Re: [Shorewall-users] Macro files bug

Andrew Suffield
Sun, 28 Oct 2007 18:30:58 -0000

On Sun, Oct 28, 2007 at 09:23:43AM -0700, Tom Eastep
wrote:
> Andrew Suffield wrote:
>
> > I''ve been playing with it, in an attempt to generate
> > similar-but-more-flexible behaviour for the SSHKnock action described
> > in http://www.shorewall.net/PortKnocking.html (since that''s a
familiar
> > example that should showcase how this feature can be used).
> >
> > The goal is something like:
> >
> > PERL Knock ''net'',
''loc:192.168.1.5'', {port => 22, knocker => 1600, trap
=> [1599, 1601]};
> >
> > where the ''net'' and
''loc:192.168.1.5'' arguments are handed off to
> > shorewall for normal processing, while the perl function takes care of
> > the rest.
>
> With the patches that I''ve posted, this should now be possible.
When you get
> it working, please post it here and I''ll include it in a new
article that
> describes "Manual Chains".

Here''s a first cut - I haven''t yet tested this on a real
firewall, and
it''ll be a few days before I get a chance to do that. A diff of the
compiled output against that given by the example in the ''Port
Knocking'' article shows no significant difference, so I think
it''s at
least as correct as that article. Would be nice if somebody who
actually uses the method in that article could try it, and see how it
matches their expectations.

Knock.pm is attached, and contains the main code; it should be placed
in the firewall config directory (/etc/shorewall or whatever). You
also have to create a ''compile'' file, containing the following
two
lines:

use Knock;
1;

Then, for the example rules lines in
http://www.shorewall.net/PortKnocking.html, here are translations:


#ACTION          SOURCE            DEST           PROTO       DEST PORT(S)
SSHKnock         net               $FW            tcp         22,1599,1600,1601

becomes:

PERL Knock ''net'', ''loc:192.168.1.5'', {target
=> 22, knocker => 1600, trap => [1599, 1601]};

and:

#ACTION          SOURCE            DEST            PROTO       DEST PORT(S)
SOURCE      ORIGINAL
#
PORT(S)     DEST
DNAT-            net               loc:192.168.1.5 tcp         22            -
206.124.146.178
SSHKnock         net               $FW             tcp         1599,1600,1601
SSHKnock         net               loc:192.168.1.5 tcp         22            -
206.124.146.178

becomes:

DNAT-            net               loc:192.168.1.5 tcp         22            -
206.124.146.178
PERL Knock ''net'', ''$FW'', {name =>
''SSH'', knocker => 1600, trap => [1599, 1601]};
PERL Knock ''net'', ''loc:192.168.1.5'', {name
=> ''SSH'', target => 22, original_dest =>
''206.124.136.178''};

The ''name'' argument is used to tie together related
target/knocker/trap sets that appear in different rules - unlike the
original, you can just add more rules with different names to create
different sets. Also there''s the obvious benefit that all the
configuration is now in the ''rules'' file, rather than having
half of
it hardcoded into the action script, so if you change the port numbers
in the rule then it actually works. Might be worth rewriting the ''Port
Knocking'' article to use this method.