1: # The LearningOnline Network with CAPA
2: # Firewall configuration to allow internal LON-CAPA communication between servers
3: #
4: # $Id: Firewall.pm,v 1.2 2009/06/11 13:01:56 raeburn Exp $
5: #
6: # The LearningOnline Network with CAPA
7: #
8: # Copyright Michigan State University Board of Trustees
9: #
10: # This file is part of the LearningOnline Network with CAPA (LON-CAPA).
11: #
12: # LON-CAPA is free software; you can redistribute it and/or modify
13: # it under the terms of the GNU General Public License as published by
14: # the Free Software Foundation; either version 2 of the License, or
15: # (at your option) any later version.
16: #
17: # LON-CAPA is distributed in the hope that it will be useful,
18: # but WITHOUT ANY WARRANTY; without even the implied warranty of
19: # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20: # GNU General Public License for more details.
21: #
22: # You should have received a copy of the GNU General Public License
23: # along with LON-CAPA; if not, write to the Free Software
24: # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
25: #
26: # /home/httpd/html/adm/gpl.txt
27: #
28: # http://www.lon-capa.org/
29: #
30: # Startup script for the LON-CAPA network processes
31: #
32:
33: package LONCAPA::Firewall;
34:
35: use strict;
36: use lib '/home/httpd/perl/lib';
37: use LONCAPA::Configuration;
38:
39: # Firewall code is based on the code in FC2 /etc/init.d/ntpd
40:
41: sub firewall_open_port {
42: my ($iptables,$fw_chain,$lond_port,$iphost,$ports) = @_;
43: return 'inactive firewall' if (!&firewall_is_active());
44: return 'port number unknown' if !$lond_port;
45: my @opened;
46: if (! `$iptables -L -n 2>/dev/null | grep $fw_chain | wc -l`) {
47: return 'Expected chain "'.$fw_chain.'" missing from iptables'."\n";
48: }
49: #
50: # iptables is running with expected chain
51: #
52: if ($fw_chain =~ /^([\w\-]+)$/) {
53: $fw_chain = $1;
54: } else {
55: return 'Chain name has unexpected format'."\n";
56: }
57: if (ref($ports) ne 'ARRAY') {
58: return 'List of ports to open needed.';
59: }
60: foreach my $portnum (@{$ports}) {
61: my $port = '';
62: if ($portnum =~ /^(\d+)$/) {
63: $port = $1;
64: } else {
65: print "Skipped non-numeric port: $portnum\n";
66: next;
67: }
68: print "Opening firewall access on port $port.\n";
69: my $result;
70: if ($port eq $lond_port) {
71: # For lond port, restrict the servers allowed to attempt to communicate
72: # to include only source IPs in the LON-CAPA cluster.
73: my (@port_error,@command_error,@lond_port_open);
74: if (ref($iphost) eq 'HASH') {
75: if (keys(%{$iphost}) > 0) {
76: &firewall_close_anywhere($iptables,$fw_chain,$port);
77: foreach my $key (keys(%{$iphost})) {
78: my $ip = '';
79: if ($key =~ /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/) {
80: if (($1<=255) && ($2<=255) && ($3<=255) && ($4<=255)) {
81: $ip = "$1.$2.$3.$4";
82: } else {
83: next;
84: }
85: } else {
86: next;
87: }
88: my $firewall_command =
89: "$iptables -I $fw_chain -p tcp -s $ip -d 0/0 --dport $port -j ACCEPT";
90: system($firewall_command);
91: my $return_status = $?>>8;
92: if ($return_status == 1) {
93: push (@port_error,$ip);
94: } elsif ($return_status == 2) {
95: push(@command_error,$ip);
96: } elsif ($return_status == 0) {
97: push(@lond_port_open,$ip);
98: }
99: }
100: }
101: }
102: if (@lond_port_open) {
103: push(@opened,$port);
104: print "Port $port opened for ".scalar(@lond_port_open)." IP addresses\n";
105: }
106: if (@port_error) {
107: print "Error opening port $port for following IP addresses: ".join(', ',@port_error)."\n";
108: }
109: if (@command_error) {
110: print "Bad command error opening port for following IP addresses: ".
111: join(', ',@command_error)."\n".
112: 'Command was: "'."$iptables -I $fw_chain -p tcp -s ".'$ip'." -d 0/0 --dport $port -j ACCEPT".'", where $ip is IP address'."\n";
113: }
114: } else {
115: my $firewall_command =
116: "$iptables -I $fw_chain -p tcp -d 0/0 --dport $port -j ACCEPT";
117: system($firewall_command);
118: my $return_status = $?>>8;
119: if ($return_status == 1) {
120: # Error
121: print "Error opening port.\n";
122: } elsif ($return_status == 2) {
123: # Bad command
124: print "Bad command error opening port. Command was\n".
125: " ".$firewall_command."\n";
126: } elsif ($return_status == 0) {
127: push(@opened,$port);
128: }
129: }
130: }
131: foreach my $port (@{$ports}) {
132: if (!grep(/^\Q$port\E$/,@opened)) {
133: return 'Required port not open: '.$port."\n";
134: }
135: }
136: return 'ok';
137: }
138:
139: sub firewall_is_port_open {
140: my ($iptables,$fw_chain,$port,$lond_port,$iphost) = @_;
141: # for lond port returns number of source IPs for which firewall port is open
142: # for other ports returns 1 if the firewall port is open, 0 if not.
143: #
144: # check if firewall is active or installed
145: return if (! &firewall_is_active());
146: if ($port eq $lond_port) {
147: my $count ++;
148: if (ref($iphost) eq 'HASH') {
149: if (keys(%{$iphost}) > 0) {
150: foreach my $ip (keys(%{$iphost})) {
151: open(PIPE,"$iptables -L $fw_chain -n 2>/dev/null");
152: while(<PIPE>) {
153: $count++ if (/^ACCEPT\s+tcp\s+\-{2}\s+\Q$ip\E\s+/);
154: }
155: close(PIPE);
156: }
157: }
158: }
159: return $count;
160: } else {
161: if (`$iptables -L -n 2>/dev/null | grep "tcp dpt:$port"`) {
162: return 1;
163: } else {
164: return 0;
165: }
166: }
167: }
168:
169: sub firewall_is_active {
170: if (-e '/proc/net/ip_tables_names') {
171: return 1;
172: } else {
173: return 0;
174: }
175: }
176:
177: sub firewall_close_port {
178: my ($iptables,$fw_chain,$lond_port,$ports) = @_;
179: return 'inactive firewall' if (!&firewall_is_active());
180: return 'port number unknown' if !$lond_port;
181: if (! `$iptables -L -n 2>/dev/null | grep $fw_chain | wc -l`) {
182: return 'Expected chain "'.$fw_chain.'" missing from iptables'."\n";
183: }
184: if (ref($ports) ne 'ARRAY') {
185: return 'List of ports to close needed.';
186: }
187: if ($fw_chain =~ /^([\w\-]+)$/) {
188: $fw_chain = $1;
189: } else {
190: return 'Chain name has unexpected format'."\n";
191: }
192: foreach my $portnum (@{$ports}) {
193: my $port = '';
194: if ($portnum =~ /^(\d+)$/) {
195: $port = $1;
196: } else {
197: print "Skipped non-numeric port: $portnum\n";
198: next;
199: }
200: print "Closing firewall access on port $port\n";
201: if (($port ne '') && ($port eq $lond_port)) {
202: my (@port_error,@command_error,@lond_port_close);
203: my %to_close;
204: open(PIPE, "$iptables -n -L $fw_chain |");
205: while (<PIPE>) {
206: chomp();
207: next unless (/dpt:\Q$port\E\s*$/);
208: if (/^ACCEPT\s+tcp\s+\-{2}\s+(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\s+/) {
209: $to_close{$1} = $port;
210: }
211: }
212: close(PIPE);
213: if (keys(%to_close) > 0) {
214: foreach my $ip (keys(%to_close)) {
215: my $firewall_command =
216: "$iptables -D $fw_chain -p tcp -s $ip -d 0/0 --dport $port -j ACCEPT";
217: system($firewall_command);
218: my $return_status = $?>>8;
219: if ($return_status == 1) {
220: push (@port_error,$ip);
221: } elsif ($return_status == 2) {
222: push(@command_error,$ip);
223: } elsif ($return_status == 0) {
224: push(@lond_port_close,$ip);
225: }
226: }
227: }
228: if (@lond_port_close) {
229: print "Port $port closed for ".scalar(@lond_port_close)." IP addresses\n";
230: }
231: if (@port_error) {
232: print "Error closing port $port for following IP addresses: ".join(', ',@port_error)."\n";
233: }
234: if (@command_error) {
235: print "Bad command error opening port for following IP addresses: ".
236: join(', ',@command_error)."\n".
237: 'Command was: "'."$iptables -D $fw_chain -p tcp -s ".'$ip'." -d 0/0 --dport $port -j ACCEPT".'", where $ip is IP address'."\n";
238: }
239: } else {
240: my $firewall_command =
241: "$iptables -D $fw_chain -p tcp -d 0/0 --dport $port -j ACCEPT";
242: system($firewall_command);
243: my $return_status = $?>>8;
244: if ($return_status == 1) {
245: # Error
246: print "Error closing port.\n";
247: } elsif ($return_status == 2) {
248: # Bad command
249: print "Bad command error closing port. Command was\n".
250: " ".$firewall_command."\n";
251: } else {
252: print "Port closed.\n";
253: }
254: }
255: }
256: return;
257: }
258:
259: sub firewall_close_anywhere {
260: my ($iptables,$fw_chain,$port) = @_;
261: open(PIPE, "$iptables --line-numbers -n -L $fw_chain |");
262: while (<PIPE>) {
263: next unless (/dpt:\Q$port\E/);
264: chomp();
265: if (/^(\d+)\s+ACCEPT\s+tcp\s+\-{2}\s+0\.0\.0\.0\/0\s+0\.0\.0\.0\/0/) {
266: my $firewall_command = "$iptables -D $fw_chain $1";
267: system($firewall_command);
268: my $return_status = $?>>8;
269: if ($return_status == 1) {
270: print 'Error closing port '.$port.' for source "anywhere"'."\n";
271: } elsif ($return_status == 2) {
272: print 'Bad command error closing port '.$port.' for source "anywhere". Command was'."\n".
273: ' '.$firewall_command."\n";
274: } else {
275: print 'Port '.$port.' closed for source "anywhere"'."\n";
276: }
277: }
278: }
279: close(PIPE);
280: }
281:
282: sub get_lond_port {
283: my $perlvarref=&LONCAPA::Configuration::read_conf();
284: my $lond_port;
285: if (ref($perlvarref) eq 'HASH') {
286: if (defined($perlvarref->{'londPort'})) {
287: $lond_port = $perlvarref->{'londPort'};
288: }
289: }
290: if (!$lond_port) {
291: print("Unable to determine lond port number from LON-CAPA configuration.\n");
292: }
293: return $lond_port;
294: }
295:
296: sub get_fw_chain {
297: my $fw_chain = 'RH-Firewall-1-INPUT';
298: my $suse_config = "/etc/sysconfig/SuSEfirewall2";
299: if (-e $suse_config) {
300: $fw_chain = 'input_ext';
301: } else {
302: if (!-e '/etc/sysconfig/iptables') {
303: print("Unable to find iptables file containing static definitions\n");
304: }
305: }
306: return $fw_chain;
307: }
308:
309: sub get_pathto_iptables {
310: my $iptables;
311: if (-e '/sbin/iptables') {
312: $iptables = '/sbin/iptables';
313: } elsif (-e '/usr/sbin/iptables') {
314: $iptables = '/usr/sbin/iptables';
315: } else {
316: print("Unable to find iptables command\n");
317: }
318: return $iptables;
319: }
320:
321: 1;
322: __END__
323:
324: =pod
325:
326: =head1 NAME
327:
328: B<LONCAPA::Firewall> - dynamic opening/closing of firewall ports
329:
330: =head1 SYNOPSIS
331:
332: use lib '/home/httpd/lib/perl/';
333: use LONCAPA::Firewall;
334:
335: LONCAPA::Firewall::firewall_open_port();
336: LONCAPA::Firewall::firewall_close_port();
337: LONCAPA::Firewall::firewall_is_port_open();
338: LONCAPA::Firewall::firewall_is_active();
339: LONCAPA::Firewall::firewall_close_anywhere();
340:
341: =head1 DESCRIPTION
342:
343: The scripts: /etc/init.d/loncontrol, used to stop or start LON-CAPA services,
344: as well as the setuid script /home/httpd/perl/lciptables, called by loncron
345: for housekeeping tasks, make use of the methods provided by this module to
346: open and close firewall ports (currently the default port: 5663), used
347: for socket-based communication between LON-CAPA servers in the cluster
348: of networked servers to which the server belongs.
349:
350: The following methods are available:
351:
352: =over 4
353:
354: =item LONCAPA::Firewall::firewall_open_port( $iptables,$fw_chain,$lond_port,$iphost,$port );
355:
356: =back
357:
358: =over 4
359:
360: =item LONCAPA::Firewall::firewall_close_port( $iptables,$fw_chain,$lond_port,$ports );
361:
362: =back
363:
364: =over 4
365:
366: =item LONCAPA::Firewall::firewall_is_port_open( $iptables,$fw_chain,$port,$lond_port,$iphost );
367:
368: =back
369:
370: =over 4
371:
372: =item LONCAPA::Firewall::firewall_is_active();
373:
374: =back
375:
376: =over 4
377:
378: =item LONCAPA::Firewall::firewall_close_anywhere( $iptables,$fw_chain,$port );
379:
380: =back
381:
382: =over 4
383:
384: =item LONCAPA::Firewall::get_lond_port();
385:
386: =back
387:
388: =over 4
389:
390: =item LONCAPA::Firewall::get_fw_chain();
391:
392: =back
393:
394: =over 4
395:
396: =item LONCAPA::Firewall::get_pathto_iptables();
397:
398:
399: =head1 AUTHORS
400:
401: This library is free software; you can redistribute it and/or
402: modify it under the same terms as LON-CAPA itself.
403:
404: =cut
405:
FreeBSD-CVSweb <freebsd-cvsweb@FreeBSD.org>
![[BACK]](/icons/back.gif){kind=icon}
Return to Firewall.pm CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [LON-CAPA] / loncom / configuration