Annotation of loncom/configuration/Firewall.pm, revision 1.4
1.1 raeburn 1: # The LearningOnline Network with CAPA
2: # Firewall configuration to allow internal LON-CAPA communication between servers
3: #
1.4 ! raeburn 4: # $Id: Firewall.pm,v 1.3 2009/07/03 17:59:01 raeburn Exp $
1.1 raeburn 5: #
6: # The LearningOnline Network with CAPA
7: #
8: # Copyright Michigan State University Board of Trustees
9: #
10: # This file is part of the LearningOnline Network with CAPA (LON-CAPA).
11: #
12: # LON-CAPA is free software; you can redistribute it and/or modify
13: # it under the terms of the GNU General Public License as published by
14: # the Free Software Foundation; either version 2 of the License, or
15: # (at your option) any later version.
16: #
17: # LON-CAPA is distributed in the hope that it will be useful,
18: # but WITHOUT ANY WARRANTY; without even the implied warranty of
19: # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20: # GNU General Public License for more details.
21: #
22: # You should have received a copy of the GNU General Public License
23: # along with LON-CAPA; if not, write to the Free Software
24: # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
25: #
26: # /home/httpd/html/adm/gpl.txt
27: #
28: # http://www.lon-capa.org/
29: #
30: # Startup script for the LON-CAPA network processes
31: #
32:
33: package LONCAPA::Firewall;
34:
35: use strict;
36: use lib '/home/httpd/perl/lib';
37: use LONCAPA::Configuration;
38:
39: # Firewall code is based on the code in FC2 /etc/init.d/ntpd
40:
41: sub firewall_open_port {
42: my ($iptables,$fw_chain,$lond_port,$iphost,$ports) = @_;
43: return 'inactive firewall' if (!&firewall_is_active());
44: return 'port number unknown' if !$lond_port;
45: my @opened;
46: if (! `$iptables -L -n 2>/dev/null | grep $fw_chain | wc -l`) {
47: return 'Expected chain "'.$fw_chain.'" missing from iptables'."\n";
48: }
49: #
50: # iptables is running with expected chain
51: #
52: if ($fw_chain =~ /^([\w\-]+)$/) {
53: $fw_chain = $1;
54: } else {
55: return 'Chain name has unexpected format'."\n";
56: }
57: if (ref($ports) ne 'ARRAY') {
58: return 'List of ports to open needed.';
59: }
60: foreach my $portnum (@{$ports}) {
61: my $port = '';
62: if ($portnum =~ /^(\d+)$/) {
63: $port = $1;
64: } else {
65: print "Skipped non-numeric port: $portnum\n";
66: next;
67: }
68: print "Opening firewall access on port $port.\n";
69: my $result;
70: if ($port eq $lond_port) {
71: # For lond port, restrict the servers allowed to attempt to communicate
72: # to include only source IPs in the LON-CAPA cluster.
73: my (@port_error,@command_error,@lond_port_open);
74: if (ref($iphost) eq 'HASH') {
75: if (keys(%{$iphost}) > 0) {
76: &firewall_close_anywhere($iptables,$fw_chain,$port);
77: foreach my $key (keys(%{$iphost})) {
78: my $ip = '';
1.2 raeburn 79: if ($key =~ /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/) {
80: if (($1<=255) && ($2<=255) && ($3<=255) && ($4<=255)) {
1.1 raeburn 81: $ip = "$1.$2.$3.$4";
82: } else {
83: next;
84: }
85: } else {
86: next;
87: }
88: my $firewall_command =
89: "$iptables -I $fw_chain -p tcp -s $ip -d 0/0 --dport $port -j ACCEPT";
90: system($firewall_command);
91: my $return_status = $?>>8;
92: if ($return_status == 1) {
93: push (@port_error,$ip);
94: } elsif ($return_status == 2) {
95: push(@command_error,$ip);
96: } elsif ($return_status == 0) {
97: push(@lond_port_open,$ip);
98: }
99: }
100: }
101: }
102: if (@lond_port_open) {
103: push(@opened,$port);
104: print "Port $port opened for ".scalar(@lond_port_open)." IP addresses\n";
105: }
106: if (@port_error) {
107: print "Error opening port $port for following IP addresses: ".join(', ',@port_error)."\n";
108: }
109: if (@command_error) {
110: print "Bad command error opening port for following IP addresses: ".
111: join(', ',@command_error)."\n".
112: 'Command was: "'."$iptables -I $fw_chain -p tcp -s ".'$ip'." -d 0/0 --dport $port -j ACCEPT".'", where $ip is IP address'."\n";
113: }
114: } else {
115: my $firewall_command =
116: "$iptables -I $fw_chain -p tcp -d 0/0 --dport $port -j ACCEPT";
117: system($firewall_command);
118: my $return_status = $?>>8;
119: if ($return_status == 1) {
120: # Error
121: print "Error opening port.\n";
122: } elsif ($return_status == 2) {
123: # Bad command
124: print "Bad command error opening port. Command was\n".
125: " ".$firewall_command."\n";
126: } elsif ($return_status == 0) {
127: push(@opened,$port);
128: }
129: }
130: }
131: foreach my $port (@{$ports}) {
132: if (!grep(/^\Q$port\E$/,@opened)) {
133: return 'Required port not open: '.$port."\n";
134: }
135: }
136: return 'ok';
137: }
138:
139: sub firewall_is_port_open {
140: my ($iptables,$fw_chain,$port,$lond_port,$iphost) = @_;
141: # for lond port returns number of source IPs for which firewall port is open
142: # for other ports returns 1 if the firewall port is open, 0 if not.
143: #
144: # check if firewall is active or installed
145: return if (! &firewall_is_active());
146: if ($port eq $lond_port) {
147: my $count ++;
148: if (ref($iphost) eq 'HASH') {
149: if (keys(%{$iphost}) > 0) {
150: foreach my $ip (keys(%{$iphost})) {
151: open(PIPE,"$iptables -L $fw_chain -n 2>/dev/null");
152: while(<PIPE>) {
153: $count++ if (/^ACCEPT\s+tcp\s+\-{2}\s+\Q$ip\E\s+/);
154: }
155: close(PIPE);
156: }
157: }
158: }
159: return $count;
160: } else {
161: if (`$iptables -L -n 2>/dev/null | grep "tcp dpt:$port"`) {
162: return 1;
163: } else {
164: return 0;
165: }
166: }
167: }
168:
169: sub firewall_is_active {
170: if (-e '/proc/net/ip_tables_names') {
171: return 1;
172: } else {
173: return 0;
174: }
175: }
176:
177: sub firewall_close_port {
178: my ($iptables,$fw_chain,$lond_port,$ports) = @_;
179: return 'inactive firewall' if (!&firewall_is_active());
180: return 'port number unknown' if !$lond_port;
181: if (! `$iptables -L -n 2>/dev/null | grep $fw_chain | wc -l`) {
182: return 'Expected chain "'.$fw_chain.'" missing from iptables'."\n";
183: }
184: if (ref($ports) ne 'ARRAY') {
185: return 'List of ports to close needed.';
186: }
187: if ($fw_chain =~ /^([\w\-]+)$/) {
188: $fw_chain = $1;
189: } else {
190: return 'Chain name has unexpected format'."\n";
191: }
192: foreach my $portnum (@{$ports}) {
193: my $port = '';
194: if ($portnum =~ /^(\d+)$/) {
195: $port = $1;
196: } else {
197: print "Skipped non-numeric port: $portnum\n";
198: next;
199: }
200: print "Closing firewall access on port $port\n";
201: if (($port ne '') && ($port eq $lond_port)) {
202: my (@port_error,@command_error,@lond_port_close);
203: my %to_close;
204: open(PIPE, "$iptables -n -L $fw_chain |");
205: while (<PIPE>) {
206: chomp();
207: next unless (/dpt:\Q$port\E\s*$/);
208: if (/^ACCEPT\s+tcp\s+\-{2}\s+(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\s+/) {
209: $to_close{$1} = $port;
210: }
211: }
212: close(PIPE);
213: if (keys(%to_close) > 0) {
214: foreach my $ip (keys(%to_close)) {
215: my $firewall_command =
216: "$iptables -D $fw_chain -p tcp -s $ip -d 0/0 --dport $port -j ACCEPT";
217: system($firewall_command);
218: my $return_status = $?>>8;
219: if ($return_status == 1) {
220: push (@port_error,$ip);
221: } elsif ($return_status == 2) {
222: push(@command_error,$ip);
223: } elsif ($return_status == 0) {
224: push(@lond_port_close,$ip);
225: }
226: }
227: }
228: if (@lond_port_close) {
229: print "Port $port closed for ".scalar(@lond_port_close)." IP addresses\n";
230: }
231: if (@port_error) {
232: print "Error closing port $port for following IP addresses: ".join(', ',@port_error)."\n";
233: }
234: if (@command_error) {
235: print "Bad command error opening port for following IP addresses: ".
236: join(', ',@command_error)."\n".
237: 'Command was: "'."$iptables -D $fw_chain -p tcp -s ".'$ip'." -d 0/0 --dport $port -j ACCEPT".'", where $ip is IP address'."\n";
238: }
239: } else {
240: my $firewall_command =
241: "$iptables -D $fw_chain -p tcp -d 0/0 --dport $port -j ACCEPT";
242: system($firewall_command);
243: my $return_status = $?>>8;
244: if ($return_status == 1) {
245: # Error
246: print "Error closing port.\n";
247: } elsif ($return_status == 2) {
248: # Bad command
249: print "Bad command error closing port. Command was\n".
250: " ".$firewall_command."\n";
251: } else {
252: print "Port closed.\n";
253: }
254: }
255: }
256: return;
257: }
258:
259: sub firewall_close_anywhere {
260: my ($iptables,$fw_chain,$port) = @_;
261: open(PIPE, "$iptables --line-numbers -n -L $fw_chain |");
262: while (<PIPE>) {
263: next unless (/dpt:\Q$port\E/);
264: chomp();
265: if (/^(\d+)\s+ACCEPT\s+tcp\s+\-{2}\s+0\.0\.0\.0\/0\s+0\.0\.0\.0\/0/) {
266: my $firewall_command = "$iptables -D $fw_chain $1";
267: system($firewall_command);
268: my $return_status = $?>>8;
269: if ($return_status == 1) {
270: print 'Error closing port '.$port.' for source "anywhere"'."\n";
271: } elsif ($return_status == 2) {
272: print 'Bad command error closing port '.$port.' for source "anywhere". Command was'."\n".
273: ' '.$firewall_command."\n";
274: } else {
275: print 'Port '.$port.' closed for source "anywhere"'."\n";
276: }
277: }
278: }
279: close(PIPE);
280: }
281:
282: sub get_lond_port {
283: my $perlvarref=&LONCAPA::Configuration::read_conf();
284: my $lond_port;
285: if (ref($perlvarref) eq 'HASH') {
286: if (defined($perlvarref->{'londPort'})) {
287: $lond_port = $perlvarref->{'londPort'};
288: }
289: }
290: if (!$lond_port) {
291: print("Unable to determine lond port number from LON-CAPA configuration.\n");
292: }
293: return $lond_port;
294: }
295:
296: sub get_fw_chain {
1.4 ! raeburn 297: my ($iptables) = @_;
1.1 raeburn 298: my $fw_chain = 'RH-Firewall-1-INPUT';
299: my $suse_config = "/etc/sysconfig/SuSEfirewall2";
300: if (-e $suse_config) {
301: $fw_chain = 'input_ext';
302: } else {
303: if (!-e '/etc/sysconfig/iptables') {
304: print("Unable to find iptables file containing static definitions\n");
305: }
1.4 ! raeburn 306: if ($iptables eq '') {
! 307: $iptables = &get_pathto_iptables();
! 308: }
1.3 raeburn 309: my $count = `$iptables -L -n 2>/dev/null |grep $fw_chain |wc -l`;
310: chomp($count);
311: if (!$count) {
312: $fw_chain ='INPUT';
313: }
1.1 raeburn 314: }
315: return $fw_chain;
316: }
317:
318: sub get_pathto_iptables {
319: my $iptables;
320: if (-e '/sbin/iptables') {
321: $iptables = '/sbin/iptables';
322: } elsif (-e '/usr/sbin/iptables') {
323: $iptables = '/usr/sbin/iptables';
324: } else {
325: print("Unable to find iptables command\n");
326: }
327: return $iptables;
328: }
329:
330: 1;
331: __END__
332:
333: =pod
334:
335: =head1 NAME
336:
337: B<LONCAPA::Firewall> - dynamic opening/closing of firewall ports
338:
339: =head1 SYNOPSIS
340:
341: use lib '/home/httpd/lib/perl/';
342: use LONCAPA::Firewall;
343:
344: LONCAPA::Firewall::firewall_open_port();
345: LONCAPA::Firewall::firewall_close_port();
346: LONCAPA::Firewall::firewall_is_port_open();
347: LONCAPA::Firewall::firewall_is_active();
348: LONCAPA::Firewall::firewall_close_anywhere();
349:
350: =head1 DESCRIPTION
351:
352: The scripts: /etc/init.d/loncontrol, used to stop or start LON-CAPA services,
353: as well as the setuid script /home/httpd/perl/lciptables, called by loncron
354: for housekeeping tasks, make use of the methods provided by this module to
355: open and close firewall ports (currently the default port: 5663), used
356: for socket-based communication between LON-CAPA servers in the cluster
357: of networked servers to which the server belongs.
358:
359: The following methods are available:
360:
361: =over 4
362:
363: =item LONCAPA::Firewall::firewall_open_port( $iptables,$fw_chain,$lond_port,$iphost,$port );
364:
365: =back
366:
367: =over 4
368:
369: =item LONCAPA::Firewall::firewall_close_port( $iptables,$fw_chain,$lond_port,$ports );
370:
371: =back
372:
373: =over 4
374:
375: =item LONCAPA::Firewall::firewall_is_port_open( $iptables,$fw_chain,$port,$lond_port,$iphost );
376:
377: =back
378:
379: =over 4
380:
381: =item LONCAPA::Firewall::firewall_is_active();
382:
383: =back
384:
385: =over 4
386:
387: =item LONCAPA::Firewall::firewall_close_anywhere( $iptables,$fw_chain,$port );
388:
389: =back
390:
391: =over 4
392:
393: =item LONCAPA::Firewall::get_lond_port();
394:
395: =back
396:
397: =over 4
398:
399: =item LONCAPA::Firewall::get_fw_chain();
400:
401: =back
402:
403: =over 4
404:
405: =item LONCAPA::Firewall::get_pathto_iptables();
406:
407:
408: =head1 AUTHORS
409:
410: This library is free software; you can redistribute it and/or
411: modify it under the same terms as LON-CAPA itself.
412:
413: =cut
414:
FreeBSD-CVSweb <freebsd-cvsweb@FreeBSD.org>
![[BACK]](/icons/back.gif){kind=icon}
Return to Firewall.pm CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [LON-CAPA] / loncom / configuration