-
Notifications
You must be signed in to change notification settings - Fork 1
/
ChangeLog
2139 lines (1903 loc) · 83.2 KB
/
ChangeLog
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
RCS file: /cvsroot/firehol/firehol/firehol.sh,v
Working file: firehol.sh
head: 1.296
branch:
locks: strict
access list:
symbolic names:
start: 1.1.1.1
vendor: 1.1.1
keyword substitution: kv
total revisions: 297; selected revisions: 297
description:
----------------------------
revision 1.296
date: 2013/01/06 23:49:08; author: ktsaou; state: Exp; lines: +9 -8
Removed depedency to get-iana.sh
It is not usefull any more.
----------------------------
revision 1.295
date: 2013/01/06 23:26:04; author: ktsaou; state: Exp; lines: +11 -8
Updated blackist command so that it does not lead to timeouts when an internal host is trying to reach a blacklisted host.
----------------------------
revision 1.294
date: 2010/10/05 21:10:08; author: ktsaou; state: Exp; lines: +7 -7
Updated RESERVED_IPS
----------------------------
revision 1.293
date: 2010/04/08 22:27:18; author: ktsaou; state: Exp; lines: +16 -16
Removed unnecessary quotes from logs.
----------------------------
revision 1.292
date: 2010/04/08 22:16:03; author: ktsaou; state: Exp; lines: +10 -6
Added service:
sane
----------------------------
revision 1.291
date: 2010/04/08 22:12:35; author: ktsaou; state: Exp; lines: +13 -6
Added services:
ipsecnatt
l2tp
----------------------------
revision 1.290
date: 2010/04/08 21:55:07; author: ktsaou; state: Exp; lines: +7 -7
Fixed bug: 2873689
Mispelled server_yppasswdd.
----------------------------
revision 1.289
date: 2010/04/08 21:51:26; author: ktsaou; state: Exp; lines: +12 -6
Added support for NFLOG as requested per patch 2954470.
----------------------------
revision 1.288
date: 2010/04/06 22:23:16; author: ktsaou; state: Exp; lines: +47 -6
Added support to block concurrent running of FireHOL by multiple admins.
FireHOL uses the lockfile command, if it finds it, allowing to detect
stale locks if 600 seconds have been passed since the last lock.
The lock file is /var/run/firehol.lck
----------------------------
revision 1.287
date: 2009/10/01 10:25:23; author: ktsaou; state: Exp; lines: +8 -7
Fixed issue with TRY and START.
----------------------------
revision 1.286
date: 2009/02/26 02:13:54; author: ktsaou; state: Exp; lines: +128 -61
Added syslog support. FireHOL now logs to syslog all important events.
Variable for the user:
FIREHOL_SYSLOG_FACILITY="daemon"
Default is shown. User can set it in config file.
----------------------------
revision 1.285
date: 2009/02/25 23:30:14; author: ktsaou; state: Exp; lines: +19 -7
Made it detect when the simple services have either server or client ports
defined, but not both.
----------------------------
revision 1.284
date: 2009/02/22 00:35:16; author: ktsaou; state: Exp; lines: +12 -10
Fixed an issue where the wizard/helpme generated too long names.
----------------------------
revision 1.283
date: 2009/02/21 21:42:07; author: ktsaou; state: Exp; lines: +28 -19
Updated the kernel module handling for certain helpers.
----------------------------
revision 1.282
date: 2009/02/19 05:27:49; author: ktsaou; state: Exp; lines: +259 -182
Added helper_<service>="helper" functionality.
This allows to consider as simple all the services which rely on a kernel
netfilter module.
Converted the following services to simple:
amanda, ftp, pptp, tftp
Updated the following simple services to use kernel modules:
h323, GRE, sip
----------------------------
revision 1.281
date: 2009/02/19 02:47:36; author: ktsaou; state: Exp; lines: +8 -8
Fixed ftp helper match to allow only ESTABLISHED or RELATED connections.
Otherwise it would allow NEW connections in the reverse direction too.
----------------------------
revision 1.280
date: 2009/02/19 02:33:08; author: ktsaou; state: Exp; lines: +37 -91
Updated service ftp to match everything with the kernel ftp helper.
Removed incomplete p2p service.
----------------------------
revision 1.279
date: 2009/02/06 04:18:31; author: ktsaou; state: Exp; lines: +8 -6
Service SIP now uses the kernel modules.
----------------------------
revision 1.278
date: 2009/02/05 02:45:00; author: ktsaou; state: Exp; lines: +9 -9
Fixed a copy and paste error in connmark helper.
----------------------------
revision 1.277
date: 2009/02/05 02:03:07; author: ktsaou; state: Exp; lines: +63 -7
Updated RESERVED_IPS for the latest IANA reservations.
Added classify helper for traffic shapping without marks.
Added connmark helper for statefull connection marking to assist the
routing decision (i.e. multiple upstream providers).
----------------------------
revision 1.276
date: 2008/12/02 20:28:02; author: ktsaou; state: Exp; lines: +16 -16
Renamed fixtos to tosfix, optimize it a bit, and added documentation about it.
----------------------------
revision 1.275
date: 2008/12/02 20:01:11; author: ktsaou; state: Exp; lines: +35 -6
Added fixtos helper to mangle packets that may have invalid TOS
----------------------------
revision 1.274
date: 2008/08/09 21:48:02; author: ktsaou; state: Exp; lines: +44 -12
fixed tcpmss issue described in bug 2043915.
It seems that LARTC is very old for this.
----------------------------
revision 1.273
date: 2008/07/31 00:46:41; author: ktsaou; state: Exp; lines: +7 -7
update RESERVED_IPS according to latest IANA reservations.
----------------------------
revision 1.272
date: 2008/04/09 21:03:13; author: ktsaou; state: Exp; lines: +7 -7
Updated IANA reservations.
----------------------------
revision 1.271
date: 2008/03/17 22:08:43; author: ktsaou; state: Exp; lines: +7 -7
Updated for latest IANA reservations format.
----------------------------
revision 1.270
date: 2007/12/11 22:05:24; author: ktsaou; state: Exp; lines: +47 -6
Added service xbox.
This is not final, as it opens all unprivileged UDP ports to anyone from source port UDP 3074.
----------------------------
revision 1.269
date: 2007/12/08 10:39:06; author: ktsaou; state: Exp; lines: +23 -23
Fixed the operation of FIREHOL_DROP_ORPHAN_TCP_ACK_FIN. It did not work
because it was also checking for a NEW state (which is not the case).
----------------------------
revision 1.268
date: 2007/11/30 19:22:36; author: ktsaou; state: Exp; lines: +7 -7
Updated RESERVED_IPS
----------------------------
revision 1.267
date: 2007/10/25 12:34:06; author: ktsaou; state: Exp; lines: +13 -13
Changed all service definitions which can use client ports bellow 1024 to
allow client connections from any possible port, because when natted, these
services will me remapped to client ports bellow 1024 without any
restriction on the port range.
----------------------------
revision 1.266
date: 2007/10/15 00:43:17; author: ktsaou; state: Exp; lines: +95 -37
'less' is no more required. Now FireHOL can use 'less', 'more' or 'cat'
in that order, for a pager.
FireHOL will now correctly use 'zcat', 'gzcat' or 'gzip' for uncompressing
/proc/config.gz, and it will ignore /proc/config.gz if it cannot
find any of these commands (with a warning).
There was a case, where an attacker could use firehol to execute a custom
script, if it was saved at a location where the kernel config file is
expected by firehol, and /proc/config, /proc/config.gz did not exist.
FireHOL now greps the kernel config file for the information it needs, so
this threat has been eliminated.
Updated the line number management of the configuration file, using the
latest user commands offered by firehol.
----------------------------
revision 1.265
date: 2007/10/14 23:02:39; author: ktsaou; state: Exp; lines: +11 -11
Replace gzcat with zcat.
----------------------------
revision 1.264
date: 2007/10/14 23:00:41; author: ktsaou; state: Exp; lines: +7 -7
Updated RESERVED_IPS to latest IANA reservations.
----------------------------
revision 1.263
date: 2007/08/20 02:03:28; author: ktsaou; state: Exp; lines: +8 -8
Made the helpme wizard correctly recognize services listening on the IPv6
equivalent of 0.0.0.0 (::).
----------------------------
revision 1.262
date: 2007/08/20 00:53:22; author: ktsaou; state: Exp; lines: +8 -8
Changed the protections to activate the 'invalid' match last, after all
other protections.
----------------------------
revision 1.261
date: 2007/07/30 22:52:48; author: ktsaou; state: Exp; lines: +39 -39
Various updates in 'helpme' mode.
There is still one issue unsolved: When there are routes to specific nets
befind a gateway, FireHOL checks if the IP of the host or the gateway are
inside the networks routed through the gateway. This is wrong. In several
cases, the network behind a gateway will not include the IP of the gateway
or the IP of the interface the firehol host routes this traffic via.
However, there seems to be no easy solution to this. For PPP interfaces the
IP of the PPP concentrator is included in the IPs that are reported by
'ip route show dev ppp0' as the networks behind this device.
May be the 'scope' paramater of the routing table should be used to exclude
'scope link' routes. If 'scope link' routes are ommitted, the resulting set
could be used to identify the routes behind a router.
----------------------------
revision 1.260
date: 2007/07/26 21:39:50; author: ktsaou; state: Exp; lines: +7 -7
Updated RESERVED_IPS.
----------------------------
revision 1.259
date: 2007/07/20 21:28:13; author: ktsaou; state: Exp; lines: +11 -8
Service multicast has been changed to match dst 224.0.0.0/4 proto IGMP and
UDP.
----------------------------
revision 1.258
date: 2007/07/20 21:16:59; author: ktsaou; state: Exp; lines: +49 -18
Various minor fixed.
firehol 'save' now saves also the required kernel modules to restore the
firewall at /var/spool/firehol/last_save_modules.sh.
This is executable already and can be called from boot scripts to load
the kernel modules required when restoring the firewall with:
iptables-restore
----------------------------
revision 1.257
date: 2007/07/20 19:58:38; author: ktsaou; state: Exp; lines: +55 -7
Added helper action:
action [chain <name> <action>]
The action helper creates an iptables chain which can be used to control the
action of other firewall rules during runtime.
For example, you can setup the custom action ACT1, which by default is ACCEPT,
but under certain cases it can be changed to DROP, REJECT or RETURN without
restarting the firewall.
The first argument must always be the word 'chain', for the moment.
name can be any chain name accepted by iptables.
It is suggested to keep it between 5 to 10 letters.
action can be any action supported by FireHOL, although ony ACCEPT,
REJECT, DROP, RETURN may have any meaning under this use.
Example 1:
At the top of firehol.conf, create the action ACT1:
action chain ACT1 accept
later, in interfaces and routers, create rules that use the ACT1 action:
server smtp ACT1
client imap ACT1
Please note that actions created this way are case sensitive.
At some point, and while the firewall is running, the action ACT1 can be
changed to DROP, with this linux command (this is not FireHOL specific):
iptables -t filter -I ACT1 -j DROP
The above command inserts (-I) the new action DROP above the default
action ACCEPT, and therefore all the traffic matching the FireHOL rules that
have the action ACT1 will now be dropped.
To return to the default action (ACCEPT), run the following linux command:
iptables -t filter -D ACT1 -j DROP
This command deletes (-D) the DROP action that was inserted above the
default action. If you delete all actions in the chain ACT1, the default
action will be RETURN, in which case all rules with action ACT1 will be
nutralized (it will be the same as they were not specified at all in
firehol.conf).
Example 2:
action chain "ACT1 ACT2 ACT3" accept chain "ACT4 ACT5 ACT6" drop
will create 6 actions, ACT1, ACT2, ACT3 with ACCEPT, and
ACT4, ACT5, ACT6 with DROP.
----------------------------
revision 1.256
date: 2007/05/22 22:52:53; author: ktsaou; state: Exp; lines: +7 -7
Updated IANA RESERVED_IPS.
----------------------------
revision 1.255
date: 2007/05/06 14:42:43; author: ktsaou; state: Exp; lines: +23 -11
Made firehol correctly identify newer kernel options regarding iptables
modules (applies to kernels 2.6.20+).
----------------------------
revision 1.254
date: 2007/05/05 23:38:31; author: ktsaou; state: Exp; lines: +92 -8
Added support for external definitions of:
RESERVED_IPS
PRIVATE_IPS
MULTICAST_IPS
UNROUTABLE_IPS
in files under the same name in /etc/firehol/.
Only RESERVED_IPS is mandatory (firehol will complain if it is not there,
but it will still work without it), and is also the only file that firehol
checks how old is it. If it is 90+ days old, firehol will complain again.
Changed the supplied get-iana.sh script to generate the RESERVED_IPS file.
FireHOL also instructs the user to use this script if the file is missing
or is too old.
----------------------------
revision 1.253
date: 2007/04/29 18:38:41; author: ktsaou; state: Exp; lines: +7 -7
Updated RESERVED_IPS
----------------------------
revision 1.252
date: 2007/04/29 18:34:55; author: ktsaou; state: Exp; lines: +9 -9
BASH 3.2 support.
The problem is in array variables.
For some reason, an empty array member in BASH 3.1 produces no iptables
arguments, but in BASH 3.2 an empty array member produces an empty iptables
argument which breaks iptables.
----------------------------
revision 1.251
date: 2007/02/04 23:28:41; author: ktsaou; state: Exp; lines: +7 -7
Updated RESERVED_IPS.
----------------------------
revision 1.250
date: 2006/11/21 23:41:23; author: ktsaou; state: Exp; lines: +7 -7
Updated latest IANA RESERVED_IPS.
----------------------------
revision 1.249
date: 2006/06/05 17:47:48; author: ktsaou; state: Exp; lines: +11 -6
Applied patch of bug: 1498292, "nfs" service missing ports for "rpc.statd"
----------------------------
revision 1.248
date: 2006/06/05 17:25:33; author: ktsaou; state: Exp; lines: +53 -15
Added support for TARPIT.
Made 'policy' work for routers too.
----------------------------
revision 1.247
date: 2006/04/22 17:26:18; author: ktsaou; state: Exp; lines: +11 -6
Added protection 'bad-packets'.
----------------------------
revision 1.246
date: 2006/03/23 18:50:16; author: ktsaou; state: Exp; lines: +8 -8
Fixed bug 1455569:
When FireHOL has created the
$FIREHOL_SPOOL_DIR, it then runs chown and chmod on
the $FIREHOL_CONFIG_DIR. This looks like a
cut-n-paste error, since it at that point makes more
sense to chown/chmod $FIREHOL_SPOOL_DIR.
----------------------------
revision 1.245
date: 2006/03/12 12:54:55; author: ktsaou; state: Exp; lines: +7 -7
Updated RESERVED_IPS for latest IANA assignements.
----------------------------
revision 1.244
date: 2006/03/11 12:24:34; author: ktsaou; state: Exp; lines: +15 -7
Added service OSPF.
Make the wizard to ommit /32 from IPs since iptables now seems to complain
about it. Check bug: 1435098
----------------------------
revision 1.243
date: 2006/01/18 21:24:22; author: ktsaou; state: Exp; lines: +7 -7
Updated RESERVED_IPS.
----------------------------
revision 1.242
date: 2006/01/18 21:20:28; author: ktsaou; state: Exp; lines: +7 -7
Fixed the SIP service to allow port 5060 for the client (had only 'default').
----------------------------
revision 1.241
date: 2005/11/19 09:38:25; author: ktsaou; state: Exp; lines: +7 -7
Added tcp/8333 to vmwareweb
----------------------------
revision 1.240
date: 2005/11/11 21:49:03; author: ktsaou; state: Exp; lines: +70 -9
Added option 'recent' to action 'ACCEPT':
Example:
server smtp accept with recent NAME SECONDS HITS
where
NAME is a name for this RECENT match
SECONDS is a number, or empty ("")
HITS is a number, or empty ("")
Check:
iptables -m recent --help
for more information.
----------------------------
revision 1.239
date: 2005/10/27 23:46:01; author: ktsaou; state: Exp; lines: +9 -6
created a copy of "microsoft_ds" service as "ms_ds" to overcome the issue
of long chain names.
----------------------------
revision 1.238
date: 2005/10/16 08:55:53; author: ktsaou; state: Exp; lines: +24 -6
Added variable FIREHOL_DROP_ORPHAN_TCP_ACK_FIN which once set to 1 in the
config file, it makes FireHOL drop all packets that appear as NEW
connections to the connection tracker but they are TCP and have ACK and FIN
set.
This should eliminate the logs that appear in a few busy environments where
the iptables connection tracker removes entries from its table when it
sees the FIN and therefore the ACK,FIN is considered a NEW connection.
See also https://sourceforge.net/tracker/?func=detail&atid=487693&aid=1326811&group_id=58425
----------------------------
revision 1.237
date: 2005/09/21 21:32:58; author: ktsaou; state: Exp; lines: +16 -13
Made it dynamically detect /var/lock/subsys and switch back to /var/lock
if the first does not exist.
----------------------------
revision 1.236
date: 2005/06/02 16:20:35; author: ktsaou; state: Exp; lines: +7 -7
fixed a bug in negative 'mac' expressions where a faulty rule was generated
for matching mac-source 'any'.
----------------------------
revision 1.235
date: 2005/06/02 15:48:52; author: ktsaou; state: Exp; lines: +7 -7
Allowed 127.0.0.1 to be in RESERVED_IPS
----------------------------
revision 1.234
date: 2005/05/08 23:27:22; author: ktsaou; state: Exp; lines: +7 -7
Updated RESERVED_IPS to current IANA reservations.
----------------------------
revision 1.233
date: 2005/04/18 22:38:23; author: ktsaou; state: Exp; lines: +83 -8
Added 'addrtype' matches, in the form of 'srctype' and 'dsttype' optional
rule parameters.
----------------------------
revision 1.232
date: 2005/04/18 21:00:22; author: ktsaou; state: Exp; lines: +11 -10
Added FIREHOL_LOG_PREFIX.
----------------------------
revision 1.231
date: 2005/04/03 21:48:04; author: ktsaou; state: Exp; lines: +16 -6
Added experimental protection all-floods.
----------------------------
revision 1.230
date: 2005/03/01 19:52:56; author: ktsaou; state: Exp; lines: +7 -6
Made FireHOL trap SIGHUP and cleanup properly on it.
----------------------------
revision 1.229
date: 2005/02/17 23:45:02; author: ktsaou; state: Exp; lines: +64 -19
Made a set of external commands optional in wizard mode, so that FireHOL
will work if these are absent, but will refuse to enter wizard mode.
----------------------------
revision 1.228
date: 2005/02/09 22:36:24; author: ktsaou; state: Exp; lines: +17 -8
Added support for /proc/config.gz for kernel configuration.
This is silently ignored if the command 'gzcat' cannot be found in the
system path.
----------------------------
revision 1.227
date: 2005/02/07 20:56:09; author: ktsaou; state: Exp; lines: +31 -7
Made wget and curl optional. Now they are required only when they are
really needed.
Also, small fixes in ecn_shame helper.
----------------------------
revision 1.226
date: 2005/01/25 21:28:19; author: ktsaou; state: Exp; lines: +10 -10
Remove -p from mkdir commands, in order for them to fail if the directory
to be created already exists.
----------------------------
revision 1.225
date: 2005/01/25 21:07:01; author: ktsaou; state: Exp; lines: +12 -12
Made sure that no files are created anywhere except the firehol temp dir.
Made the firehol temp dir use the $RANDOM variable to randomize its name.
----------------------------
revision 1.224
date: 2005/01/24 22:24:48; author: ktsaou; state: Exp; lines: +8 -8
Fixed service pptp to control GRE traffic in a stateless way.
----------------------------
revision 1.223
date: 2005/01/24 21:23:38; author: ktsaou; state: Exp; lines: +145 -103
Added security checks to directory creation mechanism.
----------------------------
revision 1.222
date: 2005/01/21 19:58:09; author: ktsaou; state: Exp; lines: +9 -6
Added service DICT (kdict, gnome-dictionary).
----------------------------
revision 1.221
date: 2004/12/29 22:34:45; author: ktsaou; state: Exp; lines: +21 -14
Minor fixes for calculating minor firehol version number, added transparent
proxy to line number calculation and fix a typo in the docs.
----------------------------
revision 1.220
date: 2004/12/23 18:43:03; author: ktsaou; state: Exp; lines: +8 -6
The knock was not allowing established connections, and knockd was
inserting a rule with a -s which matched requests but did not match the
replies.
Now, the default is to allow established connections for knock and only
control NEW connections via knockd.
----------------------------
revision 1.219
date: 2004/12/22 23:05:57; author: ktsaou; state: Exp; lines: +38 -8
Small internal changes.
Added support for integration with knockd (http://www.zeroflux.org/knock/)
This integration comes as part of the ACCEPT action:
accept [with knock <name>]
The optional parameter 'with knock' allows easy integration with knockd,
a server that allows you to control access to services, by sending certain
packets to "knock" the door, before the door is open for service.
This parameter accepts just a name. This name is used to build a special
chain knock_<name> which will contain no rules, so that the traffic entering
this chain will just return back and continue to match against the other
rules until the end of the firewall.
As an example, lets say that you want to allow https traffic based on a knock.
In FireHOL you write:
server https accept with knock hidden
and you configure knockd so that it runs:
iptables -A knock_hidden -s %IP% -j ACCEPT
to enable the https service (notice that there is no need to match anything
else than the IP. FireHOL already matches everything needed for its rules
to work), and:
iptables -D knock_hidden -s %IP% -j ACCEPT
to disable this service for the given IP.
----------------------------
revision 1.218
date: 2004/12/21 21:49:11; author: ktsaou; state: Exp; lines: +24 -18
Added helper 'transparent_proxy' and modified 'transparent_squid' to call
the new helper for setting up transparent web proxies.
----------------------------
revision 1.217
date: 2004/12/03 21:29:41; author: ktsaou; state: Exp; lines: +36 -5
Added service TIMESTAMP.
----------------------------
revision 1.216
date: 2004/11/04 19:47:05; author: ktsaou; state: Exp; lines: +7 -7
Fixed a bug in FIREHOL_OUTPUT_ACTIVATION_POLICY which was incorrectly
setting the INPUT policy.
----------------------------
revision 1.215
date: 2004/11/02 00:37:15; author: ktsaou; state: Exp; lines: +38 -5
Added service ANYSTATELESS
----------------------------
revision 1.214
date: 2004/11/01 00:13:00; author: ktsaou; state: Exp; lines: +30 -10
Implemented minor version check on services in /etc/firehol/services
----------------------------
revision 1.213
date: 2004/10/31 03:17:00; author: ktsaou; state: Exp; lines: +9 -6
Fixed a type in DSCP optional rule parameter.
Added line numbering to newly added helpers.
----------------------------
revision 1.212
date: 2004/10/31 02:21:02; author: ktsaou; state: Exp; lines: +497 -256
Added helpers:
tos - to set the TOS of packets
dscp - to set the DSCP field of packets (both raw and class)
Added optional rule parameters:
tos - to match the TOS of packets
mark - to match the MARK ID of packets
dscp - to match the DSCP field of packets (both raw and class)
Added the following actions to the rule() function:
dscp
The rule() function already had support for TOS and MARK.
----------------------------
revision 1.211
date: 2004/10/30 23:03:57; author: ktsaou; state: Exp; lines: +35 -8
Created the complex service DHCP and removed the simple one.
The complex DHCP is now stateless to overcome all the problems that
arise due to the initial DHCP broadcast.
----------------------------
revision 1.210
date: 2004/10/30 22:41:21; author: ktsaou; state: Exp; lines: +16 -12
Service SAMBA now includes MICROSOFT_DS (tcp/445). Also, updated samba
related documentation.
----------------------------
revision 1.209
date: 2004/10/30 21:27:00; author: ktsaou; state: Exp; lines: +18 -8
Some error detection for /etc/firehol/services directory creation.
----------------------------
revision 1.208
date: 2004/10/30 21:13:26; author: ktsaou; state: Exp; lines: +109 -5
Added service NIS.
Created by Carlos Rodrigues <[email protected]>
Feature Requests item #1050951 <https://sourceforge.net/tracker/?func=detail&atid=487695&aid=1050951&group_id=58425>
These rules work for client access only!
Pushing changes to slave servers won't work if these rules are active
somewhere between the master and its slaves, because it is impossible to
predict the ports where "yppush" will be listening on each push.
Pulling changes directly on the slaves will work, and could be improved
performance-wise if these rules are modified to open "fypxfrd". This wasn't
done because it doesn't make that much sense since pushing changes on the
master server is the most common, and recommended, way to replicate maps.
----------------------------
revision 1.207
date: 2004/10/28 23:03:06; author: ktsaou; state: Exp; lines: +67 -13
Added support for externally defined services in files under directory:
/etc/firehol/services
This directory may contain files ending with .conf. Example: imap.conf
Each file should *start* with a line like this:
#FHVER: 1
This must be the FIRST line of the file.
The number 1 is the FIREHOL_SERVICES_API version number. If the API within
FireHOL changes, FireHOL will refuse to load all those services files that
their API version number does not match.
----------------------------
revision 1.206
date: 2004/10/28 22:02:43; author: ktsaou; state: Exp; lines: +9 -5
Added service nut.
----------------------------
revision 1.205
date: 2004/10/08 22:30:52; author: ktsaou; state: Exp; lines: +90 -46
Added helper 'tcpmss'.
Added service 'nntps'.
Converted all simple services' port definitions to numeric.
Updated documentation accordingly.
----------------------------
revision 1.204
date: 2004/09/26 00:52:55; author: ktsaou; state: Exp; lines: +55 -6
Added services:
asterisk, darkstat, distcc, eserver, gift, giftui, h323, iax, iax2, icp,
rtp, sip, stun, upnp.
----------------------------
revision 1.203
date: 2004/09/14 21:15:44; author: ktsaou; state: Exp; lines: +119 -7
Added support for options to the ACCEPT action in order to allow
a certain frequency of NEW connections per service.
Now the template for the ACCEPT action is this:
ACCEPT [with limit frequency burst [overflow action]]
for example:
server smtp accept with limit 10/s 100 overflow drop
which means there is now control for the frequency at which NEW incoming
connections are accepted and control is also provided for the overflow
NEW ones.
The default overflow action is REJECT which rejects TCP connections with
TCP-RESET and all others with ICMP-PORT-UNREACHABLE.
To add other optional rule parameters to the server/client/route command
just add them after the ACCEPT expression. For example:
server smtp accept with limit 10/s 1000 src 1.2.3.4
If there are overflow NEW connections, the firewall will log "OVERFLOW"
with the packets and the frequency of loglimit (controled via global
variables).
The overflow action cannot accept parameters.
----------------------------
revision 1.202
date: 2004/09/12 07:24:58; author: ktsaou; state: Exp; lines: +8 -5
Added RDP service.
----------------------------
revision 1.201
date: 2004/09/12 06:57:47; author: ktsaou; state: Exp; lines: +9 -5
Added service NXSERVER.
----------------------------
revision 1.200
date: 2004/09/10 22:07:18; author: ktsaou; state: Exp; lines: +16 -5
Added a warning if wrong arguments are detected.
----------------------------
revision 1.199
date: 2004/09/10 21:36:26; author: ktsaou; state: Exp; lines: +12 -5
Added rquotad to the NFS service.
----------------------------
revision 1.198
date: 2004/08/21 21:07:09; author: ktsaou; state: Exp; lines: +6 -6
Updated RESERVED_IPS according to current IANA reserved IP range.
----------------------------
revision 1.197
date: 2004/07/31 22:31:08; author: ktsaou; state: Exp; lines: +31 -33
Due to a bug in BASH 3.0, the unset bash function corrupts array variables.
Changed FireHOL to set all variables to empty instead of unseting them.
----------------------------
revision 1.196
date: 2004/07/29 22:31:14; author: ktsaou; state: Exp; lines: +12 -6
Added documentation for DHCP and dropped packets.
Changed radius definition to use port numbers instead of port names
(gentoo has different names).
Added RADIUSPROXY and RADIUSOLDPROXY services.
----------------------------
revision 1.195
date: 2004/07/07 22:09:31; author: ktsaou; state: Exp; lines: +14 -7
Added variable FIREHOL_TRUST_LOOPBACK=1 which if set to 0, FireHOL will not
trust the lo interface allowing the admin to setup a firewall on it.
----------------------------
revision 1.194
date: 2004/05/15 10:19:01; author: ktsaou; state: Exp; lines: +9 -5
Added an iptables -nxvL command at the top of firehol.sh to initialize
iptables. Without it a few users have reported problems using firehol
during boot.
----------------------------
revision 1.193
date: 2004/05/05 23:41:19; author: ktsaou; state: Exp; lines: +88 -11
Added helper 'ecn_shame' that once called, it looks if ECN is enabled in
the kernel, and if it is, it fetches:
http://urchin.earth.li/cgi-bin/ecn.pl?output=ip
and disables ECN for all communication with these hosts.
----------------------------
revision 1.192
date: 2004/05/04 21:39:33; author: ktsaou; state: Exp; lines: +76 -5
Added grouping functionality. This is not yet finished. It has been added
to allow other developers test the functionality before optimizing all the
rules to use groups.
To use grouping, within an interface or router write:
group with [optional rule parameters]
server x accept
server y accept
group end
This will generate a much more optimized version of:
server "x y" accept [optional rule parameters]
by applying all the optional rule parameters once (instead of once per
service).
----------------------------
revision 1.191
date: 2004/04/23 22:15:18; author: ktsaou; state: Exp; lines: +26 -15
Made the nat helpers print their real statements instead of always
appearing as 'nat'.
----------------------------
revision 1.190
date: 2004/04/23 07:36:12; author: ktsaou; state: Exp; lines: +7 -7
Changed two:
tr [a-z] [A-Z]
to:
tr a-z A-Z
because a few versions of tr complain with the first format.
----------------------------
revision 1.189
date: 2004/04/23 07:32:01; author: ktsaou; state: Exp; lines: +6 -6
Fixed a printf that was giving errors because an argument was not numeric.
----------------------------
revision 1.188
date: 2004/04/21 22:57:11; author: ktsaou; state: Exp; lines: +5 -7
Removed the "press return to continue" from the 'debug' mode.
----------------------------
revision 1.187
date: 2004/04/21 22:39:40; author: ktsaou; state: Exp; lines: +12 -7
FireHOL now checks that /var/lock/subsys (the dir RH uses for startup
services lock files) exists before using it.
----------------------------
revision 1.186
date: 2004/04/21 22:23:10; author: ktsaou; state: Exp; lines: +8 -5
Added service WHOIS.
----------------------------
revision 1.185
date: 2004/04/21 21:48:32; author: ktsaou; state: Exp; lines: +10 -5
Kernel configuration is now searched in this order:
1. /proc/config
2. /lib/modules/`uname -r`/build/.config
3. /boot/config-`uname -r`
4. /usr/src/linux/.config
Check No 3 was added now.
----------------------------
revision 1.184
date: 2004/04/21 21:35:29; author: ktsaou; state: Exp; lines: +108 -49
IMPORTANT: My second kid was born a week ago!
Added a lot of information to the generated iptables command line to
debug both the commands generated and what FireHOL did.
Fixed a bug in kernel module management: check_kernel_module() was supposed
to be a runtime function, but accidentaly I had it generating commands
to be run later - which of course were not run.
----------------------------
revision 1.183
date: 2004/04/01 23:30:28; author: ktsaou; state: Exp; lines: +19 -9
Added finer control to control INVALID packets.
The default is now not to drop invalid packets globaly, but to drop them
as part of the protection statement (i.e. protection invalid). The default
full/strong/all protections include the invalid match.
To enable invalid packets dropping globaly (the previous behaviour) one
can give:
FIREHOL_DROP_INVALID=1
at the top of the configuration file.
----------------------------
revision 1.182
date: 2004/03/04 22:05:53; author: ktsaou; state: Exp; lines: +5 -6
Removed a tcp-flags match from protection because it was a subset of
another one already defined.
----------------------------
revision 1.181
date: 2004/03/03 23:18:43; author: ktsaou; state: Exp; lines: +40 -36
Fixed the required commands finder to stop properly when some system
command is not found in the system path.
----------------------------
revision 1.180
date: 2004/03/03 22:19:15; author: ktsaou; state: Exp; lines: +6 -5
Added:
--tcp-flags SYN,RST,PSH,ACK,URG SYN,RST,PSH,URG
to the list of malformed packets.
----------------------------
revision 1.179
date: 2004/03/03 21:24:41; author: ktsaou; state: Exp; lines: +12 -15
Minor mac optional rule parameter fix.
----------------------------
revision 1.178
date: 2004/03/03 20:32:35; author: ktsaou; state: Exp; lines: +11 -6
Completed the mac optional rule parameter. This was implemented since
v1.134 but it was producing rules for both input and output packets.
Now, it produces mac rules only for packets comming in the firewall
(interfaces and routers).
----------------------------
revision 1.177
date: 2004/02/07 00:43:11; author: ktsaou; state: Exp; lines: +6 -6
BUG 891471:
Multicast CIDR block is actually 224.0.0.0/4.
It extends from 224-239.
Fixed.
----------------------------
revision 1.176
date: 2004/01/10 18:44:39; author: ktsaou; state: Exp; lines: +8 -6
Further optimized and reduced PRIVATE_IPS using:
http://www.vergenet.net/linux/aggregate/
The supplied get-iana.sh uses 'aggregate-flim' if it finds it in the path.
(aggregate-flim is the name of this program when installed on Gentoo)
----------------------------
revision 1.175
date: 2004/01/02 22:32:28; author: ktsaou; state: Exp; lines: +6 -6
Fixed a warning generated incorrectly by the mark helper.
----------------------------
revision 1.174
date: 2003/12/29 22:46:00; author: ktsaou; state: Exp; lines: +7 -7
Aesthetic changes.
----------------------------
revision 1.173
date: 2003/12/29 22:40:11; author: ktsaou; state: Exp; lines: +70 -11
Added count of iptables commands generated.
----------------------------
revision 1.172
date: 2003/12/01 05:03:11; author: ktsaou; state: Exp; lines: +17 -8
Added FIREHOL_LOG_MODE which can either be LOG or ULOG to select the
logging mode for iptables. All FireHOL optional rule parameters use this.
Updated documentation to reflect the change.
----------------------------
revision 1.171
date: 2003/11/23 19:27:58; author: ktsaou; state: Exp; lines: +6 -6
Changed a "head -1" to "head -n 1" because head does not support the first
syntax anymore. Thanks to Maik Schreiber <[email protected]> for reporting
this.
----------------------------
revision 1.170
date: 2003/11/23 13:43:19; author: ktsaou; state: Exp; lines: +11 -5
Added support for kernel config in /lib/modules/`uname -r`/build/.config
Updated documentation.
----------------------------
revision 1.169
date: 2003/11/18 23:00:48; author: ktsaou; state: Exp; lines: +6 -6
There was an extra - (minus) in the iptables command generation for
negative protocol expressions. Fixed.
----------------------------
revision 1.168
date: 2003/11/04 21:43:02; author: ktsaou; state: Exp; lines: +21 -6
NETBIOS initiates based on the broadcast address of an interface
(request goes to broadcast address) but the server responds from
its own IP address. This makes the server samba accept statement
drop the server reply.
Bellow is a hack, that allows a linux samba server to respond
correctly, as it allows new outgoing connections from the well
known netbios-ns port to the clients high ports.
For clients and routers this hack is not applied because it
would be a huge security hole.
----------------------------
revision 1.167
date: 2003/11/03 20:43:09; author: ktsaou; state: Exp; lines: +6 -6
Added again 172.16.0.0/12 to PRIVATE_IPS.
----------------------------
revision 1.166
date: 2003/10/26 21:40:30; author: ktsaou; state: Exp; lines: +67 -56
Fixed PRIVATE_IPS (there was an duplicate entry and a wrong entry).
----------------------------
revision 1.165
date: 2003/10/26 21:27:31; author: ktsaou; state: Exp; lines: +102 -8
Changed kernel module management to read kernel configuration and detect
if a module is compiled in the kernel or needs to be loaded separately.
(note: this is not finished yet)
----------------------------
revision 1.164
date: 2003/10/22 06:58:27; author: ktsaou; state: Exp; lines: +6 -6
Changed TIME service ports to numeric since a few versions of bash get
confused by the use of the reserved keywork "time".
----------------------------
revision 1.163
date: 2003/10/20 17:49:56; author: ktsaou; state: Exp; lines: +7 -7
Fixed service CUPS according to the following:
> The firehol system defines the 'cups' protocol as:
>
> server_cups_ports="tcp/631"
> client_cups_ports="default"
>
> This isn't a complete definition - CUPS also has an internal printer
> browsing protocol that operates over UDP, on port 631.
>
> The following definition is more correct:
>
> server_cups_ports="tcp/631 udp/631"
> client_cups_ports="default 631"
----------------------------
revision 1.162
date: 2003/10/18 09:40:45; author: ktsaou; state: Exp; lines: +8 -5
Added Distributed Checksum Clearinghouses (DCC) service.
----------------------------
revision 1.161
date: 2003/10/16 22:05:22; author: ktsaou; state: Exp; lines: +194 -84
Added the PHYSIN and PHYSOUT optional rule parameters to match the
physical network interface in cases where iptables defines as inface
and outface a virtual interface such as a bridge.
----------------------------
revision 1.160
date: 2003/10/13 18:50:30; author: ktsaou; state: Exp; lines: +13 -5
Added services ORACLE and GKRELLMD.
----------------------------
revision 1.159
date: 2003/10/09 10:01:26; author: ktsaou; state: Exp; lines: +9 -5
Added service Veritas NetBackup.
----------------------------
revision 1.158
date: 2003/10/07 22:31:06; author: ktsaou; state: Exp; lines: +12 -7
Added lockd support in service NFS, as suggested by
"Daniel Pittman" <[email protected]>
----------------------------
revision 1.157
date: 2003/10/06 00:17:23; author: ktsaou; state: Exp; lines: +18 -6
Fixed TFTP service according to Goetz Bock <[email protected]> suggestions.
----------------------------
revision 1.156