--- loncom/configuration/Firewall.pm 2009/07/06 00:07:19 1.4
+++ loncom/configuration/Firewall.pm 2019/05/07 21:18:24 1.17
@@ -1,7 +1,7 @@
# The LearningOnline Network with CAPA
# Firewall configuration to allow internal LON-CAPA communication between servers
#
-# $Id: Firewall.pm,v 1.4 2009/07/06 00:07:19 raeburn Exp $
+# $Id: Firewall.pm,v 1.17 2019/05/07 21:18:24 raeburn Exp $
#
# The LearningOnline Network with CAPA
#
@@ -35,34 +35,83 @@ package LONCAPA::Firewall;
use strict;
use lib '/home/httpd/perl/lib';
use LONCAPA::Configuration;
+use LONCAPA;
-# Firewall code is based on the code in FC2 /etc/init.d/ntpd
+sub uses_firewalld {
+ my ($distro) = @_;
+ if ($distro eq '') {
+ $distro = &get_distro();
+ }
+ my ($inuse,$checkfirewalld,$zone);
+ if ($distro =~ /^(suse|sles)([\d\.]+)$/) {
+ if (($1 eq 'sles') && ($2 >= 15)) {
+ $checkfirewalld = 1;
+ }
+ } elsif ($distro =~ /^fedora(\d+)$/) {
+ if ($1 >= 18) {
+ $checkfirewalld = 1;
+ }
+ } elsif ($distro =~ /^(?:centos|rhes|scientific)(\d+)/) {
+ if ($1 >= 7) {
+ $checkfirewalld = 1;
+ }
+ }
+ if ($checkfirewalld) {
+ my ($loaded,$active);
+ if (open(PIPE,"systemctl status firewalld 2>&1 |")) {
+ while (<PIPE>) {
+ chomp();
+ if (/^\s*Loaded:\s+(\w+)/) {
+ $loaded = $1;
+ }
+ if (/^\s*Active\s+(\w+)/) {
+ $active = $1;
+ }
+ }
+ close(PIPE);
+ }
+ if (($loaded eq 'loaded') || ($active eq 'active')) {
+ $inuse = 1;
+ my $cmd = 'firewall-cmd --get-default-zone';
+ if (open(PIPE,"$cmd |")) {
+ my $result = <PIPE>;
+ chomp($result);
+ close(PIPE);
+ if ($result =~ /^\w+$/) {
+ $zone = $result;
+ }
+ }
+ }
+ }
+ return ($inuse,$zone);
+}
sub firewall_open_port {
- my ($iptables,$fw_chain,$lond_port,$iphost,$ports) = @_;
+ my ($iptables,$fw_chains,$lond_port,$iphost,$ports) = @_;
return 'inactive firewall' if (!&firewall_is_active());
return 'port number unknown' if !$lond_port;
- my @opened;
- if (! `$iptables -L -n 2>/dev/null | grep $fw_chain | wc -l`) {
- return 'Expected chain "'.$fw_chain.'" missing from iptables'."\n";
+ return 'invalid firewall chain' unless (ref($fw_chains) eq 'ARRAY');
+ my (@opened,@chains,@badchains,@okchains);
+ foreach my $chain (@{$fw_chains}) {
+ if ($chain =~ /^([\w\-]+)$/) {
+ push(@okchains,$1);
+ } else {
+ push(@badchains,$chain);
+ }
}
- #
- # iptables is running with expected chain
- #
- if ($fw_chain =~ /^([\w\-]+)$/) {
- $fw_chain = $1;
- } else {
- return 'Chain name has unexpected format'."\n";
+ if (!@okchains) {
+ return 'None of the chain names has the expected format.'."\n";
}
if (ref($ports) ne 'ARRAY') {
return 'List of ports to open needed.';
}
+ my ($firewalld,$zone) = &uses_firewalld();
foreach my $portnum (@{$ports}) {
my $port = '';
if ($portnum =~ /^(\d+)$/) {
$port = $1;
} else {
- print "Skipped non-numeric port: $portnum\n";
+ print "Skipped non-numeric port: $portnum.\n";
next;
}
print "Opening firewall access on port $port.\n";
@@ -70,61 +119,142 @@ sub firewall_open_port {
if ($port eq $lond_port) {
# For lond port, restrict the servers allowed to attempt to communicate
# to include only source IPs in the LON-CAPA cluster.
- my (@port_error,@command_error,@lond_port_open);
+ my (@port_error,%command_error,@lond_port_open,
+ @lond_port_curropen);
if (ref($iphost) eq 'HASH') {
- if (keys(%{$iphost}) > 0) {
- &firewall_close_anywhere($iptables,$fw_chain,$port);
+ if (keys(%{$iphost}) > 0) {
+ my %curropen;
+ foreach my $fw_chain (@okchains) {
+ &firewall_close_anywhere($iptables,$fw_chain,$port);
+ my $current = &firewall_is_port_open($iptables,$fw_chain,$port,$lond_port,$iphost,\%curropen);
+ }
foreach my $key (keys(%{$iphost})) {
my $ip = '';
if ($key =~ /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/) {
if (($1<=255) && ($2<=255) && ($3<=255) && ($4<=255)) {
$ip = "$1.$2.$3.$4";
} else {
+ print "IP address: $key does not have expected format.\n";
next;
}
} else {
+ print "IP address: $key does not have expected format.\n";
next;
}
- my $firewall_command =
- "$iptables -I $fw_chain -p tcp -s $ip -d 0/0 --dport $port -j ACCEPT";
- system($firewall_command);
- my $return_status = $?>>8;
- if ($return_status == 1) {
- push (@port_error,$ip);
- } elsif ($return_status == 2) {
- push(@command_error,$ip);
- } elsif ($return_status == 0) {
- push(@lond_port_open,$ip);
+ if ($curropen{$ip}) {
+ push(@lond_port_curropen,$ip);
+ } else {
+ foreach my $fw_chain (@okchains) {
+ if ($firewalld) {
+ my $cmd = 'firewall-cmd --zone='.$zone.' --add-rich-rule \'rule family="ipv4" source address="'.$ip.'/32" port port="'.$port.'" protocol="tcp" accept\'';
+ if (open(PIPE,"$cmd |")) {
+ my $result = <PIPE>;
+ chomp($result);
+ close(PIPE);
+ if ($result eq 'success') {
+ push(@lond_port_open,$ip);
+ last;
+ } else {
+ push (@port_error,$ip);
+ }
+ } else {
+ push (@port_error,$ip);
+ }
+ } else {
+ my $firewall_command =
+ "$iptables -I $fw_chain -p tcp -s $ip -d 0/0 --dport $port -j ACCEPT";
+ system($firewall_command);
+ my $return_status = $?>>8;
+ if ($return_status == 1) {
+ unless(grep(/^\Q$ip\E$/,@port_error)) {
+ push (@port_error,$ip);
+ }
+ } elsif ($return_status == 2) {
+ push(@{$command_error{$fw_chain}},$ip);
+ } elsif ($return_status == 0) {
+ push(@lond_port_open,$ip);
+ last;
+ }
+ }
+ }
}
}
+ } else {
+ print "no key found in $iphost hash ref\n";
}
+ } else {
+ print "$iphost is not a reference to a hash\n";
+ }
+ if (@lond_port_curropen) {
+ unless (grep(/^\Q$port\E$/,@opened)) {
+ push(@opened,$port);
+ }
+ print "Port already open for ".scalar(@lond_port_curropen)." IP addresses.\n";
}
if (@lond_port_open) {
- push(@opened,$port);
- print "Port $port opened for ".scalar(@lond_port_open)." IP addresses\n";
+ unless (grep(/^\Q$port\E$/,@opened)) {
+ push(@opened,$port);
+ }
+ print "Port opened for ".scalar(@lond_port_open)." IP addresses.\n";
}
if (@port_error) {
- print "Error opening port $port for following IP addresses: ".join(', ',@port_error)."\n";
+ print "Error opening port for following IP addresses: ".join(', ',@port_error)."\n";
}
- if (@command_error) {
- print "Bad command error opening port for following IP addresses: ".
- join(', ',@command_error)."\n".
- 'Command was: "'."$iptables -I $fw_chain -p tcp -s ".'$ip'." -d 0/0 --dport $port -j ACCEPT".'", where $ip is IP address'."\n";
+ if (keys(%command_error) > 0) {
+ foreach my $chain (sort(keys(%command_error))) {
+ if (ref($command_error{$chain}) eq 'ARRAY') {
+ if (@{$command_error{$chain}}) {
+ print "Bad command error opening port for following IP addresses: ".
+ join(', ',@{$command_error{$chain}})."\n".
+ 'Command was: "'."$iptables -I $chain -p tcp -s ".'$ip'." -d 0/0 --dport $port -j ACCEPT".'", where $ip is IP address'."\n";
+ }
+ }
+ }
}
} else {
- my $firewall_command =
- "$iptables -I $fw_chain -p tcp -d 0/0 --dport $port -j ACCEPT";
- system($firewall_command);
- my $return_status = $?>>8;
- if ($return_status == 1) {
- # Error
- print "Error opening port.\n";
- } elsif ($return_status == 2) {
- # Bad command
- print "Bad command error opening port. Command was\n".
- " ".$firewall_command."\n";
- } elsif ($return_status == 0) {
- push(@opened,$port);
+ my (@port_errors,%command_errors);
+ foreach my $fw_chain (@okchains) {
+ if ($firewalld) {
+ my $cmd = 'firewall-cmd --zone='.$zone.' --add-rich-rule \'rule family="ipv4" port port="'.$port.'" protocol="tcp" accept\'';
+ if (open(PIPE,"$cmd |")) {
+ my $result = <PIPE>;
+ chomp($result);
+ close(PIPE);
+ if ($result eq 'success') {
+ push(@opened,$port);
+ last;
+ } else {
+ push(@port_errors,$fw_chain);
+ }
+ } else {
+ push(@port_errors,$fw_chain);
+ }
+ } else {
+ my $firewall_command =
+ "$iptables -I $fw_chain -p tcp -d 0/0 --dport $port -j ACCEPT";
+ system($firewall_command);
+ my $return_status = $?>>8;
+ if ($return_status == 1) {
+ push(@port_errors,$fw_chain);
+ } elsif ($return_status == 2) {
+ $command_errors{$fw_chain} = $firewall_command;
+ } elsif ($return_status == 0) {
+ push(@opened,$port);
+ last;
+ }
+ }
+ unless (grep(/^\Q$port\E$/,@opened)) {
+ if (@port_errors) {
+ print "Error opening port for chains: ".
+ join(', ',@port_errors).".\n";
+ }
+ if (keys(%command_errors)) {
+ foreach my $fw_chain (sort(keys(%command_errors))) {
+ print "Bad command error opening port for chain: $fw_chain. Command was\n".
+ " ".$command_errors{$fw_chain}."\n";
+ }
+ }
+ }
}
}
}
@@ -137,58 +267,76 @@ sub firewall_open_port {
}
sub firewall_is_port_open {
- my ($iptables,$fw_chain,$port,$lond_port,$iphost) = @_;
+ my ($iptables,$fw_chain,$port,$lond_port,$iphost,$curropen) = @_;
# for lond port returns number of source IPs for which firewall port is open
# for other ports returns 1 if the firewall port is open, 0 if not.
#
# check if firewall is active or installed
return if (! &firewall_is_active());
- if ($port eq $lond_port) {
- my $count ++;
- if (ref($iphost) eq 'HASH') {
- if (keys(%{$iphost}) > 0) {
- foreach my $ip (keys(%{$iphost})) {
- open(PIPE,"$iptables -L $fw_chain -n 2>/dev/null");
- while(<PIPE>) {
- $count++ if (/^ACCEPT\s+tcp\s+\-{2}\s+\Q$ip\E\s+/);
+ my $count = 0;
+ if (open(PIPE,"$iptables -L $fw_chain -n |")) {
+ while(<PIPE>) {
+ if ($port eq $lond_port) {
+ if (ref($iphost) eq 'HASH') {
+ if (/^ACCEPT\s+tcp\s+\-{2}\s+(\S+)\s+\S+\s+tcp\s+dpt\:\Q$port\E/) {
+ my $ip = $1;
+ if ($iphost->{$ip}) {
+ $count ++;
+ if (ref($curropen) eq 'HASH') {
+ $curropen->{$ip} ++;
+ }
+ }
}
- close(PIPE);
+ }
+ } else {
+ if (/tcp dpt\:\Q$port\E/) {
+ $count ++;
+ last;
}
}
}
- return $count;
- } else {
- if (`$iptables -L -n 2>/dev/null | grep "tcp dpt:$port"`) {
- return 1;
- } else {
- return 0;
- }
+ close(PIPE);
}
+ return $count;
}
sub firewall_is_active {
+ my $status = 0;
if (-e '/proc/net/ip_tables_names') {
- return 1;
- } else {
- return 0;
+ if (open(PIPE,'cat /proc/net/ip_tables_names |')) {
+ while(<PIPE>) {
+ chomp();
+ if (/^filter$/) {
+ $status = 1;
+ last;
+ }
+ }
+ close(PIPE);
+ }
}
+ return $status;
}
sub firewall_close_port {
- my ($iptables,$fw_chain,$lond_port,$ports) = @_;
+ my ($iptables,$fw_chains,$lond_port,$iphost,$ports) = @_;
return 'inactive firewall' if (!&firewall_is_active());
return 'port number unknown' if !$lond_port;
- if (! `$iptables -L -n 2>/dev/null | grep $fw_chain | wc -l`) {
- return 'Expected chain "'.$fw_chain.'" missing from iptables'."\n";
+ return 'invalid firewall chain' unless (ref($fw_chains) eq 'ARRAY');
+ my (@opened,@chains,@badchains,@okchains);
+ foreach my $chain (@{$fw_chains}) {
+ if ($chain =~ /^([\w\-]+)$/) {
+ push(@okchains,$1);
+ } else {
+ push(@badchains,$chain);
+ }
+ }
+ if (!@okchains) {
+ return 'None of the chain names has the expected format.'."\n";
}
if (ref($ports) ne 'ARRAY') {
return 'List of ports to close needed.';
}
- if ($fw_chain =~ /^([\w\-]+)$/) {
- $fw_chain = $1;
- } else {
- return 'Chain name has unexpected format'."\n";
- }
+ my ($firewalld,$zone) = &uses_firewalld();
foreach my $portnum (@{$ports}) {
my $port = '';
if ($portnum =~ /^(\d+)$/) {
@@ -197,59 +345,123 @@ sub firewall_close_port {
print "Skipped non-numeric port: $portnum\n";
next;
}
- print "Closing firewall access on port $port\n";
+ print "Closing firewall access on port $port.\n";
if (($port ne '') && ($port eq $lond_port)) {
- my (@port_error,@command_error,@lond_port_close);
- my %to_close;
- open(PIPE, "$iptables -n -L $fw_chain |");
- while (<PIPE>) {
- chomp();
- next unless (/dpt:\Q$port\E\s*$/);
- if (/^ACCEPT\s+tcp\s+\-{2}\s+(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\s+/) {
- $to_close{$1} = $port;
+ my $output;
+ foreach my $fw_chain (@okchains) {
+ my (@port_error,@command_error,@lond_port_close);
+ my %to_close;
+ if (open(PIPE, "$iptables -n -L $fw_chain |")) {
+ while (<PIPE>) {
+ chomp();
+ next unless (/dpt:\Q$port\E/);
+ if (/^ACCEPT\s+tcp\s+\-{2}\s+(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\s+/) {
+ my $ip = $1;
+ my $keepopen = 0;
+ if (ref($iphost) eq 'HASH') {
+ if (exists($iphost->{$ip})) {
+ $keepopen = 1;
+ }
+ }
+ unless ($keepopen) {
+ $to_close{$ip} = $port;
+ }
+ }
+ }
+ close(PIPE);
}
- }
- close(PIPE);
- if (keys(%to_close) > 0) {
- foreach my $ip (keys(%to_close)) {
- my $firewall_command =
- "$iptables -D $fw_chain -p tcp -s $ip -d 0/0 --dport $port -j ACCEPT";
- system($firewall_command);
- my $return_status = $?>>8;
- if ($return_status == 1) {
- push (@port_error,$ip);
- } elsif ($return_status == 2) {
- push(@command_error,$ip);
- } elsif ($return_status == 0) {
- push(@lond_port_close,$ip);
+ if (keys(%to_close) > 0) {
+ foreach my $ip (keys(%to_close)) {
+ if ($firewalld) {
+ my $cmd = 'firewall-cmd --zone='.$zone.' --remove-rich-rule \'rule family="ipv4" source address="'.$ip.'/32" port port="'.$port.'" protocol="tcp" accept\'';
+ if (open(PIPE,"$cmd |")) {
+ my $result = <PIPE>;
+ chomp($result);
+ close(PIPE);
+ if ($result eq 'success') {
+ push(@lond_port_close,$ip);
+ } else {
+ push(@port_error,$ip);
+ }
+ } else {
+ push(@port_error,$ip);
+ }
+ } else {
+ my $firewall_command =
+ "$iptables -D $fw_chain -p tcp -s $ip -d 0/0 --dport $port -j ACCEPT";
+ system($firewall_command);
+ my $return_status = $?>>8;
+ if ($return_status == 1) {
+ push (@port_error,$ip);
+ } elsif ($return_status == 2) {
+ push(@command_error,$ip);
+ } elsif ($return_status == 0) {
+ push(@lond_port_close,$ip);
+ }
+ }
}
}
+ if (@lond_port_close) {
+ $output .= "Port closed for ".scalar(@lond_port_close)." IP addresses.\n";
+ }
+ if (@port_error) {
+ $output .= "Error closing port for following IP addresses: ".join(', ',@port_error)."\n";
+ }
+ if (@command_error) {
+ $output .= "Bad command error opening port for following IP addresses: ".
+ join(', ',@command_error)."\n".
+ 'Command was: "'."$iptables -D $fw_chain -p tcp -s ".'$ip'." -d 0/0 --dport $port -j ACCEPT".'", where $ip is IP address'."\n";
+ }
}
- if (@lond_port_close) {
- print "Port $port closed for ".scalar(@lond_port_close)." IP addresses\n";
- }
- if (@port_error) {
- print "Error closing port $port for following IP addresses: ".join(', ',@port_error)."\n";
- }
- if (@command_error) {
- print "Bad command error opening port for following IP addresses: ".
- join(', ',@command_error)."\n".
- 'Command was: "'."$iptables -D $fw_chain -p tcp -s ".'$ip'." -d 0/0 --dport $port -j ACCEPT".'", where $ip is IP address'."\n";
+ if ($output) {
+ print $output;
+ } else {
+ print "No IP addresses required discontinuation of access.\n";
}
} else {
- my $firewall_command =
- "$iptables -D $fw_chain -p tcp -d 0/0 --dport $port -j ACCEPT";
- system($firewall_command);
- my $return_status = $?>>8;
- if ($return_status == 1) {
- # Error
- print "Error closing port.\n";
- } elsif ($return_status == 2) {
- # Bad command
- print "Bad command error closing port. Command was\n".
- " ".$firewall_command."\n";
- } else {
- print "Port closed.\n";
+ foreach my $fw_chain (@okchains) {
+ my (@port_error,@command_error,@lond_port_close);
+ my $to_close;
+ if (open(PIPE, "$iptables -n -L $fw_chain |")) {
+ while (<PIPE>) {
+ chomp();
+ next unless (/dpt:\Q$port\E/);
+ $to_close = 1;
+ }
+ close(PIPE);
+ }
+ if ($to_close) {
+ if ($firewalld) {
+ my $cmd = 'firewall-cmd --zone='.$zone.' --remove-rich-rule \'rule family="ipv4" port port="'.$port.'" protocol="tcp" accept\'';
+ if (open(PIPE,"$cmd|")) {
+ my $result = <PIPE>;
+ chomp($result);
+ close(PIPE);
+ if ($result eq 'success') {
+ print "Port closed for chain $fw_chain.\n";
+ } else {
+ print "Error closing port for chain: $fw_chain.\n";
+ }
+ } else {
+ print "Error closing port for chain: $fw_chain.\n";
+ }
+ } else {
+ my $firewall_command =
+ "$iptables -D $fw_chain -p tcp -d 0/0 --dport $port -j ACCEPT";
+ system($firewall_command);
+ my $return_status = $?>>8;
+ if ($return_status == 1) {
+ # Error
+ print "Error closing port for chain: $fw_chain.\n";
+ } elsif ($return_status == 2) {
+ # Bad command
+ print "Bad command error closing port. Command was\n".
+ " ".$firewall_command."\n";
+ } else {
+ print "Port closed for chain $fw_chain.\n";
+ }
+ }
+ }
}
}
}
@@ -258,25 +470,43 @@ sub firewall_close_port {
sub firewall_close_anywhere {
my ($iptables,$fw_chain,$port) = @_;
- open(PIPE, "$iptables --line-numbers -n -L $fw_chain |");
- while (<PIPE>) {
- next unless (/dpt:\Q$port\E/);
- chomp();
- if (/^(\d+)\s+ACCEPT\s+tcp\s+\-{2}\s+0\.0\.0\.0\/0\s+0\.0\.0\.0\/0/) {
- my $firewall_command = "$iptables -D $fw_chain $1";
- system($firewall_command);
- my $return_status = $?>>8;
- if ($return_status == 1) {
- print 'Error closing port '.$port.' for source "anywhere"'."\n";
- } elsif ($return_status == 2) {
- print 'Bad command error closing port '.$port.' for source "anywhere". Command was'."\n".
- ' '.$firewall_command."\n";
- } else {
- print 'Port '.$port.' closed for source "anywhere"'."\n";
+ my ($firewalld,$zone) = &uses_firewalld();
+ if (open(PIPE, "$iptables --line-numbers -n -L $fw_chain |")) {
+ while (<PIPE>) {
+ next unless (/dpt:\Q$port\E/);
+ chomp();
+ if (/^(\d+)\s+ACCEPT\s+tcp\s+\-{2}\s+0\.0\.0\.0\/0\s+0\.0\.0\.0\/0/) {
+ if ($firewalld) {
+ my $cmd = 'firewall-cmd --remove-port='.$port.'/tcp';
+ if (open(PIPE,"$cmd |")) {
+ my $result = <PIPE>;
+ chomp($result);
+ close(PIPE);
+ if ($result eq 'success') {
+ print 'Port '.$port.' closed for source "anywhere"'."\n";
+ } else {
+ print 'Error closing port '.$port.' for source "anywhere".'."\n";
+ }
+ } else {
+ print 'Error closing port '.$port.' for source "anywhere".'."\n";
+ }
+ } else {
+ my $firewall_command = "$iptables -D $fw_chain $1";
+ system($firewall_command);
+ my $return_status = $?>>8;
+ if ($return_status == 1) {
+ print 'Error closing port '.$port.' for source "anywhere".'."\n";
+ } elsif ($return_status == 2) {
+ print 'Bad command error closing port '.$port.' for source "anywhere". Command was'."\n".
+ ' '.$firewall_command."\n";
+ } else {
+ print 'Port '.$port.' closed for source "anywhere"'."\n";
+ }
+ }
}
}
+ close(PIPE);
}
- close(PIPE);
}
sub get_lond_port {
@@ -293,26 +523,73 @@ sub get_lond_port {
return $lond_port;
}
-sub get_fw_chain {
- my ($iptables) = @_;
- my $fw_chain = 'RH-Firewall-1-INPUT';
+sub get_fw_chains {
+ my ($iptables,$distro) = @_;
+ if ($distro eq '') {
+ $distro = &get_distro();
+ }
+ my @fw_chains;
my $suse_config = "/etc/sysconfig/SuSEfirewall2";
- if (-e $suse_config) {
- $fw_chain = 'input_ext';
+ my $ubuntu_config = "/etc/ufw/ufw.conf";
+ my ($firewalld,$zone) = &uses_firewalld($distro);
+ if ($firewalld) {
+ if ($zone ne '') {
+ push(@fw_chains,'IN_'.$zone.'_allow');
+ } else {
+ push(@fw_chains,'IN_public_allow');
+ }
+ } elsif (-e $suse_config) {
+ push(@fw_chains,'input_ext');
} else {
- if (!-e '/etc/sysconfig/iptables') {
- print("Unable to find iptables file containing static definitions\n");
+ my @posschains;
+ if (-e $ubuntu_config) {
+ @posschains = ('ufw-user-input','INPUT');
+ } else {
+ if ($distro =~ /^(debian|ubuntu|suse|sles)/) {
+ @posschains = ('INPUT');
+ } elsif ($distro =~ /^(fedora|rhes|centos|scientific)(\d+)$/) {
+ if ((($1 eq 'fedora') && ($2 > 15)) || (($1 ne 'fedora') && ($2 >= 7))) {
+ @posschains = ('INPUT');
+ } else {
+ @posschains = ('RH-Firewall-1-INPUT','INPUT');
+ }
+ }
+ if (!-e '/etc/sysconfig/iptables') {
+ if (!-e '/var/lib/iptables') {
+ unless ($distro =~ /^(debian|ubuntu)/) {
+ print("Unable to find iptables file containing static definitions.\n");
+ }
+ }
+ if ($distro =~ /^(fedora|rhes|centos|scientific)(\d+)$/) {
+ unless ((($1 eq 'fedora') && ($2 > 15)) || (($1 ne 'fedora') && ($2 >= 7))) {
+ push(@fw_chains,'RH-Firewall-1-INPUT');
+ }
+ }
+ }
}
if ($iptables eq '') {
$iptables = &get_pathto_iptables();
}
- my $count = `$iptables -L -n 2>/dev/null |grep $fw_chain |wc -l`;
- chomp($count);
- if (!$count) {
- $fw_chain ='INPUT';
+ my %counts;
+ if (open(PIPE,"$iptables -L -n |")) {
+ while(<PIPE>) {
+ foreach my $chain (@posschains) {
+ if (/(\Q$chain\E)/) {
+ $counts{$1} ++;
+ }
+ }
+ }
+ close(PIPE);
+ }
+ foreach my $fw_chain (@posschains) {
+ if ($counts{$fw_chain}) {
+ unless(grep(/^\Q$fw_chain\E$/,@fw_chains)) {
+ push(@fw_chains,$fw_chain);
+ }
+ }
}
}
- return $fw_chain;
+ return @fw_chains;
}
sub get_pathto_iptables {
@@ -322,11 +599,20 @@ sub get_pathto_iptables {
} elsif (-e '/usr/sbin/iptables') {
$iptables = '/usr/sbin/iptables';
} else {
- print("Unable to find iptables command\n");
+ print("Unable to find iptables command.\n");
}
return $iptables;
}
+sub get_distro {
+ my $distro;
+ if (open(PIPE,"/home/httpd/perl/distprobe |")) {
+ $distro = <PIPE>;
+ close(PIPE);
+ }
+ return $distro;
+}
+
1;
__END__
@@ -341,6 +627,7 @@ B<LONCAPA::Firewall> - dynamic opening/c
use lib '/home/httpd/lib/perl/';
use LONCAPA::Firewall;
+ LONCAPA::Firewall::uses_firewalld();
LONCAPA::Firewall::firewall_open_port();
LONCAPA::Firewall::firewall_close_port();
LONCAPA::Firewall::firewall_is_port_open();
@@ -360,19 +647,25 @@ The following methods are available:
=over 4
-=item LONCAPA::Firewall::firewall_open_port( $iptables,$fw_chain,$lond_port,$iphost,$port );
+=item LONCAPA::Firewall::uses_firewalld( $distro );
=back
=over 4
-=item LONCAPA::Firewall::firewall_close_port( $iptables,$fw_chain,$lond_port,$ports );
+=item LONCAPA::Firewall::firewall_open_port( $iptables,$fw_chains,$lond_port,$iphost,$port );
=back
=over 4
-=item LONCAPA::Firewall::firewall_is_port_open( $iptables,$fw_chain,$port,$lond_port,$iphost );
+=item LONCAPA::Firewall::firewall_close_port( $iptables,$fw_chains,$lond_port,$iphost,$ports );
+
+=back
+
+=over 4
+
+=item LONCAPA::Firewall::firewall_is_port_open( $iptables,$fw_chain,$port,$lond_port,$iphost,$curropen );
=back
@@ -396,7 +689,7 @@ The following methods are available:
=over 4
-=item LONCAPA::Firewall::get_fw_chain();
+=item LONCAPA::Firewall::get_fw_chains( $iptables,$distro );
=back
@@ -404,6 +697,13 @@ The following methods are available:
=item LONCAPA::Firewall::get_pathto_iptables();
+=back
+
+=over 4
+
+=item LONCAPA::Firewall::get_distro();
+
+=back
=head1 AUTHORS