RCS file: /cvsroot/firehol/firehol/firehol.sh,v
Working file: firehol.sh
head: 1.226
branch:
locks: strict
access list:
symbolic names:
	start: 1.1.1.1
	vendor: 1.1.1
keyword substitution: kv
total revisions: 227;	selected revisions: 227
description:
----------------------------
revision 1.226
date: 2005/01/25 21:28:19;  author: ktsaou;  state: Exp;  lines: +10 -10
Remove -p from mkdir commands, in order for them to fail if the directory
to be created already exists.
----------------------------
revision 1.225
date: 2005/01/25 21:07:01;  author: ktsaou;  state: Exp;  lines: +12 -12
Made sure that no files are created anywhere except the firehol temp dir.
Made the firehol temp dir use the $RANDOM variable to randomize its name.
----------------------------
revision 1.224
date: 2005/01/24 22:24:48;  author: ktsaou;  state: Exp;  lines: +8 -8
Fixed service pptp to control GRE traffic in a stateless way.
----------------------------
revision 1.223
date: 2005/01/24 21:23:38;  author: ktsaou;  state: Exp;  lines: +145 -103
Added security checks to directory creation mechanism.
----------------------------
revision 1.222
date: 2005/01/21 19:58:09;  author: ktsaou;  state: Exp;  lines: +9 -6
Added service DICT (kdict, gnome-dictionary).
----------------------------
revision 1.221
date: 2004/12/29 22:34:45;  author: ktsaou;  state: Exp;  lines: +21 -14
Minor fixes for calculating minor firehol version number, added transparent
proxy to line number calculation and fix a typo in the docs.
----------------------------
revision 1.220
date: 2004/12/23 18:43:03;  author: ktsaou;  state: Exp;  lines: +8 -6
The knock was not allowing established connections, and knockd was
inserting a rule with a -s which matched requests but did not match the
replies.

Now, the default is to allow established connections for knock and only
control NEW connections via knockd.
----------------------------
revision 1.219
date: 2004/12/22 23:05:57;  author: ktsaou;  state: Exp;  lines: +38 -8
Small internal changes.

Added support for integration with knockd (http://www.zeroflux.org/knock/)
This integration comes as part of the ACCEPT action:

accept [with knock <name>]
The optional parameter 'with knock' allows easy integration with knockd,
a server that allows you to control access to services, by sending certain
packets to "knock" the door, before the door is open for service.

This parameter accepts just a name. This name is used to build a special
chain knock_<name> which will contain no rules, so that the traffic entering
this chain will just return back and continue to match against the other
rules until the end of the firewall.

As an example, lets say that you want to allow https traffic based on a knock.
In FireHOL you write:

   server https accept with knock hidden

and you configure knockd so that it runs:

   iptables -A knock_hidden -s %IP% -j ACCEPT

to enable the https service (notice that there is no need to match anything
else than the IP. FireHOL already matches everything needed for its rules
to work), and:

   iptables -D knock_hidden -s %IP% -j ACCEPT

to disable this service for the given IP.
----------------------------
revision 1.218
date: 2004/12/21 21:49:11;  author: ktsaou;  state: Exp;  lines: +24 -18
Added helper 'transparent_proxy' and modified 'transparent_squid' to call
the new helper for setting up transparent web proxies.
----------------------------
revision 1.217
date: 2004/12/03 21:29:41;  author: ktsaou;  state: Exp;  lines: +36 -5
Added service TIMESTAMP.
----------------------------
revision 1.216
date: 2004/11/04 19:47:05;  author: ktsaou;  state: Exp;  lines: +7 -7
Fixed a bug in FIREHOL_OUTPUT_ACTIVATION_POLICY which was incorrectly
setting the INPUT policy.
----------------------------
revision 1.215
date: 2004/11/02 00:37:15;  author: ktsaou;  state: Exp;  lines: +38 -5
Added service ANYSTATELESS
----------------------------
revision 1.214
date: 2004/11/01 00:13:00;  author: ktsaou;  state: Exp;  lines: +30 -10
Implemented minor version check on services in /etc/firehol/services
----------------------------
revision 1.213
date: 2004/10/31 03:17:00;  author: ktsaou;  state: Exp;  lines: +9 -6
Fixed a type in DSCP optional rule parameter.
Added line numbering to newly added helpers.
----------------------------
revision 1.212
date: 2004/10/31 02:21:02;  author: ktsaou;  state: Exp;  lines: +497 -256
Added helpers:

tos	- to set the TOS of packets
dscp	- to set the DSCP field of packets (both raw and class)


Added optional rule parameters:

tos	- to match the TOS of packets
mark	- to match the MARK ID of packets
dscp	- to match the DSCP field of packets (both raw and class)


Added the following actions to the rule() function:

dscp

The rule() function already had support for TOS and MARK.
----------------------------
revision 1.211
date: 2004/10/30 23:03:57;  author: ktsaou;  state: Exp;  lines: +35 -8
Created the complex service DHCP and removed the simple one.
The complex DHCP is now stateless to overcome all the problems that
arise due to the initial DHCP broadcast.
----------------------------
revision 1.210
date: 2004/10/30 22:41:21;  author: ktsaou;  state: Exp;  lines: +16 -12
Service SAMBA now includes MICROSOFT_DS (tcp/445). Also, updated samba
related documentation.
----------------------------
revision 1.209
date: 2004/10/30 21:27:00;  author: ktsaou;  state: Exp;  lines: +18 -8
Some error detection for /etc/firehol/services directory creation.
----------------------------
revision 1.208
date: 2004/10/30 21:13:26;  author: ktsaou;  state: Exp;  lines: +109 -5
Added service NIS.

Created by Carlos Rodrigues <crlf@users.sourceforge.net>
Feature Requests item #1050951 <https://sourceforge.net/tracker/?func=detail&atid=487695&aid=1050951&group_id=58425>

These rules work for client access only!

Pushing changes to slave servers won't work if these rules are active
somewhere between the master and its slaves, because it is impossible to
predict the ports where "yppush" will be listening on each push.

Pulling changes directly on the slaves will work, and could be improved
performance-wise if these rules are modified to open "fypxfrd". This wasn't
done because it doesn't make that much sense since pushing changes on the
master server is the most common, and recommended, way to replicate maps.
----------------------------
revision 1.207
date: 2004/10/28 23:03:06;  author: ktsaou;  state: Exp;  lines: +67 -13
Added support for externally defined services in files under directory:

/etc/firehol/services

This directory may contain files ending with .conf. Example: imap.conf
Each file should *start* with a line like this:

#FHVER: 1

This must be the FIRST line of the file.
The number 1 is the FIREHOL_SERVICES_API version number. If the API within
FireHOL changes, FireHOL will refuse to load all those services files that
their API version number does not match.
----------------------------
revision 1.206
date: 2004/10/28 22:02:43;  author: ktsaou;  state: Exp;  lines: +9 -5
Added service nut.
----------------------------
revision 1.205
date: 2004/10/08 22:30:52;  author: ktsaou;  state: Exp;  lines: +90 -46
Added helper 'tcpmss'.
Added service 'nntps'.
Converted all simple services' port definitions to numeric.
Updated documentation accordingly.
----------------------------
revision 1.204
date: 2004/09/26 00:52:55;  author: ktsaou;  state: Exp;  lines: +55 -6
Added services:

asterisk, darkstat, distcc, eserver, gift, giftui, h323, iax, iax2, icp,
rtp, sip, stun, upnp.
----------------------------
revision 1.203
date: 2004/09/14 21:15:44;  author: ktsaou;  state: Exp;  lines: +119 -7
Added support for options to the ACCEPT action in order to allow
a certain frequency of NEW connections per service.

Now the template for the ACCEPT action is this:

ACCEPT [with limit frequency burst [overflow action]]

for example:

server smtp accept with limit 10/s 100 overflow drop

which means there is now control for the frequency at which NEW incoming
connections are accepted and control is also provided for the overflow
NEW ones.

The default overflow action is REJECT which rejects TCP connections with
TCP-RESET and all others with ICMP-PORT-UNREACHABLE.

To add other optional rule parameters to the server/client/route command
just add them after the ACCEPT expression. For example:

server smtp accept with limit 10/s 1000 src 1.2.3.4

If there are overflow NEW connections, the firewall will log "OVERFLOW"
with the packets and the frequency of loglimit (controled via global
variables).

The overflow action cannot accept parameters.
----------------------------
revision 1.202
date: 2004/09/12 07:24:58;  author: ktsaou;  state: Exp;  lines: +8 -5
Added RDP service.
----------------------------
revision 1.201
date: 2004/09/12 06:57:47;  author: ktsaou;  state: Exp;  lines: +9 -5
Added service NXSERVER.
----------------------------
revision 1.200
date: 2004/09/10 22:07:18;  author: ktsaou;  state: Exp;  lines: +16 -5
Added a warning if wrong arguments are detected.
----------------------------
revision 1.199
date: 2004/09/10 21:36:26;  author: ktsaou;  state: Exp;  lines: +12 -5
Added rquotad to the NFS service.
----------------------------
revision 1.198
date: 2004/08/21 21:07:09;  author: ktsaou;  state: Exp;  lines: +6 -6
Updated RESERVED_IPS according to current IANA reserved IP range.
----------------------------
revision 1.197
date: 2004/07/31 22:31:08;  author: ktsaou;  state: Exp;  lines: +31 -33
Due to a bug in BASH 3.0, the unset bash function corrupts array variables.
Changed FireHOL to set all variables to empty instead of unseting them.
----------------------------
revision 1.196
date: 2004/07/29 22:31:14;  author: ktsaou;  state: Exp;  lines: +12 -6
Added documentation for DHCP and dropped packets.
Changed radius definition to use port numbers instead of port names
(gentoo has different names).
Added RADIUSPROXY and RADIUSOLDPROXY services.
----------------------------
revision 1.195
date: 2004/07/07 22:09:31;  author: ktsaou;  state: Exp;  lines: +14 -7
Added variable FIREHOL_TRUST_LOOPBACK=1 which if set to 0, FireHOL will not
trust the lo interface allowing the admin to setup a firewall on it.
----------------------------
revision 1.194
date: 2004/05/15 10:19:01;  author: ktsaou;  state: Exp;  lines: +9 -5
Added an iptables -nxvL command at the top of firehol.sh to initialize
iptables. Without it a few users have reported problems using firehol
during boot.
----------------------------
revision 1.193
date: 2004/05/05 23:41:19;  author: ktsaou;  state: Exp;  lines: +88 -11
Added helper 'ecn_shame' that once called, it looks if ECN is enabled in
the kernel, and if it is, it fetches:

http://urchin.earth.li/cgi-bin/ecn.pl?output=ip

and disables ECN for all communication with these hosts.
----------------------------
revision 1.192
date: 2004/05/04 21:39:33;  author: ktsaou;  state: Exp;  lines: +76 -5
Added grouping functionality. This is not yet finished. It has been added
to allow other developers test the functionality before optimizing all the
rules to use groups.
To use grouping, within an interface or router write:

group with [optional rule parameters]
   server x accept
   server y accept
group end

This will generate a much more optimized version of:

server "x y" accept [optional rule parameters]

by applying all the optional rule parameters once (instead of once per
service).
----------------------------
revision 1.191
date: 2004/04/23 22:15:18;  author: ktsaou;  state: Exp;  lines: +26 -15
Made the nat helpers print their real statements instead of always
appearing as 'nat'.
----------------------------
revision 1.190
date: 2004/04/23 07:36:12;  author: ktsaou;  state: Exp;  lines: +7 -7
Changed two:

tr [a-z] [A-Z]

to:

tr a-z A-Z

because a few versions of tr complain with the first format.
----------------------------
revision 1.189
date: 2004/04/23 07:32:01;  author: ktsaou;  state: Exp;  lines: +6 -6
Fixed a printf that was giving errors because an argument was not numeric.
----------------------------
revision 1.188
date: 2004/04/21 22:57:11;  author: ktsaou;  state: Exp;  lines: +5 -7
Removed the "press return to continue" from the 'debug' mode.
----------------------------
revision 1.187
date: 2004/04/21 22:39:40;  author: ktsaou;  state: Exp;  lines: +12 -7
FireHOL now checks that /var/lock/subsys (the dir RH uses for startup
services lock files) exists before using it.
----------------------------
revision 1.186
date: 2004/04/21 22:23:10;  author: ktsaou;  state: Exp;  lines: +8 -5
Added service WHOIS.
----------------------------
revision 1.185
date: 2004/04/21 21:48:32;  author: ktsaou;  state: Exp;  lines: +10 -5
Kernel configuration is now searched in this order:

1. /proc/config
2. /lib/modules/`uname -r`/build/.config
3. /boot/config-`uname -r`
4. /usr/src/linux/.config

Check No 3 was added now.
----------------------------
revision 1.184
date: 2004/04/21 21:35:29;  author: ktsaou;  state: Exp;  lines: +108 -49
IMPORTANT: My second kid was born a week ago!

Added a lot of information to the generated iptables command line to
debug both the commands generated and what FireHOL did.

Fixed a bug in kernel module management: check_kernel_module() was supposed
to be a runtime function, but accidentaly I had it generating commands
to be run later - which of course were not run.
----------------------------
revision 1.183
date: 2004/04/01 23:30:28;  author: ktsaou;  state: Exp;  lines: +19 -9
Added finer control to control INVALID packets.
The default is now not to drop invalid packets globaly, but to drop them
as part of the protection statement (i.e. protection invalid). The default
full/strong/all protections include the invalid match.

To enable invalid packets dropping globaly (the previous behaviour) one
can give:

FIREHOL_DROP_INVALID=1

at the top of the configuration file.
----------------------------
revision 1.182
date: 2004/03/04 22:05:53;  author: ktsaou;  state: Exp;  lines: +5 -6
Removed a tcp-flags match from protection because it was a subset of
another one already defined.
----------------------------
revision 1.181
date: 2004/03/03 23:18:43;  author: ktsaou;  state: Exp;  lines: +40 -36
Fixed the required commands finder to stop properly when some system
command is not found in the system path.
----------------------------
revision 1.180
date: 2004/03/03 22:19:15;  author: ktsaou;  state: Exp;  lines: +6 -5
Added:

--tcp-flags SYN,RST,PSH,ACK,URG SYN,RST,PSH,URG

to the list of malformed packets.
----------------------------
revision 1.179
date: 2004/03/03 21:24:41;  author: ktsaou;  state: Exp;  lines: +12 -15
Minor mac optional rule parameter fix.
----------------------------
revision 1.178
date: 2004/03/03 20:32:35;  author: ktsaou;  state: Exp;  lines: +11 -6
Completed the mac optional rule parameter. This was implemented since
v1.134 but it was producing rules for both input and output packets.

Now, it produces mac rules only for packets comming in the firewall
(interfaces and routers).
----------------------------
revision 1.177
date: 2004/02/07 00:43:11;  author: ktsaou;  state: Exp;  lines: +6 -6
BUG 891471:
Multicast CIDR block is actually 224.0.0.0/4.
It extends from 224-239.

Fixed.
----------------------------
revision 1.176
date: 2004/01/10 18:44:39;  author: ktsaou;  state: Exp;  lines: +8 -6
Further optimized and reduced PRIVATE_IPS using:
http://www.vergenet.net/linux/aggregate/

The supplied get-iana.sh uses 'aggregate-flim' if it finds it in the path.
(aggregate-flim is the name of this program when installed on Gentoo)
----------------------------
revision 1.175
date: 2004/01/02 22:32:28;  author: ktsaou;  state: Exp;  lines: +6 -6
Fixed a warning generated incorrectly by the mark helper.
----------------------------
revision 1.174
date: 2003/12/29 22:46:00;  author: ktsaou;  state: Exp;  lines: +7 -7
Aesthetic changes.
----------------------------
revision 1.173
date: 2003/12/29 22:40:11;  author: ktsaou;  state: Exp;  lines: +70 -11
Added count of iptables commands generated.
----------------------------
revision 1.172
date: 2003/12/01 05:03:11;  author: ktsaou;  state: Exp;  lines: +17 -8
Added FIREHOL_LOG_MODE which can either be LOG or ULOG to select the
logging mode for iptables. All FireHOL optional rule parameters use this.

Updated documentation to reflect the change.
----------------------------
revision 1.171
date: 2003/11/23 19:27:58;  author: ktsaou;  state: Exp;  lines: +6 -6
Changed a "head -1" to "head -n 1" because head does not support the first
syntax anymore. Thanks to Maik Schreiber <blizzy@blizzy.de> for reporting
this.
----------------------------
revision 1.170
date: 2003/11/23 13:43:19;  author: ktsaou;  state: Exp;  lines: +11 -5
Added support for kernel config in /lib/modules/`uname -r`/build/.config

Updated documentation.
----------------------------
revision 1.169
date: 2003/11/18 23:00:48;  author: ktsaou;  state: Exp;  lines: +6 -6
There was an extra - (minus) in the iptables command generation for
negative protocol expressions. Fixed.
----------------------------
revision 1.168
date: 2003/11/04 21:43:02;  author: ktsaou;  state: Exp;  lines: +21 -6
NETBIOS initiates based on the broadcast address of an interface
(request goes to broadcast address) but the server responds from
its own IP address. This makes the server samba accept statement
drop the server reply.
Bellow is a hack, that allows a linux samba server to respond
correctly, as it allows new outgoing connections from the well
known netbios-ns port to the clients high ports.
For clients and routers this hack is not applied because it
would be a huge security hole.
----------------------------
revision 1.167
date: 2003/11/03 20:43:09;  author: ktsaou;  state: Exp;  lines: +6 -6
Added again 172.16.0.0/12 to PRIVATE_IPS.
----------------------------
revision 1.166
date: 2003/10/26 21:40:30;  author: ktsaou;  state: Exp;  lines: +67 -56
Fixed PRIVATE_IPS (there was an duplicate entry and a wrong entry).
----------------------------
revision 1.165
date: 2003/10/26 21:27:31;  author: ktsaou;  state: Exp;  lines: +102 -8
Changed kernel module management to read kernel configuration and detect
if a module is compiled in the kernel or needs to be loaded separately.

(note: this is not finished yet)
----------------------------
revision 1.164
date: 2003/10/22 06:58:27;  author: ktsaou;  state: Exp;  lines: +6 -6
Changed TIME service ports to numeric since a few versions of bash get
confused by the use of the reserved keywork "time".
----------------------------
revision 1.163
date: 2003/10/20 17:49:56;  author: ktsaou;  state: Exp;  lines: +7 -7
Fixed service CUPS according to the following:

> The firehol system defines the 'cups' protocol as:
>
> server_cups_ports="tcp/631"
> client_cups_ports="default"
>
> This isn't a complete definition - CUPS also has an internal printer
> browsing protocol that operates over UDP, on port 631.
>
> The following definition is more correct:
>
> server_cups_ports="tcp/631 udp/631"
> client_cups_ports="default 631"
----------------------------
revision 1.162
date: 2003/10/18 09:40:45;  author: ktsaou;  state: Exp;  lines: +8 -5
Added Distributed Checksum Clearinghouses (DCC) service.
----------------------------
revision 1.161
date: 2003/10/16 22:05:22;  author: ktsaou;  state: Exp;  lines: +194 -84
Added the PHYSIN and PHYSOUT optional rule parameters to match the
physical network interface in cases where iptables defines as inface
and outface a virtual interface such as a bridge.
----------------------------
revision 1.160
date: 2003/10/13 18:50:30;  author: ktsaou;  state: Exp;  lines: +13 -5
Added services ORACLE and GKRELLMD.
----------------------------
revision 1.159
date: 2003/10/09 10:01:26;  author: ktsaou;  state: Exp;  lines: +9 -5
Added service Veritas NetBackup.
----------------------------
revision 1.158
date: 2003/10/07 22:31:06;  author: ktsaou;  state: Exp;  lines: +12 -7
Added lockd support in service NFS, as suggested by
"Daniel Pittman" <daniel@rimspace.net>
----------------------------
revision 1.157
date: 2003/10/06 00:17:23;  author: ktsaou;  state: Exp;  lines: +18 -6
Fixed TFTP service according to Goetz Bock <bock@blacknet.de> suggestions.
----------------------------
revision 1.156
date: 2003/10/05 22:58:57;  author: ktsaou;  state: Exp;  lines: +110 -68
Cleaned up all complex services.
Added complex service TFTP.
----------------------------
revision 1.155
date: 2003/09/18 20:54:25;  author: ktsaou;  state: Exp;  lines: +8 -5
When I first started FireHOL (about a year before) I started with the
header part of /etc/init.d/iptables (of redhat 7.2). This header
just checked the kernel version and made a check on whether ipchains
was running. If any of the above was faulty (kernel version less than
2.3 or ipchains loaded into the kernel) it was exiting silently.

Although I still keep this logic, now FireHOL will print a warning
instead of just exiting silently.
----------------------------
revision 1.154
date: 2003/09/13 01:03:46;  author: ktsaou;  state: Exp;  lines: +26 -5
Added helper 'mark'

Abstract from the documentation:

mark <NUMBER> <WHERE> [optional rule parameters]

The mark helper marks the traffic with a specific mark NUMBER
that can be matched by traffic shapping tools for controlling the
traffic.

Parameters

    * NUMBER is a number to mark the packets with.

    * WHERE tells FireHOL where to search for the specific traffic
      to be marked.
      Currently, WHERE can be one of the build-in iptables chains
      attached to table mangle. (for example: INPUT, FORWARD, OUTPUT,
      PREROUTING, POSTROUTING - case does matter here).

    * optional rule parameters is a set of rules that allow further
      restriction of the traffic that gets matched by this rule.
      See Optional Rules Parameters for more information.

Example 1: mark 1 OUTPUT
   will mark with 1 all packets send by the local machine.

Example 2: mark 2 FORWARD
   will mark with 2 all packets passing through the local machine.

Example 3: mark 3 FORWARD proto tcp dport 25 dst 1.1.1.1 src 2.2.2.2
   will match with 3 all packets sent by 2.2.2.2, passing through the
   local machine and targeting port TCP/25 of host 1.1.1.1.
----------------------------
revision 1.153
date: 2003/08/31 22:21:49;  author: ktsaou;  state: Exp;  lines: +8 -5
Added service XDMCP.
----------------------------
revision 1.152
date: 2003/08/23 23:26:50;  author: ktsaou;  state: Exp;  lines: +6 -6
Bug #793889:
Change #!/bin/sh to #!/bin/bash to allow FireHOL run on systems that
bash is not linked to /bin/sh.
----------------------------
revision 1.151
date: 2003/08/23 22:50:14;  author: ktsaou;  state: Exp;  lines: +7 -7
Bug #893887:
Added -q to modprobe in order not to complain about modules already
loaded in kernel 2.6.x with module-init-tools
----------------------------
revision 1.150
date: 2003/08/23 22:27:34;  author: ktsaou;  state: Exp;  lines: +35 -11
Made the blacklist helper produce only one set of chains for all its runs.
This will keep the produced rules clearer and the firewall smaller.
----------------------------
revision 1.149
date: 2003/08/23 21:42:35;  author: ktsaou;  state: Exp;  lines: +54 -5
Added "blacklist" helper to create blacklists.

Abstract from the documentation:

blacklist [option] <IP>
The blacklist helper creates a blacklist for the IP addresses given.
It supports two modes of operation based on the option given (or the
absence of it).

The option can be:

    * one of the words them, him, her, it, this, these, input in which
      case it will generate a unidirectional statefull blacklist,
      meaning that you will be able to ask (initiate connections)
      anything from them, but they will not be able to ask (initiate
      connections) anything from you or the remote hosts you protect
      (routing).

    * one of the words all, full or ommitted (no option given), in
      which case FireHOL will create bidirectional stateless rules
      that will DROP all traffic comming in from these IPs and will
      REJECT all traffic going to them.

The blacklist helper affects both interfaces and routers.

Example 1: blacklist this 195.97.5.202
Example 2: blacklist full 195.97.5.202

Suggested by: Mikkel Schubert
----------------------------
revision 1.148
date: 2003/08/19 22:21:32;  author: ktsaou;  state: Exp;  lines: +6 -6
Fixed a minor bug in kernel module handling that made it not detect that
ip_tables is already compiled (or loaded) in the kernel.
----------------------------
revision 1.147
date: 2003/07/31 20:44:45;  author: ktsaou;  state: Exp;  lines: +7 -7
More Gentoo compatibility (mainly change of port names to port numbers in
services).
----------------------------
revision 1.146
date: 2003/07/27 22:58:59;  author: ktsaou;  state: Exp;  lines: +21 -8
Minor changes for gentoo compatibility (SAVE feature)
.
----------------------------
revision 1.145
date: 2003/07/20 22:45:50;  author: ktsaou;  state: Exp;  lines: +43 -7
Added service HYLAFAX, although experimental.
----------------------------
revision 1.144
date: 2003/07/20 22:14:28;  author: ktsaou;  state: Exp;  lines: +37 -37
As suggested by "Francisco Javier Félix Belmonte" <ffelix@gescosoft.com>
fixed all EOF statements in order to produce cleaner iptables run script.
----------------------------
revision 1.143
date: 2003/07/20 21:52:41;  author: ktsaou;  state: Exp;  lines: +8 -5
Added service POSTGRES.
----------------------------
revision 1.142
date: 2003/07/20 21:50:29;  author: ktsaou;  state: Exp;  lines: +8 -5
Added TIME service.
----------------------------
revision 1.141
date: 2003/07/20 21:48:01;  author: ktsaou;  state: Exp;  lines: +6 -6
Changed service CUPS ports to numeric. Gentoo does not have this defined.
----------------------------
revision 1.140
date: 2003/07/20 21:46:41;  author: ktsaou;  state: Exp;  lines: +131 -86
Added --cmd-owner support.
----------------------------
revision 1.139
date: 2003/06/30 22:18:46;  author: ktsaou;  state: Exp;  lines: +8 -5
Added service webmin.
----------------------------
revision 1.138
date: 2003/06/30 22:07:01;  author: ktsaou;  state: Exp;  lines: +11 -5
Added jabber and jabberd services.
----------------------------
revision 1.137
date: 2003/06/28 23:22:49;  author: ktsaou;  state: Exp;  lines: +9 -7
Aesthetic changes in mac helper.
----------------------------
revision 1.136
date: 2003/06/28 21:26:20;  author: ktsaou;  state: Exp;  lines: +6 -6
Updated service LPD according to RFCs, and now it accepts only ports
721 to 731 inclusive, plus the default client ports.
----------------------------
revision 1.135
date: 2003/06/28 20:52:09;  author: ktsaou;  state: Exp;  lines: +7 -7
Reverted DEFAULT_CLIENT_PORTS to 1024+ (was 1000+)

Made LPD client ports "any".
----------------------------
revision 1.134
date: 2003/06/18 22:56:24;  author: ktsaou;  state: Exp;  lines: +120 -52
Added the "mac" optional rule parameter, that matches the source mac
address of packets.

Added the "mac" helper that verifies that packets comming in from a
specific source IP address, always come from a specific MAC address.
This applies to the whole firewall (INPUT and FORWARD).
----------------------------
revision 1.133
date: 2003/06/18 21:44:52;  author: ktsaou;  state: Exp;  lines: +19 -5
Added FIREHOL_INPUT_ACTIVATION_POLICY, FIREHOL_OUTPUT_ACTIVATION_POLICY,
and FIREHOL_FORWARD_ACTIVATION_POLICY to control the firewall default
policy during firewall activation.
----------------------------
revision 1.132
date: 2003/06/11 07:00:24;  author: ktsaou;  state: Exp;  lines: +7 -7
Optimized RESERVED_IPS as suggested by Marc 'HE' Brockschmidt
<marc@marcbrockschmidt.de>.
----------------------------
revision 1.131
date: 2003/06/10 21:27:46;  author: ktsaou;  state: Exp;  lines: +11 -5
Added MSN and DCPP services.
----------------------------
revision 1.130
date: 2003/06/10 20:44:27;  author: ktsaou;  state: Exp;  lines: +7 -8
Added man page for firehol.conf, contributed by
"Marc 'HE' Brockschmidt" <marc@marcbrockschmidt.de>

Thanks Marc.
----------------------------
revision 1.129
date: 2003/05/22 19:39:53;  author: ktsaou;  state: Exp;  lines: +56 -29
Made FireHOL mv /etc/firehol.conf to /etc/firehol/firehol.conf, if
/etc/firehol (directory) does not exist.

Also, made _CMD variables better detect wrong situations, such as
multiple instanses of the same command, command not found, etc.
----------------------------
revision 1.128
date: 2003/05/01 01:30:24;  author: ktsaou;  state: Exp;  lines: +9 -9
Made default config in /etc/firehol/firehol.conf to comform with various
distributions that prefer it this way (Gentoo).

This will also allow to have services.d within this directory.
----------------------------
revision 1.127
date: 2003/04/30 23:29:47;  author: ktsaou;  state: Exp;  lines: +9 -9

"Marc 'HE' Brockschmidt" <marc@marcbrockschmidt.de> wrote:

Today, I've tried to debianize firehol, but noticed a few problems
(eg. the need for a force-reload-option for every init-script [you could
realize it as an alias for restart]).
I've corrected a few " !!!" (As a reader of Terry Pratchett, I had to
kill them ;-)
I'm attaching a patch for these issues.

I've also created a manpage for FireHOL, and I'm working on the manpage
for firehole.conf.

---
Thank you Marc.
----------------------------
revision 1.126
date: 2003/04/24 08:15:08;  author: ktsaou;  state: Exp;  lines: +6 -6
Fixed a 'touch' cmd to use the external command system.
----------------------------
revision 1.125
date: 2003/04/24 08:12:51;  author: ktsaou;  state: Exp;  lines: +12 -5
Made HELPME detect duplicate routers and prevent multiple definitions
of them.
----------------------------
revision 1.124
date: 2003/04/23 20:42:26;  author: ktsaou;  state: Exp;  lines: +18 -7
Eliminated duplicate router definitions in HELPME, when an interface
has multiple IPs on the same subnet.
----------------------------
revision 1.123
date: 2003/04/20 10:18:10;  author: ktsaou;  state: Exp;  lines: +27 -7
FireHOL now stops the firewall with its own logic (without calling
/etc/init.d/iptables) since some distribution do not have this.
----------------------------
revision 1.122
date: 2003/04/18 20:52:44;  author: ktsaou;  state: Exp;  lines: +48 -13
Module management can now be controlled with FIREHOL_LOAD_KERNEL_MODULES.
Default value is 1, it can be set to 0 to disable module management.

Also, now FireHOL automatically detects if ip_tables and ip_conntrack
are build into the kernel, by looking for relative files in /proc/net.
----------------------------
revision 1.121
date: 2003/04/08 00:12:02;  author: ktsaou;  state: Exp;  lines: +184 -150
Removed all hard-coded references to external commands and made a dynamic
list at the top of FireHOL. Now FireHOL will refuse to run if some command
is missing.
----------------------------
revision 1.120
date: 2003/03/19 21:51:56;  author: ktsaou;  state: Exp;  lines: +16 -6
Fixed MIRROR statements to produce REJECT on the OUTPUT of the host.
----------------------------
revision 1.119
date: 2003/03/18 21:27:35;  author: ktsaou;  state: Exp;  lines: +9 -9
Copyright notices now print year 2003.
----------------------------
revision 1.118
date: 2003/03/17 23:03:00;  author: ktsaou;  state: Exp;  lines: +13 -6
Cosmetic changes in 'helpme'
----------------------------
revision 1.117
date: 2003/03/17 22:57:26;  author: ktsaou;  state: Exp;  lines: +7 -6
Fixed broken 'helpme' detection of networks behind gateways. Now it works.
----------------------------
revision 1.116
date: 2003/03/17 22:42:18;  author: ktsaou;  state: Exp;  lines: +46 -9
'helpme' now detects multiple overlapping networks defined for the same
interface. In such cases it only defines the wider network.
----------------------------
revision 1.115
date: 2003/03/16 22:13:30;  author: ktsaou;  state: Exp;  lines: +138 -50
Made 'helpme' detect point-to-point routes better.
----------------------------
revision 1.114
date: 2003/03/15 01:24:19;  author: ktsaou;  state: Exp;  lines: +8 -5
Added service 'socks'.
----------------------------
revision 1.113
date: 2003/03/15 00:59:27;  author: ktsaou;  state: Exp;  lines: +25 -5
'panic' now prevent you from loosing the SSH you are issuing this command
by allowing the established connection specified in the environment
variable SSH_CLIENT (only if it exists: it is lost if you su -, you should
su without the minus).

Also, the panic argument takes one optional argument. This can be an IP
address in which case all established connections between the host and this
IP will be allowed.
----------------------------
revision 1.112
date: 2003/03/14 21:22:37;  author: ktsaou;  state: Exp;  lines: +6 -6
The squid service has been defined with numeric port numbers because
Debian systems have not this service defined.
----------------------------
revision 1.111
date: 2003/03/14 20:59:07;  author: ktsaou;  state: Exp;  lines: +26 -7
Command line argument 'panic' does not call the system's iptables script
but blocks all traffic by itself, since many systems do not have the
'panic' argument.
----------------------------
revision 1.110
date: 2003/03/14 20:36:52;  author: ktsaou;  state: Exp;  lines: +30 -10
Added FIREHOL_AUTOSAVE variable that controls the file that is saved with
the 'save' argument of FireHOL. By default this variable is empty in which
case FireHOL detects RedHat and Debian systems and saves it to the right
place.
----------------------------
revision 1.109
date: 2003/03/07 23:34:29;  author: ktsaou;  state: Exp;  lines: +7 -5
'helpme' now allows ICMP traffic by default.
----------------------------
revision 1.108
date: 2003/03/07 23:17:38;  author: ktsaou;  state: Exp;  lines: +15 -15
Fixed double quoting in router statements produced by 'helpme'.
----------------------------
revision 1.107
date: 2003/03/07 23:12:15;  author: ktsaou;  state: Exp;  lines: +15 -7
'helpme' handles multiple networks in router statements.
----------------------------
revision 1.106
date: 2003/03/07 23:01:31;  author: ktsaou;  state: Exp;  lines: +6 -6
'helpme' mode does not require a configuration file present.
----------------------------
revision 1.105
date: 2003/03/07 09:19:19;  author: ktsaou;  state: Exp;  lines: +6 -6
Made it not ignore the default route in 'helpme' routers.
----------------------------
revision 1.104
date: 2003/03/06 08:18:49;  author: ktsaou;  state: Exp;  lines: +17 -14
Minor changes in 'helpme' generation.
----------------------------
revision 1.103
date: 2003/03/05 22:06:51;  author: ktsaou;  state: Exp;  lines: +23 -14
Made it ignore a default gateway when there was a P-t-P default gateways
found.
----------------------------
revision 1.102
date: 2003/03/05 18:23:57;  author: ktsaou;  state: Exp;  lines: +106 -72
Made the 'helpme' feature append another interface for the default gateway.
----------------------------
revision 1.101
date: 2003/03/05 00:33:56;  author: ktsaou;  state: Exp;  lines: +23 -10
Minor changes in the default help page presented by FireHOL.
----------------------------
revision 1.100
date: 2003/03/05 00:11:56;  author: ktsaou;  state: Exp;  lines: +232 -154
Re-wrote 'helpme' to detect multiple IPs and networks per interfaces,
and to produce multiple interfaces for each IP. This means that FireHOL
is somewhat smart to match IPs with networks and interfaces, to detect
networks behind gateways, default gateways on point-to-point interfaces,
and to produce router statements matching the interfaces detected above.
----------------------------
revision 1.99
date: 2003/03/03 21:51:04;  author: ktsaou;  state: Exp;  lines: +22 -10
Made 'helpme' ignore interfaces that do not have an IP or no traffic is
routed to them (no route).
----------------------------
revision 1.98
date: 2003/02/26 22:26:16;  author: ktsaou;  state: Exp;  lines: +6 -6
Minor changes in 'helpme' and changes in documentation to reflect the
'helpme' feature addition.
----------------------------
revision 1.97
date: 2003/02/25 21:35:06;  author: ktsaou;  state: Exp;  lines: +151 -61
'helpme' now produces router statements for each network each interface
is attached to. This produces templates to be used in cases where one
interface is used for routing traffic between multiple networks.

Additionally, 'helpme' produces example SNAT statements to be used instead
of masquerade when the IPs of the interfaces are statically assigned.
----------------------------
revision 1.96
date: 2003/02/24 23:30:21;  author: ktsaou;  state: Exp;  lines: +48 -58
The helpme wizard now detects interfaces using:

ip link show

detects interface IPs using:

ip addr show

and detects interface networks using:

ip route show

This makes the 'helpme' wizard support any kind of interfaces,
configurations and interfaces aliases.
----------------------------
revision 1.95
date: 2003/02/22 03:50:55;  author: ktsaou;  state: Exp;  lines: +15 -7
Minor changes to helpme output.
----------------------------
revision 1.94
date: 2003/02/22 03:41:16;  author: ktsaou;  state: Exp;  lines: +203 -33
The helpme command line argument is now somewhat useful.
It produces a FireHOL configuration file in standard output.
----------------------------
revision 1.93
date: 2003/02/21 23:47:22;  author: ktsaou;  state: Exp;  lines: +6 -5
Added a modprobe ip_tables before iptables-save to make sure that the
later will not fail during boot.
----------------------------
revision 1.92
date: 2003/02/20 22:32:56;  author: ktsaou;  state: Exp;  lines: +126 -5
Fixed snmptrap and syslog.

Added the still 'under construction' wizard mode.
----------------------------
revision 1.91
date: 2003/02/18 20:42:20;  author: ktsaou;  state: Exp;  lines: +4 -4
Updated RESERVED_IPS according to the latest IANA Reserved IPv4 address
space.
----------------------------
revision 1.90
date: 2003/02/11 22:20:07;  author: ktsaou;  state: Exp;  lines: +25 -9
Added /sbin in front of two sysctl statements that were producing errors
in a few systems.

Added control option FIREHOL_LOG_LEVEL and the optional argument 'level'
to the 'log' parameter in order to accept custom log levels per rule.

Now, to have different log levels, one could write:

	server dhcp accept log "my-dhcp" src 1.1.1.1

to get the default controlled by FIREHOL_LOG_LEVEL, or

	server dhcp accept log "my-dhcp" level critical src 1.1.1.1

Note that the 'level' is NOT a FireHOL optional rule parameter. It is an
optional argument to the 'log' parameter. This for example is invalid:

	server dhcp accept level critical log "my-dhcp" src 1.1.1.1

The new definition of the 'log' optional rule parameter is:

                    log "some text" [level a_level]
----------------------------
revision 1.89
date: 2003/02/03 23:11:49;  author: ktsaou;  state: Exp;  lines: +52 -3
Added service emule.
----------------------------
revision 1.88
date: 2003/01/30 21:39:36;  author: ktsaou;  state: Exp;  lines: +6 -6
Fixed a typo.
----------------------------
revision 1.87
date: 2003/01/30 21:36:07;  author: ktsaou;  state: Exp;  lines: +65 -15
Added TOS and MARK actions in FireHOL's core to support Type-Of-Service and
MARKing (for traffic shapping) in the future.

Also, added an error handler that detects use of SNAT, DNAT, REDIRECT
outside the 'nat' table and TOS, MARK outside the 'mangle' table.
----------------------------
revision 1.86
date: 2003/01/29 23:19:20;  author: ktsaou;  state: Exp;  lines: +26 -12
The nat helper was wrongly producing duplicate logs when log/loglimit was
present in the optional rule parameters. Fixed.
----------------------------
revision 1.85
date: 2003/01/28 19:47:31;  author: ktsaou;  state: Exp;  lines: +4 -4
Made masquerade handle correctly interfaces given directly to it.
----------------------------
revision 1.84
date: 2003/01/28 19:42:09;  author: ktsaou;  state: Exp;  lines: +4 -4
Made it handle the 'reverse' keyword of masquerade correctly.
----------------------------
revision 1.83
date: 2003/01/25 02:33:59;  author: ktsaou;  state: Exp;  lines: +77 -36
FireHOL now supports runtime ERRORs and WARNINGs.

ERRORs are assumed to be situations where FireHOL cannot continue, and it
will exit just after restoring the previous firewall.

WARNINGs are situations where FireHOL cannot determine if the firewall
will or won't work, and it will just present the warning and continue.
----------------------------
revision 1.82
date: 2003/01/25 01:46:11;  author: ktsaou;  state: Exp;  lines: +15 -9
Made FireHOL not stop processing if some required kernel module is not
present. This behaviour is required when the required module is compiled
in the kernel, instead of being a module.

However, FireHOL still calls /sbin/modprobe which will print some error
to the console (this will not make FireHOL stop functioning).
----------------------------
revision 1.81
date: 2003/01/25 00:37:37;  author: ktsaou;  state: Exp;  lines: +25 -9
Added redirect helper to implement port redirections.
----------------------------
revision 1.80
date: 2003/01/22 21:14:21;  author: ktsaou;  state: Exp;  lines: +4 -4
Fixed a small typo.
----------------------------
revision 1.79
date: 2003/01/22 21:02:43;  author: ktsaou;  state: Exp;  lines: +11 -5
Added some comments to the just added code.
----------------------------
revision 1.78
date: 2003/01/22 20:54:05;  author: ktsaou;  state: Exp;  lines: +56 -93
Fixed a bug in 'REJECT with auto' that made FireHOL produce wrong iptables
statements in some versions of BASH.

Fixed a problem of some early 2.4 kernels where not all mangle default
chains are defined. Now, FireHOL detects which chains are present.
----------------------------
revision 1.77
date: 2003/01/22 19:13:27;  author: ktsaou;  state: Exp;  lines: +5 -5
Some text changes.
----------------------------
revision 1.76
date: 2003/01/20 22:10:56;  author: ktsaou;  state: Exp;  lines: +15 -5
Allowed multiple 'to' arguments to DNAT and SNAT.
----------------------------
revision 1.75
date: 2003/01/20 21:50:36;  author: ktsaou;  state: Exp;  lines: +6 -3
Added service cvspserver as suggested by Florian Thiel <thiel@ksan.de>
----------------------------
revision 1.74
date: 2003/01/16 00:55:36;  author: ktsaou;  state: Exp;  lines: +38 -27
Made snat and dnat use one core function named 'nat'.
----------------------------
revision 1.73
date: 2003/01/16 00:33:26;  author: ktsaou;  state: Exp;  lines: +166 -70
Added experimental "snat" and "dnat" helpers.
----------------------------
revision 1.72
date: 2003/01/14 21:49:23;  author: ktsaou;  state: Exp;  lines: +5 -5
*** empty log message ***
----------------------------
revision 1.71
date: 2003/01/13 23:31:03;  author: ktsaou;  state: Exp;  lines: +406 -281
Added user (uid), group (gid), process (pid), session (sid) to optional
rule parameters. Modified FireHOL to apply such parameters only to
traffic send by the localhost and silently ignore them on incoming and
passing through traffic.
----------------------------
revision 1.70
date: 2003/01/08 23:33:25;  author: ktsaou;  state: Exp;  lines: +68 -6
Added detection of overwritten optional rule parameters.
----------------------------
revision 1.69
date: 2003/01/08 22:42:46;  author: ktsaou;  state: Exp;  lines: +9 -6
changed helpers to overwrite illegal optional parameters in order to avoid
building rules that match nothing.

transparent_squid now passes some rule parameters to the rules matching
the user ids. This makes it possible to use succesfully negative rules,
such as:

dst not "A B C"

to make the transparent cache exclude these.
----------------------------
revision 1.68
date: 2003/01/07 20:21:57;  author: ktsaou;  state: Exp;  lines: +39 -30
Made transparent_squid accept multiple users
----------------------------
revision 1.67
date: 2003/01/07 01:51:47;  author: ktsaou;  state: Exp;  lines: +4 -22
Made internal parameters of masquerade to overwrite its optional ones.
Made the version command optional.
----------------------------
revision 1.66
date: 2003/01/06 16:13:34;  author: ktsaou;  state: Exp;  lines: +186 -93
The previous implementation of the "with" parameter was conflicting with
negative expressions. Fixed.

Now each action (ACCEPT, REJECT, etc) can have each own optional rule
parameters. Currently only REJECT (with) and REDIRECT (to-port) have
such parameters.

Implemented the REDIRECT action (usefull in NAT).

Introduced a new concept in FireHOL: helpers

Helpers are functions that do some job for you, like a shortcut.

Implemented the transparent_squid helper.
----------------------------
revision 1.65
date: 2003/01/06 01:16:41;  author: ktsaou;  state: Exp;  lines: +19 -3
I have added a not-to-be-documented command line argument:

gimme-the-services-defs

An application can choose to run FireHOL with this argument to have all
the service definitions FireHOL knows in the environment variables.
----------------------------
revision 1.64
date: 2003/01/06 00:41:10;  author: ktsaou;  state: Exp;  lines: +736 -671
Changed the method with which the current command line was saved for the
error handler. The new way saved a fork() and gave some speed improvements.

Re-arranged the code so that the global variables and the services
definitions will be at the top of the file firehol.sh

Developed a work-around for a bug in iptables-save where:

! --uid-owner A

was saved as

--uid-owner !A

which was giving errors during restoration.
Unfortunatelly this made firehol saving the running firewall without the
use of /etc/init.d/iptables save.
The "save" argument to firehol saves the firewall to:

/etc/sysconfig/iptables
----------------------------
revision 1.63
date: 2003/01/05 20:03:07;  author: ktsaou;  state: Exp;  lines: +29 -3
Added service ping
----------------------------
revision 1.62
date: 2003/01/03 23:34:37;  author: ktsaou;  state: Exp;  lines: +16 -4
Added protocols as services: ICMP, AH, GRE, ESP
----------------------------
revision 1.61
date: 2003/01/01 04:32:48;  author: ktsaou;  state: Exp;  lines: +6 -3
Added service: microsoft_ds
----------------------------
revision 1.60
date: 2003/01/01 03:12:17;  author: ktsaou;  state: Exp;  lines: +51 -38
FireHOL has been changed to be "smart" when REJECTing packets.
If the packet to be rejected is a TCP packet, it will send back a tcp-reset
message, while for any other protocol it will send icmp-port-unreachable.

This is now the default behavior, without specifing a 'with' parameter.

Also, the multicast service has been changed to additionally match
protocol No 2.
----------------------------
revision 1.59
date: 2002/12/31 09:10:15;  author: ktsaou;  state: Exp;  lines: +20 -12
Extended REJECT control ('with' parameter) to work on 'policy' and on the
default firewall policies.
----------------------------
revision 1.58
date: 2002/12/31 08:55:42;  author: ktsaou;  state: Exp;  lines: +19 -4
Added optional rule parameter "with" which is only valid just after the
action "REJECT" on all rules. "with" allows finer control over the method
of packet rejection.
----------------------------
revision 1.57
date: 2002/12/23 14:39:19;  author: ktsaou;  state: Exp;  lines: +609 -501
Code cleanup and code comments
----------------------------
revision 1.56
date: 2002/12/23 13:49:09;  author: ktsaou;  state: Exp;  lines: +27 -4
Error handles now shows the command line that generated the error
as-is in the configuration file.
----------------------------
revision 1.55
date: 2002/12/22 14:02:54;  author: ktsaou;  state: Exp;  lines: +6 -3
Added service APCUPSDNIS.
----------------------------
revision 1.54
date: 2002/12/20 20:31:11;  author: ktsaou;  state: Exp;  lines: +10 -6
Added variable FIREHOL_AMANDA_PORTS to control which ports amanda has been
compiled with.

Added service CUPS.
----------------------------
revision 1.53
date: 2002/12/19 22:52:15;  author: ktsaou;  state: Exp;  lines: +43 -3
Added service AMANDA.
----------------------------
revision 1.52
date: 2002/12/18 23:36:07;  author: ktsaou;  state: Exp;  lines: +98 -42
Fixed a bug in command line parsing when there was a configuration file
specified in the command line together with a command.
Now, when a filename is specified only three commands are valid:
debug, try, start

Fixed error handling to detect errors in a few functions that were
ignored.

Updated documentation to reflect the above changes.

Updated interactive mode help and added directive 'in' as a shortcut to
interface eth0 internet
----------------------------
revision 1.51
date: 2002/12/18 22:05:37;  author: ktsaou;  state: Exp;  lines: +20 -5
Enhanced the error handler to detect errors separately for each protection.
----------------------------
revision 1.50
date: 2002/12/18 20:44:08;  author: ktsaou;  state: Exp;  lines: +78 -71
Fixed a potential security hole where UDP traffic could come in
uncoditionally from source port 53 when there was a:

client dns accept

This means that DNS is back to statefull mode.

Also, removed from ICMP the RELATED state, since it will be matched
at the end of the end of the interface or firewall.
----------------------------
revision 1.49
date: 2002/12/18 20:18:53;  author: ktsaou;  state: Exp;  lines: +13 -5
Fixed active FTP bug. It was not working.
----------------------------
revision 1.48
date: 2002/12/18 00:35:42;  author: ktsaou;  state: Exp;  lines: +7 -3
Added help entry for explain.
----------------------------
revision 1.47
date: 2002/12/18 00:30:28;  author: ktsaou;  state: Exp;  lines: +67 -13
More changes regarding explain.
Added interactive commands 'help', 'show' and 'quit'.
Now the interactive mode automatically generates a configuration file
from all the successfull commands.
Made interactive mode accept variable definitions and loops.
----------------------------
revision 1.46
date: 2002/12/17 20:47:34;  author: ktsaou;  state: Exp;  lines: +100 -24
Added command line argument "explain" to run in interactive debugging
mode.

This resulted in discovering bugs in NFS (fixed) and masquerade (fixed).

Also, enriched the error handler to be more descriptive about what
FireHOL is doing.
----------------------------
revision 1.45
date: 2002/12/16 20:41:39;  author: ktsaou;  state: Exp;  lines: +56 -86
Added service DHCP Relay.

Made kernel modules loaded during run time.

Saving of old firewall takes now place before processing the configuration
file, in order to make sure it will not be altered by accident due to
some illegal commands in the configuration file.

FireHOL enables kernel routing automatically when there is at least a
router defined in the configuration.

Now the configuration accepts command line arguments given to FireHOL.
To send a set of arguments to the script, either just append them to
FireHOL command line or (in case it is not clear if the argument is going
to be used by FireHOL or the configuration) precede the configuration
arguments by -- (two dashes).
----------------------------
revision 1.44
date: 2002/12/16 18:57:30;  author: ktsaou;  state: Exp;  lines: +12 -12
Restored gawk stuff to previous methodology, using <<"EOF" since escaping
produced warnings in debian systems.
----------------------------
revision 1.43
date: 2002/12/13 21:52:19;  author: ktsaou;  state: Exp;  lines: +13 -17
Further optimizations in the error handler.
----------------------------
revision 1.42
date: 2002/12/13 19:56:11;  author: ktsaou;  state: Exp;  lines: +93 -113
Made tons of optimizations for better FireHOL speed.
----------------------------
revision 1.41
date: 2002/12/12 20:07:47;  author: ktsaou;  state: Exp;  lines: +22 -4
Added services: APTPROXY, APCUPSD, ISAKMP
Removed Service: TFTP
----------------------------
revision 1.40
date: 2002/12/11 20:51:38;  author: ktsaou;  state: Exp;  lines: +4 -4
Changed service submission to be presented by number instead of name
because debian does not have this service in /etc/services.
----------------------------
revision 1.39
date: 2002/12/10 23:31:32;  author: ktsaou;  state: Exp;  lines: +3 -3
Made default protections burst 50.
----------------------------
revision 1.38
date: 2002/12/10 23:08:07;  author: ktsaou;  state: Exp;  lines: +5 -3
Added FIREHOL_LOG_FREQUENCY and FIREHOL_LOG_BURST to allow control on
the frequency of the loglimit rule parameter.
----------------------------
revision 1.37
date: 2002/12/10 18:10:38;  author: ktsaou;  state: Exp;  lines: +4 -4
Fixed a bug in netbios_ns
----------------------------
revision 1.36
date: 2002/12/09 21:13:35;  author: ktsaou;  state: Exp;  lines: +9 -9
Fixed a typo in protections, that made them unusable in the previous
version.
----------------------------
revision 1.35
date: 2002/12/08 22:05:40;  author: ktsaou;  state: Exp;  lines: +8 -2
The command line argument stop was not working. Fixed.
----------------------------
revision 1.34
date: 2002/12/07 18:12:43;  author: ktsaou;  state: Exp;  lines: +26 -13
Now protections can be applied on both directions of a router.

When running firehol with a configuration file as the first argument, now
you can specify an action (start, debug, try, etc) as the second argument.
----------------------------
revision 1.33
date: 2002/12/07 00:47:30;  author: ktsaou;  state: Exp;  lines: +27 -174
Re-organized parameters parsing to prevent processing a possible file
in the current directory with filename the name of the FireHOL command.

Now FireHOL locks the subsys firehol, in addition to iptables.
----------------------------
revision 1.32
date: 2002/12/05 09:23:36;  author: ktsaou;  state: Exp;  lines: +31 -2
Added many new services.
----------------------------
revision 1.31
date: 2002/12/05 09:03:37;  author: ktsaou;  state: Exp;  lines: +13 -3
The problem with line numbers on debian systems found to be an awk
alternative those systems use. Now FireHOL uses gawk instead of awk.

Added service SUBMISSION (SMTP or SSL/TLS).
----------------------------
revision 1.30
date: 2002/12/04 23:12:10;  author: ktsaou;  state: Exp;  lines: +35 -2
Fixed a problem where empty parameters to src, dst, etc where not giving
an error and where not producing any iptables statements.
This was happening because FireHOL relies on nested BASH loops, and bash
does not loop with empty iterations...
----------------------------
revision 1.29
date: 2002/12/04 22:41:13;  author: ktsaou;  state: Exp;  lines: +155 -114
Re-wrote the negative expressions handling to archieve near hand-made
(i.e. optimum) quality of iptables firewall.
Now, instead of the linked-list that was created for negative expressions,
we match all positive expressions before the negatives and all the
negatives are together in one chain.
This also fixed possible performance problems due to the large number
of chains and rules that the packets had to traverse in order to get
matched (or not matched).

The fact that now positive rules are matched before negatives has also the
benefit that not all traffic has to be matched against the negatives. Now,
first we select what might be good for a rule, and then we check if this
breaks the negative expressions.

Last, this made the iptables firewall much more clear and human readable.
----------------------------
revision 1.28
date: 2002/12/04 21:32:26;  author: ktsaou;  state: Exp;  lines: +17 -14
Fixed a bug that FireHOL was incorrectly choosing LOCAL_CLIENT_PORTS on
router configurations. This bug appeared when the router configurations
were made to accept normal server/client statements.
----------------------------
revision 1.27
date: 2002/12/04 07:20:19;  author: ktsaou;  state: Exp;  lines: +13 -2
Error handler now works on protections too.
----------------------------
revision 1.26
date: 2002/12/03 22:49:16;  author: ktsaou;  state: Exp;  lines: +75 -20
Changed the banner to be much more descriptive. It now also shows the
services FireHOL supports (removed the services parameter).
----------------------------
revision 1.25
date: 2002/12/03 22:07:09;  author: ktsaou;  state: Exp;  lines: +12 -3
Fixed the usage banner to show the "services" parameter.
----------------------------
revision 1.24
date: 2002/12/03 22:03:00;  author: ktsaou;  state: Exp;  lines: +87 -7
Another work around to fix the problem of LINENO not working in debian
systems.

Added command line argument "services" which shows all the service
definitions firehol knows about.
----------------------------
revision 1.23
date: 2002/12/02 17:48:41;  author: ktsaou;  state: Exp;  lines: +13 -8
Fixed a bug where some versions of BASH do not handle correctly cat >>"EOF".
They treat it as cat >>EOF and thus they do variable substitution on the
text.
Now, FireHOL uses cat >>EOF but the text has been escaped in order to avoid
variable substitution.

The problem has been reported by Florian Thiel <thiel@ksan.de>.
----------------------------
revision 1.22
date: 2002/12/02 00:01:24;  author: ktsaou;  state: Exp;  lines: +14 -7
Fixed parameter 'custom' processing. It is not an array now, but it is
treated specially to support BASH special characters such as !
Quoting things in parameters 'custom' needs tweaking still.
----------------------------
revision 1.21
date: 2002/12/01 04:34:00;  author: ktsaou;  state: Exp;  lines: +48 -61
More quoting issues fixed. Changed the core to work with BASH arrays in
order to handle quoted arguments accurately.

Fixed a bug in postprocessing error handler that did not present the
command line that produced the error.
----------------------------
revision 1.20
date: 2002/11/30 22:53:55;  author: ktsaou;  state: Exp;  lines: +235 -186
Fixed various problems related to quoted arguments.
Fixed iptables generation to support quoted arguments.
Made chain names shorter.

Every single element in the firehol config now gets its own chain.
Previously, the same services (e.g. smtp servers) were implemented using
only one pair of chains.

Enhanced the error handler of logical and syntactical error. Now it says
were and why an error has occured.
----------------------------
revision 1.19
date: 2002/11/30 14:33:33;  author: ktsaou;  state: Exp;  lines: +77 -57
As suggested by Florian Thiel <thiel@ksan.de>:
a. Fixed service IRC to work on TCP instead of UDP.
b. Added services: UUCP, VNC, WEBCACHE, IMAPS, IKE.

Also fixed the home-router.conf example (it was outdated).
----------------------------
revision 1.18
date: 2002/11/03 13:17:39;  author: ktsaou;  state: Exp;  lines: +30 -10
Minor aesthetic changes.
----------------------------
revision 1.17
date: 2002/11/01 19:37:20;  author: ktsaou;  state: Exp;  lines: +82 -1
Added service: any
Any allows the administrator to define any stateful rule to match services
that cannot have source and destination ports, such as unusual protocols,
etc.

Syntax: type any name action [optional rule parameters]

type: server/client/route
name: the name for the service (used for the chain)
action: accept, reject, etc.


Added service: multicast
Multicast allows the administrator to match packets with destination
224.0.0.0/8 in both directions (input/output).
----------------------------
revision 1.16
date: 2002/10/31 15:31:52;  author: ktsaou;  state: Exp;  lines: +61 -13
Added command line parameter 'try' (in addition to 'start', 'stop', etc)
that when used it activates the firewall and waits 30 seconds for the
administrator to type 'commit' in order to keep the firewall active.
If the administrator does not write 'commit' or the timeout passes, FireHOL
restores the previous firewall.

Also, if you break (Ctrl-C) FireHOL while activating the new firewall,
FireHOL will restore the old firewall.
----------------------------
revision 1.15
date: 2002/10/30 23:25:07;  author: ktsaou;  state: Exp;  lines: +80 -61
Rearranged default RELATED rules to match after normal processing and
protections.
Made the core of FireHOL operate on multiple tables (not assuming the
rules refer to the 'filter' table). This will allow FireHOL to support
all kinds of NAT chains in the future.
----------------------------
revision 1.14
date: 2002/10/29 22:20:41;  author: ktsaou;  state: Exp;  lines: +79 -27
Client and server keywords now work on routers too.
(The old 'route' subcommand is an alias for the 'server' subcommand -
within a router).
Protection can be reversed on routers to match outface instead of inface.
Masquerade can be used in interfaces, routers (matches outface - but can
be reverse(ed) to match inface) or as a primary command with all the
interfaces to be masqueraded in an argument.
----------------------------
revision 1.13
date: 2002/10/28 19:47:02;  author: ktsaou;  state: Exp;  lines: +31 -27
Protection has been extented to work on routers too.
Made a few minor aesthetic changes on the generated code. Now in/out chains
on routers match the inface/outface correctly.
----------------------------
revision 1.12
date: 2002/10/28 18:45:54;  author: ktsaou;  state: Exp;  lines: +35 -14
Added support for ICMP floods protection and from BAD TCP flags protection.
This was suggested by: Fco.Felix Belmonte (ffelix@gescosoft.com).
----------------------------
revision 1.11
date: 2002/10/27 12:47:48;  author: ktsaou;  state: Exp;  lines: +5 -0
Added CVS versioning to all files.
----------------------------
revision 1.10
date: 2002/10/27 02:49:34;  author: ktsaou;  state: Exp;  lines: +66 -5
Added service IRC.
Extended kernel modules handling to simple services too.
Simple services can now have:

require_myservice_modules="module"
require_myservice_nat_modules="module"

in order to have these modules installed if and when "myservice" is
used.

Added the "masquerade" interfaces subcommand, that gives a shortcut to
masquerade on the output of an interface.

FireHOL, now have a separate rule to match all RELATED sockets on all
chains. This is always added at the top of the firewall.

FireHOL, now DROPs all INVALID packets, as suggested by the iptables
HOW-TO.

Various other minor enhancements.
----------------------------
revision 1.9
date: 2002/10/26 15:14:52;  author: ktsaou;  state: Exp;  lines: +40 -26
Added logging options support as suggested by:
Fco.Felix Belmonte <ffelix@gescosoft.com>
----------------------------
revision 1.8
date: 2002/10/24 21:10:01;  author: ktsaou;  state: Exp;  lines: +86 -9
Removed service TFTP since this requires a kernel module for stateful
operation.

After suggestions by Fco.Felix Belmonte (ffelix@gescosoft.com),
I have added:

a) RESERVED_IPS, PRIVATE_IPS, MULTICAST_IPS and UNROUTABLE_IPS
You can use the above in SRC (not) parameters to match them.
The use of UNROUTABLE_IPS is suggested for cases where an interface is
exclusivelly public.

b) kernel module requirements per complex service and for the
configuration file as a whole.
Now you can use:

# one line for each module, somewhere in your config file
require_kernel_module <kernel_module>

to have FireHOL require some kernel module to succesfully complete
the firewall configuration.

As an option for those running NAT, you can use:

FIREHOL_NAT=1 # put this at the top of your config file

to make the complex services require also the NAT modules for the
services they implement.

Finally, I have added a get-iana.sh script that produces one BASH
statement for RESERVED_IPS.
----------------------------
revision 1.7
date: 2002/10/20 19:09:18;  author: ktsaou;  state: Exp;  lines: +1 -1
Changed TFTP from TCP to UDP.
----------------------------
revision 1.6
date: 2002/10/11 21:09:11;  author: ktsaou;  state: Exp;  lines: +18 -0
Added services RNDC, FINGER, ECHO, DAYTIME, NNTP
----------------------------
revision 1.5
date: 2002/10/04 17:35:49;  author: ktsaou;  state: Exp;  lines: +137 -7
Fixed negative expressions in FireHOL statements.
By default, when multiple instances of interfaces/ports/addresses exist
FireHOL produces one rule for each instance. However when negative
expressions were defined the previous approach was producing ORed iptables
statements instead of ANDed statements.
The new code, now produces linked lists of iptables chains for all negative
expressions so that only if ALL the negative are matched, one rule for each
positive expression will be produced.

Example: interface eth0 myname src "1.1.1.1 2.2.2.2"

This will correctly produce two indepedent rules, one for each IP address.
But:

interface eth0 myname src NOT "1.1.1.1 2.2.2.2"

was incorrectly producing two indepedent rules. Now the later statement
produces a linked list that first matches that the source of the packets
is not 1.1.1.1, in which case it forwards the packets to the second chain
in the lists that confirms that the packets are not comming from 2.2.2.2,
which finally sends the packets to their destination to be checked if they
are comming from eth0.

Note: I don't know the overhead of this linked list thing. I hope iptables
is fast enough...
----------------------------
revision 1.4
date: 2002/10/03 23:53:09;  author: ktsaou;  state: Exp;  lines: +68 -58
Added control for unmatched packets using:
UNMATCHED_INPUT_POLICY=
UNMATCHED_OUTPUT_POLICY=
UNMATCHED_ROUTER_POLICY=
and removed DEFAULT_ROUTER_POLICY since iptables accepts only DROP and ACCEPT.

To control what will happen to unmatched packets just set the above variables
in /etc/firehol.conf

Note that in any case (e.g. UMATCHED_ROUTER_POLICY=ACCEPT) the packets will
still be logged to syslog.

Made also various aesthetic changes in the code.

Rules programmers can now include their service names in the
ALL_SHOULD_ALSO_RUN variable and the "all" service will run them
automatically.
----------------------------
revision 1.3
date: 2002/10/03 16:28:16;  author: ktsaou;  state: Exp;  lines: +60 -7
Service ntp is now both TCP and UDP and accepts clients from default ports.
DNS over TCP is stateful but over UDP is now not stateful. This will not bother your syslog if your DNS server fails to reply within the stateful UDP timeout of iptables.
Added service rsync.
Added service vmwareauth.
Added service vmwareweb.
Added DEFAULT_ROUTER_POLICY to control how firehol handles its routing.
Fixed a bug where firehol script arguments were not passed to /etc/init.d/iptables.
Increased version number to 5.
----------------------------
revision 1.2
date: 2002/09/08 12:05:10;  author: ktsaou;  state: Exp;  lines: +28 -18
Release 4.
Made it work on non RedHat systems.
client/server/route now accept many services on the same line.
Other minor fixes and enhancements.
Verified NFS operation.
----------------------------
revision 1.1
date: 2002/09/05 20:57:59;  author: ktsaou;  state: Exp;
branches:  1.1.1;
Initial revision
----------------------------
revision 1.1.1.1
date: 2002/09/05 20:57:59;  author: ktsaou;  state: Exp;  lines: +0 -0
First Public Release
=============================================================================