the big choice
case "$PLUTO_VERB:$1" in
prepare-host:*|prepare-client:*)
        # delete possibly-existing route (preliminary to adding a route)
        case "$PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK" in
        "0.0.0.0/0.0.0.0")
                # horrible kludge for obscure routing bug with opportunistic
                parms1="-net 0.0.0.0 netmask 128.0.0.0"
                parms2="-net 128.0.0.0 netmask 128.0.0.0"
                it="route del $parms1 2>&1 ; route del $parms2 2>&1"
                oops="`route del $parms1 2>&1 ; route del $parms2 2>&1`"
                ;;
        *)
                parms="-net $PLUTO_PEER_CLIENT_NET netmask $PLUTO_PEER_CLIENT_MASK"
                it="route del $parms 2>&1"
                oops="`route del $parms 2>&1`"
                ;;
        esac
        status="$?"
        if test " $oops" = " " -a " $status" != " 0"
        then
                oops="silent error, exit status $status"
        fi
        case "$oops" in
        'SIOCDELRT: No such process'*)
                # This is what route (currently -- not documented!) gives
                # for "could not find such a route".
                oops=
                status=0
                ;;
        esac
        if test " $oops" != " " -o " $status" != " 0"
        then
                echo "$0: \`$it' failed ($oops)" >&2
        fi
        exit $status
        ;;
route-host:*|route-client:*)
        # connection to me or my client subnet being routed
        uproute
        ;;
unroute-host:*|unroute-client:*)
        # connection to me or my client subnet being unrouted
        downroute
        ;;
up-host:*)
        # connection to me coming up
        # If you are doing a custom version, firewall commands go here.
        if [ "$PLUTO_MY_PROTOCOL" == "6" ] || [ "$PLUTO_MY_PROTOCOL" == "17" ]
        then
          iptables -I INPUT 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
            -s $PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK --sport $PLUTO_PEER_PORT \
            -d 0.0.0.0/0.0.0.0 --dport $PLUTO_MY_PORT -j ACCEPT
          iptables -I OUTPUT 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
            -s 0.0.0.0/0.0.0.0 --sport $PLUTO_MY_PORT \
            -d $PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK --dport $PLUTO_PEER_PORT -j ACCEPT
        else
          iptables -I INPUT 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
            -s $PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK \
            -j ACCEPT
          iptables -I OUTPUT 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
            -d $PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK -j ACCEPT
        fi
        if [ "$PLUTO_PEER_CLIENT" == "$PLUTO_PEER/32" ]
        then
          logger -t $TAG -p $FAC_PRIO \
            "+ $PLUTO_PEER_ID $PLUTO_PEER -- $PLUTO_ME"
        else
          logger -t $TAG -p $FAC_PRIO \
            "+ $PLUTO_PEER_ID $PLUTO_PEER_CLIENT == $PLUTO_PEER -- $PLUTO_ME"
        fi
        ;;
down-host:*)
        # connection to me going down
        # If you are doing a custom version, firewall commands go here.
        if [ "$PLUTO_MY_PROTOCOL" == "6" ] || [ "$PLUTO_MY_PROTOCOL" == "17" ]
        then
          iptables -D INPUT -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
            -s $PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK --sport $PLUTO_PEER_PORT \
            -j ACCEPT
          iptables -D OUTPUT -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
            -d $PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK --dport $PLUTO_PEER_PORT -j ACCEPT
        else
          iptables -D INPUT -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
            -s $PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK \
            -j ACCEPT
          iptables -D OUTPUT -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
            -d $PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK -j ACCEPT
        fi
        if [ "$PLUTO_PEER_CLIENT" == "$PLUTO_PEER/32" ]
        then
          logger -t $TAG -p $FAC_PRIO -- \
            "- $PLUTO_PEER_ID $PLUTO_PEER -- $PLUTO_ME"
        else
          logger -t $TAG -p $FAC_PRIO -- \
          "- $PLUTO_PEER_ID $PLUTO_PEER_CLIENT == $PLUTO_PEER -- $PLUTO_ME"
        fi
        ;;
up-client:)
        # connection to my client subnet coming up
        # If you are doing a custom version, firewall commands go here.
        if [ "$PLUTO_MY_PROTOCOL" == "6" ] || [ "$PLUTO_MY_PROTOCOL" == "17" ]
        then
          iptables -I FORWARD 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
            -s $PLUTO_MY_CLIENT_NET/$PLUTO_MY_CLIENT_MASK --sport $PLUTO_MY_PORT \
            -d $PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK --dport $PLUTO_PEER_PORT -j ACCEPT
          iptables -I FORWARD 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
            -s $PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK --sport $PLUTO_PEER_PORT \
            -d $PLUTO_MY_CLIENT_NET/$PLUTO_MY_CLIENT_MASK --dport $PLUTO_MY_PORT -j ACCEPT
        else
          iptables -I FORWARD 1 -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
            -s $PLUTO_MY_CLIENT_NET/$PLUTO_MY_CLIENT_MASK \
            -d $PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK -j ACCEPT
          iptables -I FORWARD 1 -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
            -s $PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK \
            -d $PLUTO_MY_CLIENT_NET/$PLUTO_MY_CLIENT_MASK -j ACCEPT
        fi
        if [ "$PLUTO_PEER_CLIENT" == "$PLUTO_PEER/32" ]
        then
          logger -t $TAG -p $FAC_PRIO \
            "+ $PLUTO_PEER_ID $PLUTO_PEER -- $PLUTO_ME == $PLUTO_MY_CLIENT"
        else
          logger -t $TAG -p $FAC_PRIO \
            "+ $PLUTO_PEER_ID $PLUTO_PEER_CLIENT == $PLUTO_PEER -- $PLUTO_ME == $PLUTO_MY_CLIENT"
        fi
        ;;
down-client:)
        # connection to my client subnet going down
        # If you are doing a custom version, firewall commands go here.
        if [ "$PLUTO_MY_PROTOCOL" == "6" ] || [ "$PLUTO_MY_PROTOCOL" == "17" ]
        then
          iptables -D FORWARD -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
            -s $PLUTO_MY_CLIENT_NET/$PLUTO_MY_CLIENT_MASK --sport $PLUTO_MY_PORT \
            -d $PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK --dport $PLUTO_PEER_PORT -j ACCEPT
          iptables -D FORWARD -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
            -s $PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK --sport $PLUTO_PEER_PORT \
            -d $PLUTO_MY_CLIENT_NET/$PLUTO_MY_CLIENT_MASK --dport $PLUTO_MY_PORT -j ACCEPT
        else
          iptables -D FORWARD -o $PLUTO_INTERFACE -p $PLUTO_PEER_PROTOCOL \
            -s $PLUTO_MY_CLIENT_NET/$PLUTO_MY_CLIENT_MASK \
            -d $PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK -j ACCEPT
          iptables -D FORWARD -i $PLUTO_INTERFACE -p $PLUTO_MY_PROTOCOL \
            -s $PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK \
            -d $PLUTO_MY_CLIENT_NET/$PLUTO_MY_CLIENT_MASK -j ACCEPT
        fi
        if [ "$PLUTO_PEER_CLIENT" == "$PLUTO_PEER/32" ]
        then
          logger -t $TAG -p $FAC_PRIO -- \
            "- $PLUTO_PEER_ID $PLUTO_PEER -- $PLUTO_ME == $PLUTO_MY_CLIENT"
        else
          logger -t $TAG -p $FAC_PRIO -- \
            "- $PLUTO_PEER_ID $PLUTO_PEER_CLIENT == $PLUTO_PEER -- $PLUTO_ME == $PLUTO_MY_CLIENT"
        fi
        ;;
up-client:ipfwadm)
        # connection to client subnet, with (left/right)firewall=yes, coming up
        # This is used only by the default updown script, not by your custom
        # ones, so do not mess with it; see CAUTION comment up at top.
        ipfwadm -F -i accept -b -S $PLUTO_MY_CLIENT_NET/$PLUTO_MY_CLIENT_MASK \
                -D $PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK
        ;;
down-client:ipfwadm)
        # connection to client subnet, with (left/right)firewall=yes, going down
        # This is used only by the default updown script, not by your custom
        # ones, so do not mess with it; see CAUTION comment up at top.
        ipfwadm -F -d accept -b -S $PLUTO_MY_CLIENT_NET/$PLUTO_MY_CLIENT_MASK \
                -D $PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK
        ;;
*) echo "$0: unknown verb \`$PLUTO_VERB' or parameter \`$1'" >&2
        exit 1
        ;;
esac

_______________________________________________
Users mailing list
Users_at_lists.freeswan.org
http://lists.freeswan.org/mailman/listinfo/users



This archive was generated by hypermail 2.1.4 : Tue Aug 06 2002 - 18:19:29 CEST