3 # Marta Carbone, Luigi Rizzo
4 # Copyright (C) 2009 Universita` di Pisa
7 # This script the vsys backend used to configure emulation.
9 # - reads the user's input from the vsys input pipe
10 # - validates the input
11 # - configures the firewall
12 # - writes results on the output vsys pipe
14 # Configurable variables are at the beginning
16 # If HOOK is set the program is called before configuring a rule.
17 # A sample hook can be found in the ipfw.rpm package
18 # HOOK=/tmp/sample_hook
21 # You should not touch anything below.
23 # We assume three type of connections
24 # SERVER we know the local port P, and do the
25 # bind/listen/accept on the local socket.
26 # pipe_in in dst-port P
27 # pipe_out out src-port P
29 # CLIENT we know the remote port P, and do a connect to it
30 # (src and dst are swapped wrt the previous case)
31 # pipe_in in src-port P
32 # pipe_out out dst-port P
34 # SERVICE we run a server on local port P, and also connect
35 # from local clients to remote servers on port P.
36 # pipe_in in { dst-port P or src-port P }
37 # pipe_out out { src-port P or dst-port P }
39 # On a given port a user can have one CLIENT and/or one SERVER
40 # configuration or one SERVICE configuration.
41 # When a SERVICE configuration is installed any existing CLIENT
42 # and SERVER configuration on the same port are removed.
43 # When a CLIENT or SERVER configuration is installed any existing
44 # SERVICE configuration on the same port is removed.
46 # The following is a case that is implemented as SERVER
47 # D we run a server on local port P, and also connect
48 # to remote servers but doing a bind(P) before connect().
49 # In terms of rules, this is not distinguishable from
50 # the SERVER case, however it would be different if we
51 # had a way to tell SERVER from CLIENT sockets
52 # pipe_in in dst-port P
53 # pipe_out out src-port P
55 # The database of current ipfw and dummynet configuration is in a
56 # file which is regenerated on errors. The format is
58 # slice_id type arg rule_base pipe_base timeout
60 # (lines starting with '#' are comments and are ignored)
61 # For each configuration we allocate one rule number in ipfw,
62 # and two sequential pipe numbers.
64 # globals, do not touch below
65 VERBOSE=0 # set to !0 to enable debug messages
66 TEST=0 # set to 1 for test mode
69 lockfile=/var/lock/ipfw.lock
71 # There values are the keys used in the database for rules and pipes
72 # rule_nr 1..10000 are mapped to rules 10000..49999 (n*4+9996)
73 # rule_nr 10001..20000 are mapped to rules 50000..59999 (n+39999)
74 # pipe_nr 1..25000 are mapped to pipes 10000-59999 (n*2+9998)
81 # These are the rule numbers used in ipfw
87 # set slicename and slice_id
88 # there represents the credential of the user
90 SLICE_ID=`id -u $SLICENAME`
91 [ $? != 0 ] && abort "Invalid slicename $SLICENAME"
94 # XXX check consistency for variables {}
97 [ -x ${SED} ] || { SED=`which sed` ; SEDOPT=-E ; }
99 IPFW_CHECK="/sbin/ipfw -n"
101 debug() { # $1 message to be displayed
102 [ x"${VERBOSE}" != x"0" ] && echo "ipfw-be: $1"
104 # if the first argument is -v, enable verbose mode
106 [ x"$1" = x"-v" -o x"$2" = x"-v" ] && VERBOSE=1
109 [ x"$1" = x"-q" -o x"$2" = x"-q" ] || return
111 IPFW="/bin/echo ipfw:"
112 IPFW_CHECK="/bin/echo ipfw -n:"
116 abort() { # $1 message to be displayed
118 echo "ipfw-be aborting: $1"
122 # remove dangerous characters from user input
123 # if present, the leading '-v/-t' will be removed
124 filter() { # $* variables to be filtered
125 [ x${1} = x"-v" -o x${1} = x"-q" ] && shift
126 [ x${1} = x"-v" -o x${1} = x"-q" ] && shift
127 # allowed chars are: numbers, uppercase and lowercase letters,
128 # spaces, and the following symbols: .,_-/
129 echo "$*" | ${SED} ${SEDOPT} 's/[^\t0-9a-zA-Z., _\/\{}-]*//g'
132 # remove all entries from the ipfw config, and create an empty db
136 # we would like to delete ranges of rules and pipes but this
137 # is not supported so for the time being we kill them all
139 ${IPFW} -q pipe flush
140 # ${IPFW} delete ${IPFW_RULE_MIN}-${IPFW_RULE_MAX}
141 # ${IPFW} pipe delete ${IPFW_PIPE_MIN}-${IPFW_PIPE_MAX}
144 # Add the ipfw rule/pipe and update the database.
145 # The pipe-in and pipe_out config are through global variables
146 # CONFIG_IN CONFIG_OUT because they may be long.
147 # Other arguments are on the command line
148 add_rule() { # new_rule slice_id type arg rule pipe_base timeout
149 local new_rule=$1 slice_id=$2 type=$3 arg=$4
150 local rule_base=$5 pipe_base=$6 timeout=$7
151 local pipe_in pipe_out rule_in rule_out check_timeout
153 # If we use a profile file, locate the user directory
154 # move in the slice root dir XXX todo
155 [ "$TEST" != "1" ] && cd /vservers/${SLICENAME}/root
156 #echo ${CONFIG_STRING} | ${SED} -e "s/ profile \(.[^ ]\)/ profile \/vservers\/${SLICENAME}\/\1/g"
158 # first, call ipfw -n to check syntax, if ok move on and do the action
159 pipe_in=$(($pipe_base + $pipe_base + 9998))
160 pipe_out=$(($pipe_in + 1))
161 local del # anything to delete ?
162 local rule_nr=$(($rule_base + 39999)) # XXX formula for individual rules
163 if [ x"$new_rule" != x"0" ] ; then
166 rule_in="dst-port $arg"
167 rule_out="src-port $arg"
171 rule_in="src-port $arg"
172 rule_out="dst-port $arg"
176 rule_in="{ src-port $arg or dst-port $arg }"
177 rule_out="{ src-port $arg or dst-port $arg }"
181 abort "invalid service type $type"
185 rule_in="pipe ${pipe_in} in uid $slice_id ${rule_in}"
186 rule_out="pipe ${pipe_out} out uid $slice_id ${rule_out}"
187 ${IPFW_CHECK} add ${rule_nr} $rule_in > /dev/null || \
188 abort "ipfw syntax error $rule_in"
189 ${IPFW_CHECK} add ${rule_nr} $rule_out > /dev/null || \
190 abort "ipfw syntax error $rule_out"
193 # check error reporting
194 ${IPFW_CHECK} pipe ${pipe_in} config ${CONFIG_PIPE_IN} > /dev/null || \
195 abort "ipfw syntax error pipe_in"
196 ${IPFW_CHECK} pipe ${pipe_out} config ${CONFIG_PIPE_OUT} > /dev/null || \
197 abort "ipfw syntax error pipe_out"
199 # all good, delete and add rules if necessary
200 [ "$del" = "service" ] && do_delete $slice_id service $arg
201 [ "$del" = "cli_ser" ] && do_delete $slice_id client $arg
202 [ "$del" = "cli_ser" ] && do_delete $slice_id server $arg
203 [ "$new_rule" != "0" ] && ${IPFW} add ${rule_nr} $rule_in > /dev/null
204 [ "$new_rule" != "0" ] && ${IPFW} add ${rule_nr} $rule_out > /dev/null
206 ${IPFW} pipe ${pipe_in} config ${CONFIG_PIPE_IN}
207 ${IPFW} pipe ${pipe_out} config ${CONFIG_PIPE_OUT}
209 # send output to the user
210 ${IPFW} show ${rule_nr}
211 ${IPFW} pipe ${pipe_in} show
212 ${IPFW} pipe ${pipe_out} show
214 [ "$TEST" = "1" ] && return
215 # add to the database, at least to adjust the timeout
216 ( grep -v -- "^${slice_id} ${type} ${arg}" $DBFILE; \
217 echo "${slice_id} ${type} ${arg} ${rule_base} ${pipe_base} ${timeout}" ) > ${DBFILE}.tmp
218 mv ${DBFILE}.tmp ${DBFILE}
221 # Delete a given configuration
222 do_delete() { # slice_id type arg
223 local pipe_in pipe_out pipe_base rule_base rule_nr
224 local slice_id=$1 type=$2 arg=$3
226 [ "${arg}" = "" ] && abort "Missing arg on 'delete'"
227 set `find_rule $slice_id $type $arg`
228 rule_base=$1; pipe_base=$2
229 [ "$rule_base" = "0" ] && return # no rules found
231 rule_nr=$(($rule_base + 39999)) # XXX only individual rules
232 pipe_in=$(($pipe_base + $pipe_base + 9998))
233 pipe_out=$(($pipe_in + 1))
235 $IPFW delete ${rule_nr}
236 $IPFW pipe delete ${pipe_in}
237 $IPFW pipe delete ${pipe_out}
238 echo "removed configuration $slice_id} ${type} ${arg}"
239 [ "$TEST" = "1" ] && return
240 # remove from the database
241 grep -v -- "^${slice_id} ${type} ${arg}" $DBFILE > ${DBFILE}.tmp
242 mv ${DBFILE}.tmp ${DBFILE}
245 # called with the database file as input
246 # compare the tuple <slice_id type arg> with
247 # the current firewall configuration. The database contains
248 # slice_id type arg rule_base pipe_base timeout
249 # On match returns <rule_base pipe_base timeout>
250 # On non match returns 0 0 0
251 find_rule() { # $1 slice_id $2 type $3 arg
253 ret=`grep -- "^$1 $2 $3 " $DBFILE`
255 [ x"$ret" = x ] && echo "0 0 0 " && return # nothing found
256 # ignore multiple matches. If the db is corrupt we are
263 # Find a hole in a list of numbers within a range (boundaries included)
264 # The input is passed as a sorted list of numbers on stdin.
265 # Return a "0" rule if there is no rule free
266 find_hole() { # min max
267 local min=$1 cand=$1 max=$2 line
269 [ $line -lt $min ] && continue
270 [ $line -ne $cand ] && break # found
271 [ $cand -ge $max ] && cand=0 && break # no space
277 # returns a free rule and pipe base for client|server|service
278 # Returns r=0 if there are no resources available
279 allocate_resources() {
281 # remove comments, extract field, sort
282 p=`grep -v '^#' $DBFILE | awk '{print $5}' | sort -n | \
283 find_hole $PIPE_MIN $PIPE_MAX`
284 r=`grep -v '^#' $DBFILE | awk '{print $4}' | sort -n | find_hole $1 $2`
285 [ $r = 0 -o $p = 0 ] && r=0 # no resources available
290 # A request is made by a set of arguments formatted as follow:
292 # config {server|client|service} arg [-t timeout] PIPE_IN <pipe_conf> PIPE_OUT <pipe_conf>
293 # show {rules|pipes} [args]
296 # XXX not implemented yet
297 # config {rule|pipe} num <parameters>
298 # alloc rules|pipes [-t timeout] # returns a block of NUM_RULES or NUM_PIPES
299 # release rules|pipes args # release the entire block
300 # refresh rules|pipes args [-t timeout]
302 # where uppercase values are keywords.
303 # The timeout value is expressed as:
304 # week, day, month or anything else accepted by the date command.
305 # The id of the slice issuing the request is in the $SLICE_ID variable,
306 # set at the beginning of this script.
309 local timeout TMP i rule_base pipe_base
310 local slicename=${SLICENAME}
312 local debug_args="$*";
313 local type=$1 ; shift
315 debug "Received command: <$cmd> arguments: <$debug_args>"
317 # set the timeout value
318 # clean args from the timeout keyword
319 timeout=`echo ${args} | ${SED} ${SEDOPT} 's/(.+)( -t [a-zA-Z0-9]+ )(.*)/\2/'`
320 if [ "${timeout}" != "${args}" ] ; then # match
321 timeout=`echo ${timeout} | ${SED} ${SEDOPT} 's/-t //'`
322 check_timeout ${timeout} # abort on error
323 args=`echo ${args} | ${SED} ${SEDOPT} 's/(.+)( -t [a-zA-Z0-9]+ )(.*)/\1 \3/'`
325 timeout=1day # default to 1 day
328 debug "Timeout $timeout"
329 # Handle special requests: show and delete
332 abort "XXX unimplemented " && return 0
335 [ "$type" = "server" ] && do_config $SLICE_ID $timeout $type $args && return 0
336 [ "$type" = "client" ] && do_config $SLICE_ID $timeout $type $args && return 0
337 [ "$type" = "service" ] && do_config $SLICE_ID $timeout $type $args && return 0
338 [ "$type" = "rule" ] && abort "XXX unimplemented " && return 0
339 [ "$type" = "pipe" ] && abort "XXX unimplemented " && return 0
340 abort "'config' should be followed by {server|client|service|rule|pipe}"
343 do_delete ${SLICE_ID} $type $args
346 abort "XXX unimplemented " && return 0
347 do_refresh ${SLICE_ID} $type $args $timeout
350 abort "XXX unimplemented " && return 0
351 do_release ${SLICE_ID} $type $args
354 # XXX should filter on uid
355 [ "$type" = "rules" ] && ${IPFW} show && return 0
356 [ "$type" = "pipes" ] && ${IPFW} pipe show && return 0
357 abort "'show' should be followed by {rules|pipes}"
360 # help XXX to be done
361 abort "'command' should be one of {show|config|delete|refresh|release}"
366 # validate the timeout
367 check_timeout() { # timeout
368 local tt=`date --date="${1}" +%s`
369 [ "$?" != "0" ] && abort "Date format $1 not valid"
372 do_release() { # slice_id type args timeout
376 do_refresh() { # slice_id ttype args
380 do_config() { # slice_id timeout type arg PIPE_IN pipe_conf PIPE_OUT pipe_conf
381 local slice_id=$1; shift
382 local timeout=$1; shift
384 local arg=$1; shift # XXX addr not yet implemented
386 [ "$1" != "PIPE_IN" ] && abort "Missing addr:port, or PIPE_IN requested"
389 # read pipe in configuration
391 while [ "$1" != "" -a "$1" != "PIPE_OUT" ] ; do
395 CONFIG_PIPE_IN="$i" # XXX local ?
396 [ "$CONFIG_PIPE_IN" = "" ] && abort "Missing pipe in configuration"
398 [ "$1" != "PIPE_OUT" ] && abort "Missing pipe in configuration, or missing PIPE_OUT"
401 # read pipe out configuration
403 while [ "$1" != "" ] ; do
407 CONFIG_PIPE_OUT="$i" # XXX local ?
408 [ "$CONFIG_PIPE_OUT" = "" ] && abort "Missing pipe out configuration"
410 debug "Configuration Required:"
411 debug "slice_id: $slice_id"
414 debug "timeout: $timeout"
415 debug "PIPE_IN: $CONFIG_PIPE_IN"
416 debug "PIPE_OUT: $CONFIG_PIPE_OUT"
417 debug "-----------------------"
419 # check if the link is already configured
420 debug "Search for ${slice_id} ${type} ${arg}"
422 set `find_rule ${slice_id} ${type} ${arg}`
427 if [ ${rule_base} = "0" ] ; then
428 debug "Rule not found, new installation"
430 set `allocate_resources $RULE_IN_MIN $RULE_IN_MAX`
431 rule_base=$1; pipe_base=$2
432 [ $rule_base = 0 ] && abort "no resources available"
433 debug "found free resources rule: $rule_base pipe: $pipe_base"
435 debug "Rule found, just changing the pipe configuration"
438 add_rule $new_pipe $slice_id $type $arg $rule_base $pipe_base $timeout
440 # if present, call a hook in order to collect statistical
441 # information on dummynet usage
442 if [ -n "${HOOK}" -a -x "${HOOK}" ]; then
444 ${HOOK} $slice_id $type $port $rule_base $pipe_base $timeout &
449 # acquire the lock XXX check lockfile
451 [ "$TEST" = 1 ] && return
452 lockfile -s 0 -r 0 $lockfile 2> /dev/null
453 if [ $? -ne 0 ] ; then
454 echo "lock acquisition failed"
465 # ALLOCATION OF PIPES AND RULES
466 # pipes are always allocated in pairs
467 # rules are either individual or in groups of size NUM_RULES (e.g. 4)
468 # and are allocated in two different parts of the rule namespace
469 # (e.g. blocks from 10000 to 49999 and individuals from 50000 to 59999)
470 # Internally allocator uses the base number for each item, e.g.
471 # rule 10000..49999 -> rule_base=1..10000
472 # rule 50000..59999 -> rule_base=10001..20000
473 # pipe 10000..59999 -> pipe_base=1..25000
474 # a bit of math lets us compute the correct numbers.
475 # For CLIENT, SERVER, SERVICE the database contains entries as
476 # XID TYPE arg rule_base pipe_base
477 # For blocks the entries are
478 # XID RULE - rule_base -
479 # XID PIPE - - pipe_base
480 # When a rule or pipe is referenced we first check that the owner owns it.
481 # more details below.
484 debug "--- $0 START for $SLICENAME ---"
486 # If the db does not exist, create it and we clean rules and pipes
487 [ ! -e ${DBFILE} ] && clean_db
489 # A request to the vsys backend is composed by a single line of input
490 read REQ # read one line, ignore the rest
491 set_verbose ${REQ} # use inital -v if present
492 set_test ${REQ} # use inital -t if present
493 REQ="`filter ${REQ}`" # remove -v and -t and invalid chars
494 debug "--- processing <${REQ}>"
495 acquire_lock # critical section
498 debug "--- $0 END ---"