Kernel module loading implemented

master
bbruns 2014-04-12 15:09:08 +00:00
parent f392fc4d7b
commit 426978b0fc
6 changed files with 87 additions and 6 deletions

View File

@ -1,4 +1,8 @@
2.00 Alpha 1
2.00 Alpha 2 - 04/11/2014
- Slightly better documentation
- Module loading for netfilter helpers
2.00 Alpha 1 - 04/10/2014
- Complete code rewrite and restructure to solve some long standing issues with v1
- Separate out functions into support files for easier grouping of what they do
- Make more compatible with multiple disto file layouts

View File

@ -31,6 +31,7 @@ FWBINDIR="${FWPREFIX}/bin"
source "${FWLIBDIR}/binaries.inc"
source "${FWLIBDIR}/iptables.inc"
source "${FWLIBDIR}/display.inc"
source "${FWLIBDIR}/kernel.inc"
source "${FWCONFIGDIR}/main.conf"
@ -46,10 +47,10 @@ source "${FWCONFIGDIR}/ipv6.conf"
[[ -e "{FWCONFIGDIR}/ipv6/local.conf" ]] && source "{FWCONFIGDIR}/ipv6/local.conf"
# We require at least bash v3 or later at this point given some of the more complex
# We require at least bash v2 or later at this point given some of the more complex
# operations we do to make the firewall script work.
if (( ${BASH_VERSINFO[0]} <= "2" )); then
echo "Error: We can only run with bash 3.0 or higher. Please upgrade your version"
echo "Error: We can only run with bash 2.0 or higher. Please upgrade your version"
echo "of bash to something more recent, preferably the latest which is, as of this"
echo "writing, 4.x"
exit 1
@ -178,7 +179,11 @@ if [ "${EnableIPv4}" == "yes" ]; then
Defaultv4InPolicy=${Defaultv4InPolicy=ACCEPT}
Defaultv4OutPolicy=${Defaultv4OutPolicy=ACCEPT}
Defaultv4FwdPolicy=${Defaultv4FwdPolicy=ACCEPT}
default_policy_set ipv4 ${Defaultv4InPolicy} ${Defaultv4OutPolicy} ${Defaultv4FwdPolicy}
default_policy_set ipv4 ${Defaultv4InPolicy} ${Defaultv4OutPolicy} ${Defaultv4FwdPolicy}
([[ ${Enablev4NetfilterModules} == "yes" ]] && [[ ${Enablev4ConnectionTracking} == "yes" ]]) \
&& load_kernel_modules "${Loadv4NetfilterModules}"
([[ ${Enablev4NetfilterModules} == "yes" ]] && [[ ${Enablev4ConnectionTracking} == "yes" ]] \
&& [[ ${Enablev4NAT} == "yes" ]]) && load_kernel_modules "${Loadv4NetfilterModulesNAT}"
[[ ${Enablev4MSSClamp} == "yes" ]] && enable_mss_clamp ipv4
([[ ${Enablev4ConnTrackInterfaces} != "none" ]] && [[ ${Enablev4ConnectionTracking} == "yes" ]]) \
&& enable_conntrack_int ipv4 "${Enablev4ConnTrackInterfaces}"
@ -208,6 +213,10 @@ if [ "${EnableIPv6}" == "yes" ]; then
Defaultv6OutPolicy=${Defaultv6OutPolicy=ACCEPT}
Defaultv6FwdPolicy=${Defaultv6FwdPolicy=ACCEPT}
default_policy_set ipv6 ${Defaultv6InPolicy} ${Defaultv6OutPolicy} ${Defaultv6FwdPolicy}
([[ ${Enablev6NetfilterModules} == "yes" ]] && [[ ${Enablev6ConnectionTracking} == "yes" ]]) \
&& load_kernel_modules "${Loadv6NetfilterModules}"
([[ ${Enablev6NetfilterModules} == "yes" ]] && [[ ${Enablev6ConnectionTracking} == "yes" ]] \
&& [[ ${Enablev6NAT} == "yes" ]]) && load_kernel_modules "${Loadv6NetfilterModulesNAT}"
[[ ${Enablev6MSSClamp} == "yes" ]] && enable_mss_clamp ipv6
([[ ${Enablev6ConnTrackInterfaces} != "none" ]] && [[ ${Enablev6ConnectionTracking} == "yes" ]]) \
&& enable_conntrack_int ipv6 "${Enablev6ConnTrackInterfaces}"

View File

@ -29,7 +29,8 @@ Enablev4MSSClamp="yes"
# packets it allows and refuses. On highly loaded systems or
# ones with low memory, this may be desirable. Everyone else
# should probably leave this on.
# Depended on by: Enablev4NAT Enablev4ConnTrackInterfaces
# Depended on by: Enablev4NAT Enablev4ConnTrackInterfaces Enablev4NetfilterModules
# Loadv4NetfilterModules
# Values: no | yes (default)
Enablev4ConnectionTracking="yes"
@ -97,6 +98,26 @@ Enablev4NAT="yes"
# Values: no | yes (default)
Enablev4PortForwarding="yes"
# Enable loading of helper modules
# Load kernel modules for various helpers/ALGs that netfilter
# has available. You may need to modify the Loadv4NetfilterModules
# option as sometimes kernel modules may not exist or be renamed on
# a particular system.
# Values: no | yes (default)
Enablev4NetfilterModules="yes"
# List of kernel netfilter modules to Load
# Default: nf_conntrack_ftp nf_conntrack_h323 nf_conntrack_irc
# nf_conntrack_pptp nf_conntrack_proto_dccp nf_conntrack_proto_gre
# nf_conntrack_proto_sctp nf_conntrack_proto_udplite nf_conntrack_sip
# nf_conntrack_broadcast
Loadv4NetfilterModules="nf_conntrack_ftp nf_conntrack_h323 nf_conntrack_irc nf_conntrack_pptp nf_conntrack_proto_dccp nf_conntrack_proto_gre nf_conntrack_proto_sctp nf_conntrack_proto_udplite nf_conntrack_sip nf_conntrack_broadcast"
# These are loaded as well if you have Enablev4NAT set to yes
# Default: nf_nat_ftp nf_nat_h323 nf_nat_irc nf_nat_pptp nf_nat_proto_dccp
# nf_nat_proto_gre nf_nat_proto_sctp nf_nat_proto_udplite nf_nat_sip
Loadv4NetfilterModulesNAT="nf_nat_ftp nf_nat_h323 nf_nat_irc nf_nat_pptp nf_nat_proto_dccp nf_nat_proto_gre nf_nat_proto_sctp nf_nat_proto_udplite nf_nat_sip"
# Default policy for filtering rules
# netfilter/iptables has a default policy that can be set, such as
# DROP all unless it is explicitly allowed via rules.

View File

@ -97,6 +97,25 @@ Enablev6NAT="yes"
# Values: no | yes (default)
Enablev6PortForwarding="yes"
# Enable loading of helper modules
# Load kernel modules for various helpers/ALGs that netfilter
# has available. You may need to modify the Loadv4NetfilterModules
# option as sometimes kernel modules may not exist or be renamed on
# a particular system.
# This is set to no by default on ipv6 because on my test system, I do not
# see any usable helper modules for ipv6 use. Obviously this may change
# in the future.
# Values: no (default) | yes
Enablev6NetfilterModules="no"
# List of kernel netfilter modules to Load
# Default: none
Loadv6NetfilterModules=""
# These are loaded as well if you have Enablev4NAT set to yes
# Default: none
Loadv6NetfilterModulesNAT=""
# Default policy for filtering rules
# netfilter/iptables has a default policy that can be set, such as
# DROP all unless it is explicitly allowed via rules.

View File

@ -60,7 +60,7 @@ function default_policy_set {
ipv6) VER_IPTABLES=${IP6TABLES} ;;
ipv4|*) VER_IPTABLES=${IPTABLES} ;;
esac
${display} RED "Setting ${IP_VERSION} policies to ${SET_POLICY}..."
${display} RED "Setting ${IP_VERSION} policies to INPUT:${INPOLICY} OUTPUT:${OUTPOLICY} FORWARD:${FWDPOLICY}..."
${VER_IPTABLES} --policy INPUT ${INPOLICY}
${VER_IPTABLES} --policy OUTPUT ${OUTPOLICY}
${VER_IPTABLES} --policy FORWARD ${FWDPOLICY}

28
lib/kernel.inc Normal file
View File

@ -0,0 +1,28 @@
#!/bin/bash
# By Brielle Bruns <bruns@2mbit.com>
# URL: http://www.sosdg.org/freestuff/firewall
# License: GPLv3
#
# Copyright (C) 2009 - 2014 Brielle Bruns
# Copyright (C) 2009 - 2014 The Summit Open Source Development Group
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
function load_kernel_modules {
LOAD_MODULES="${2}"
${debug} ${DebugColor} "${FUNCNAME}:${DEFAULT_COLOR} loading"
for i in $LOAD_MODULES; do
${debug} ${DebugColor} "${FUNCNAME}:${DEFAULT_COLOR} Loading kernel module ${i}..."
${MODPROBE} ${i}
done
}