From 4ca93e73238c31ec0e0496709ff83c98cf32562f Mon Sep 17 00:00:00 2001 From: "David M. Syzdek" Date: Mon, 29 Jul 2019 14:45:54 -0800 Subject: Adding ability to change order in which files are processed --- src/bbfw.conf-example.in | 47 ++++++++++ src/bbfw.in | 222 ++++++++++++++++++++++++++++++++++++----------- 2 files changed, 216 insertions(+), 53 deletions(-) diff --git a/src/bbfw.conf-example.in b/src/bbfw.conf-example.in index e8a62fa..24a8955 100644 --- a/src/bbfw.conf-example.in +++ b/src/bbfw.conf-example.in @@ -45,4 +45,51 @@ # verbose = yes +# Options which specify order of executions or loading of rules use the +# following keywords: +# +# global - files within %{firewall_dir}/global.d/ +# apps - files within %{firewall_dir}/apps.d/%{app}/ +# cluster - files within %{firewall_dir}/cluster.d/ +# local - files within %{firewall_dir}/ +# +# Types of files are always processed in the following order: +# +# pre-hooks (start and stop) +# ipsets load (start only) +# iptables load (start only) +# iptables flush (stop only / not user definable) +# ipsets flush (stop only / not user definable) +# post-hooks (start and stop) +# + + +# The `order_prehook` option defines the order in which pre-hooks are +# executed. To modify the order in which pre-hooks are executed, uncomment +# the line below and modify the order of the key words. See above for +# keyword descriptions. +# order_prehook = global apps cluster local + + +# The `order_posthook` option defines the order in which post-hooks are +# executed. To modify the order in which post-hooks are executed, uncomment +# the line below and modify the order of the key words. See above for +# keyword descriptions. +# order_posthook = global apps cluster local + + +# The `order_ipsets` option defines the order in which ipsets are +# loaded. To modify the order in which ipsets are loaded, uncomment +# the line below and modify the order of the key words. See above for +# keyword descriptions. +# order_ipsets = global apps cluster local + + +# The `order_iptables` option defines the order in which iptables +# and ip6tables are loaded. To modify the order in which rules are loaded, +# uncomment the line below and modify the order of the key words. See above +# for keyword descriptions. +# order_iptables = apps local cluster global + + # end of configuration diff --git a/src/bbfw.in b/src/bbfw.in index 00c45b9..40fdcb8 100755 --- a/src/bbfw.in +++ b/src/bbfw.in @@ -82,6 +82,10 @@ FW_PREFIX=@sysconfdir@/firewall.d/ FW_CONF=@sysconfdir@/bbfw.conf FW_QUIET=no FW_VERBOSE=no +FW_ORDER_PRE="global apps cluster local" +FW_ORDER_POST="global apps cluster local" +FW_ORDER_IPSETS="global apps cluster local" +FW_ORDER_IPTABLES="apps local cluster global" ########### @@ -218,70 +222,159 @@ load() # Function to start the network: start() { # run pre-hooks - run_hook start ${FW_PREFIX}/global.d/pre-hook "running global pre-hook start ..." - for FILE in $( find_appfile pre-hook );do - run_hook start ${FILE} "running app pre-hook start (App: $(name_appfile ${FILE})) ..." + for LEVEL in ${FW_ORDER_PRE};do + case "${LEVEL}" in + global) + run_hook start ${FW_PREFIX}/global.d/pre-hook "running global pre-hook start ..." + ;; + + apps) + for FILE in $( find_appfile pre-hook );do + run_hook start ${FILE} "running app pre-hook start (App: $(name_appfile ${FILE})) ..." + done + ;; + + cluster) + run_hook start ${FW_PREFIX}/cluster.d/pre-hook "running cluster pre-hook start ..." + ;; + + local) + run_hook start ${FW_PREFIX}/pre-hook "running local pre-hook start ..." + ;; + + *) + echo "Unknown pre-hook order \"${LEVEL}\"" + ;; + esac done - run_hook start ${FW_PREFIX}/cluster.d/pre-hook "running cluster pre-hook start ..." - run_hook start ${FW_PREFIX}/pre-hook "running local pre-hook start ..." # create IP sets - load ipset ${FW_PREFIX}/global.d/ipsets "adding global IP sets" - for FILE in $( find_appfile ipsets );do - load ipset ${FILE} "adding IP sets (App: $(name_appfile ${FILE})) ..." + for LEVEL in ${FW_ORDER_IPSETS};do + case "${LEVEL}" in + global) + load ipset ${FW_PREFIX}/global.d/ipsets "adding global IP sets" + ;; + + apps) + for FILE in $( find_appfile ipsets );do + load ipset ${FILE} "adding IP sets (App: $(name_appfile ${FILE})) ..." + done + ;; + + cluster) + load ipset ${FW_PREFIX}/cluster.d/ipsets "adding cluster IP sets" + ;; + + local) + load ipset ${FW_PREFIX}/ipsets "adding local IP sets" + ;; + + *) + echo "Unknown ipsets order \"${LEVEL}\"" + ;; + esac done - load ipset ${FW_PREFIX}/cluster.d/ipsets "adding cluster IP sets" - load ipset ${FW_PREFIX}/ipsets "adding local IP sets" - # Application rules - for FILE in $( find_appfile rules4 );do - load iptables ${FILE} "adding IPv4 rules (App: $(name_appfile ${FILE})) ..." + # loads iptables/ip6tables + for LEVEL in ${FW_ORDER_IPTABLES};do + case "${LEVEL}" in + apps) + for FILE in $( find_appfile rules4 );do + load iptables ${FILE} "adding IPv4 rules (App: $(name_appfile ${FILE})) ..." + done + for FILE in $( find_appfile rules6 );do + load ip6tables ${FILE} "adding IPv6 rules (App: $(name_appfile ${FILE})) ..." + done + for FILE in $( find_appfile rules );do + load iptables ${FILE} "adding IPv4/IPv6 rules (App: $(name_appfile ${FILE})) ..." + load ip6tables ${FILE} + done + ;; + + local) + load iptables ${FW_PREFIX}/rules4 "adding IPv4 local rules" + load ip6tables ${FW_PREFIX}/rules6 "adding IPv6 local rules" + load iptables ${FW_PREFIX}/rules "adding IPv4/IPv6 local rules" + load ip6tables ${FW_PREFIX}/rules + ;; + + cluster) + load iptables ${FW_PREFIX}/cluster.d/rules4 "adding IPv4 cluster rules" + load ip6tables ${FW_PREFIX}/cluster.d/rules6 "adding IPv6 cluster rules" + load iptables ${FW_PREFIX}/cluster.d/rules "adding IPv4/IPv6 cluster rules" + load ip6tables ${FW_PREFIX}/cluster.d/rules + ;; + + global) + load iptables ${FW_PREFIX}/global.d/rules4 "adding IPv4 global rules" + load ip6tables ${FW_PREFIX}/global.d/rules6 "adding IPv6 global rules" + load iptables ${FW_PREFIX}/global.d/rules "adding IPv4/IPv6 global rules" + load ip6tables ${FW_PREFIX}/global.d/rules + ;; + + *) + echo "Unknown iptables order \"${LEVEL}\"" + ;; + esac done - for FILE in $( find_appfile rules6 );do - load ip6tables ${FILE} "adding IPv6 rules (App: $(name_appfile ${FILE})) ..." - done - for FILE in $( find_appfile rules );do - load iptables ${FILE} "adding IPv4/IPv6 rules (App: $(name_appfile ${FILE})) ..." - load ip6tables ${FILE} - done - - # apply host specific firewall rules - load iptables ${FW_PREFIX}/rules4 "adding IPv4 local rules" - load ip6tables ${FW_PREFIX}/rules6 "adding IPv6 local rules" - load iptables ${FW_PREFIX}/rules "adding IPv4/IPv6 local rules" - load ip6tables ${FW_PREFIX}/rules - - # apply cluster specific firewall rules - load iptables ${FW_PREFIX}/cluster.d/rules4 "adding IPv4 cluster rules" - load ip6tables ${FW_PREFIX}/cluster.d/rules6 "adding IPv6 cluster rules" - load iptables ${FW_PREFIX}/cluster.d/rules "adding IPv4/IPv6 cluster rules" - load ip6tables ${FW_PREFIX}/cluster.d/rules - - # apply company policy for firewall rules - load iptables ${FW_PREFIX}/global.d/rules4 "adding IPv4 global rules" - load ip6tables ${FW_PREFIX}/global.d/rules6 "adding IPv6 global rules" - load iptables ${FW_PREFIX}/global.d/rules "adding IPv4/IPv6 global rules" - load ip6tables ${FW_PREFIX}/global.d/rules # run post-hooks - run_hook start ${FW_PREFIX}/global.d/post-hook "running global post-hook start ..." - for FILE in $( find_appfile post-hook );do - run_hook start ${FILE} "running app post-hook start (App: $(name_appfile ${FILE})) ..." + for LEVEL in ${FW_ORDER_POST};do + case "${LEVEL}" in + global) + run_hook start ${FW_PREFIX}/global.d/post-hook "running global post-hook start ..." + ;; + + apps) + for FILE in $( find_appfile post-hook );do + run_hook start ${FILE} "running app post-hook start (App: $(name_appfile ${FILE})) ..." + done + ;; + + cluster) + run_hook start ${FW_PREFIX}/cluster.d/post-hook "running cluster post-hook start ..." + ;; + + local) + run_hook start ${FW_PREFIX}/post-hook "running local post-hook start ..." + ;; + + *) + echo "Unknown post-hook order \"${LEVEL}\"" + ;; + esac done - run_hook start ${FW_PREFIX}/cluster.d/post-hook "running cluster post-hook start ..." - run_hook start ${FW_PREFIX}/post-hook "running local post-hook start ..." } # Function to stop the network: stop() { # run pre-hooks - run_hook stop ${FW_PREFIX}/global.d/pre-hook "running global pre-hook stop ..." - for FILE in $( find_appfile pre-hook );do - run_hook stop ${FILE} "running app pre-hook stop (App: $(name_appfile ${FILE})) ..." + for LEVEL in ${FW_ORDER_PRE};do + case "${LEVEL}" in + global) + run_hook stop ${FW_PREFIX}/global.d/pre-hook "running global pre-hook stop ..." + ;; + + apps) + for FILE in $( find_appfile pre-hook );do + run_hook stop ${FILE} "running app pre-hook stop (App: $(name_appfile ${FILE})) ..." + done + ;; + + cluster) + run_hook stop ${FW_PREFIX}/cluster.d/pre-hook "running cluster pre-hook stop ..." + ;; + + local) + run_hook stop ${FW_PREFIX}/pre-hook "running local pre-hook stop ..." + ;; + + *) + echo "Unknown pre-hook order \"${LEVEL}\"" + ;; + esac done - run_hook stop ${FW_PREFIX}/cluster.d/pre-hook "running cluster pre-hook stop ..." - run_hook stop ${FW_PREFIX}/pre-hook "running local pre-hook stop ..." # flushes iptables for TABLE in $(iptables-save |grep '^*' |sed -e 's/^*//g' |sort);do @@ -323,12 +416,31 @@ stop() { done # run post-hooks - run_hook stop ${FW_PREFIX}/global.d/post-hook "running global post-hook stop ..." - for FILE in $( find_appfile post-hook );do - run_hook stop ${FILE} "running app post-hook stop (App: $(name_appfile ${FILE})) ..." + for LEVEL in ${FW_ORDER_POST};do + case "${LEVEL}" in + global) + run_hook stop ${FW_PREFIX}/global.d/post-hook "running global post-hook stop ..." + ;; + + apps) + for FILE in $( find_appfile post-hook );do + run_hook stop ${FILE} "running app post-hook stop (App: $(name_appfile ${FILE})) ..." + done + ;; + + cluster) + run_hook stop ${FW_PREFIX}/cluster.d/post-hook "running cluster post-hook stop ..." + ;; + + local) + run_hook stop ${FW_PREFIX}/post-hook "running local post-hook stop ..." + ;; + + *) + echo "Unknown post-hook order \"${LEVEL}\"" + ;; + esac done - run_hook stop ${FW_PREFIX}/cluster.d/post-hook "running cluster post-hook stop ..." - run_hook stop ${FW_PREFIX}/post-hook "running local post-hook stop ..." } @@ -340,6 +452,10 @@ stop() { FW_PREFIX="$( config_option firewall_dir "${FW_PREFIX}" )" FW_QUIET="$( config_option quiet "${FW_QUIET}" A-Z a-z )" FW_VERBOSE="$( config_option verbose "${FW_VERBOSE}" A-Z a-z )" +FW_ORDER_PRE="$( config_option order_prehook "${FW_ORDER_PRE}" A-Z a-z )" +FW_ORDER_POST="$( config_option order_posthook "${FW_ORDER_POST}" A-Z a-z )" +FW_ORDER_IPTABLES="$( config_option order_iptables "${FW_ORDER_IPTABLES}" A-Z a-z )" +FW_ORDER_IPSETS="$( config_option order_ipsets "${FW_ORDER_IPSETS}" A-Z a-z )" # checks and normalizes options -- cgit v1.2.3