root/fwknop/tags/fwknop-0.9.7-pre3/knoptm

#!/usr/bin/perl -w
#
#############################################################################
#
# File: knoptm
#
# Purpose: This daemon will remove entries from the iptables chain(s) to
#          which fwknop has added access for certain IP addresses.  It uses
#          the file /var/log/fwknop/knoptm.cache file in order to determine
#          when access should be removed.  The format of the entries in this
#          is as follows:
#
#   <rule timestamp> <timeout> <ip> <proto> <port> <table> <chain> <target>
#
# Author: Michael Rash (mbr@cipherdyne.org)
#
# Version: 0.9.5
#
# Copyright (C) 2004 Michael Rash (mbr@cipherdyne.org)
#
# License (GNU Public License):
#
#    This program is distributed in the hope that it will be useful,
#    but WITHOUT ANY WARRANTY; without even the implied warranty of
#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
#    GNU General Public License for more details.
#
#    You should have received a copy of the GNU General Public License
#    along with this program; if not, write to the Free Software
#    Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307
#    USA
#
#############################################################################
#
# $Id$
#

use lib '/usr/lib/fwknop';
use IPTables::Parse;
use IPTables::ChainMgr;
use Unix::Syslog qw(:subs :macros);
use Net::IPv4Addr qw(ipv4_in_network);
use IO::Socket;
use IO::Handle;
use File::Copy;
use Data::Dumper;
use POSIX;
use Getopt::Long;
use strict;

my $config_file = '/etc/fwknop/fwknop.conf';
my $alerting_config_file = '/etc/fwknop/alert.conf';
my $user_rc_file = '';

my $version = '0.9.5';
my $print_help = 0;
my $debug      = 0;
my $die_msg    = '';
my $warn_msg   = '';
my $timeout_sock = '';

my %config = ();
my %cmds   = ();
my %timeout_cache = ();

my $ip_re = '(?:\d{1,3}\.){3}\d{1,3}';

### make Getopts case sensitive
Getopt::Long::Configure('no_ignore_case');
&usage(1) unless (GetOptions(
    'config=s' => \$config_file,
    'help'     => \$print_help
));

&usage(0) if $print_help;

### set things up, deal with pid's, and import config
&knoptm_init();

print STDERR "[+] Opening $config{'KNOPTM_IP_TIMEOUT_SOCK'} socket, ",
    "and entering main loop.\n" if $debug;

$timeout_sock = IO::Socket::UNIX->new(
    Type   => SOCK_STREAM,
    Local  => $config{'KNOPTM_IP_TIMEOUT_SOCK'},
    Listen => SOMAXCONN,
    Timeout => .1
) or die "[*] Could not acquire auto-response domain socket: $!";

for (;;) {
    my @fw_cache_entries = ();

    my $fwknop_connection = $timeout_sock->accept();
    if ($fwknop_connection) {
        @fw_cache_entries = <$fwknop_connection>;

        ### add new entries to the cache
        &build_timeout_cache(\@fw_cache_entries) if @fw_cache_entries;
    }

    ### always check to see if any fw rules need to be removed
    &timeout_cache_entries();

    &append_die_msg()  if $die_msg;
    &append_warn_msg() if $warn_msg;

    sleep 1;
}
close $timeout_sock;
exit 0;
#============================ end main ==============================

sub build_timeout_cache() {
    my $cache_entries_aref = shift;
    LINE: for my $line (@$cache_entries_aref) {
        if ($line =~ /^\s*\d+\s+\d+\s+\S+
                \s+\S+\s+\d+\s+\S+\s+\S+\s+\S+/x) {

            $timeout_cache{$line} = '';
        }
    }
    return;
}

sub timeout_cache_entries() {

    my @del_keys = ();
    for my $line (keys %timeout_cache) {
        if ($line =~ /^\s*(\d+)\s+(\d+)\s+(\S+)
                \s+(\S+)\s+(\d+)\s+(\S+)\s+(\S+)\s+(\S+)/x) {
            my $rule_timestamp = $1;
            my $timeout        = $2;
            my $ip             = $3;
            my $proto          = $4;
            my $port           = $5;
            my $table          = $6;
            my $chain          = $7;
            my $target         = $8;

            ### see if the rule is still active, and remove if necessary
            if (&rm_fw_rule($rule_timestamp, $timeout, $ip, $proto,
                    $port, $table, $chain, $target)) {

                ### delete the entry from the in-memory cache now that
                ### Netfilter rule has been removed
                push @del_keys, $line;
            }
        }
    }
    if (@del_keys) {
        for my $key (@del_keys) {
            delete $timeout_cache{$key};
        }
    }
    return;
}

sub rm_fw_rule() {
    my ($rule_timestamp, $timeout, $ip, $proto,
        $port, $table, $chain, $target) = @_;

    return 0 unless (time() - $rule_timestamp > $timeout);

    my $removed_rule = 0;
    my $ipt = new IPTables::ChainMgr(
        'iptables' => $cmds{'iptables'}
    ) or die '[*] Could not acquire IPTables::ChainMgr object.';

    if ($ipt->find_ip_rule($ip, '0.0.0.0/0', $table,
            $chain, $target, {'protocol' => $proto,
            'd_port' => $port})) {

        my ($rv, $status_msg) = $ipt->delete_ip_rule($ip,
            '0.0.0.0/0', $table, $chain, $target,
            {'protocol' => $proto, 'd_port' => $port});

        if ($rv) {
            &logr('[+]', "removed iptables $chain ACCEPT rule " .
                "for $ip -> $proto/$port, $timeout " .
                "second timeout exceeded", 1);
            $removed_rule = 1;
        } else {
            &logr('[-]', $status_msg, 0);
        }
    }
    return $removed_rule;
}

sub import_config() {
    my $config_file = shift;
    open C, "< $config_file" or die "[*] Could not open ",
        "config file $config_file: $!";
    my @lines = <C>;
    close C;
    for my $line (@lines) {
        chomp $line;
        next if ($line =~ /^\s*#/);
        if ($line =~ /^(\S+)\s+(.*?)\;/) {
            my $varname = $1;
            my $val     = $2;
            if ($val =~ m|/.+| && $varname =~ /^(\w+)Cmd$/) {
                ### found a command
                $cmds{$1} = $val;
            } else {
                $config{$varname} = $val;
            }
        }
    }
    return;
}

### check paths to commands and attempt to correct if any are wrong.
sub check_commands() {
    my @path = qw(
        /bin
        /sbin
        /usr/bin
        /usr/sbin
        /usr/local/bin
        /usr/local/sbin
    );
    for my $cmd (keys %cmds) {
        unless (-x $cmds{$cmd}) {
            my $found = 0;
            PATH: for my $dir (@path) {
                if (-x "${dir}/${cmd}") {
                    $cmds{$cmd} = "${dir}/${cmd}";
                    $found = 1;
                    last PATH;
                }
            }
            unless ($found) {
                die "[*] Could not find $cmd anywhere!!!  Please edit the\n",
                    "config section in $config_file to include the path to\n",
                    "$cmd.";
            }
        }
        unless (-x $cmds{$cmd}) {
            die "[*] Command $cmd is located at $cmds{$cmd}, but ",
                "is not executable by uid: $<";
        }
    }
    return;
}

sub sendmail() {
    my $subject = shift;
    open MAIL, "| $cmds{'mail'} -s \"$subject\" $config{'EMAIL_ADDRESSES'} " .
        "> /dev/null" or die "[*] Could not send mail: $cmds{'mail'} -s " .
        "$subject\" $config{'EMAIL_ADDRESSES'}: $!";
    close MAIL;
    return;
}

sub uniquepid() {
    if (-e $config{'KNOPTM_PID_FILE'}) {
        my $caller = $0;
        open PIDFILE, "< $config{'KNOPTM_PID_FILE'}";
        my $pid = <PIDFILE>;
        close PIDFILE;
        chomp $pid;
        if (kill 0, $pid) {  # knoptm is already running
            die "[*] knoptm (pid: $pid) is already running!  Exiting.\n";
        }
    }
    return;
}

sub writepid() {
    open P, "> $config{'KNOPTM_PID_FILE'}" or die "[*] Could not open ",
        "$config{'KNOPTM_PID_FILE'}: $!";
    print P $$, "\n";
    close P;
    chmod 0600, $config{'KNOPTM_PID_FILE'};
    return;
}

sub knoptm_init() {

    ### import config
    &import_config($config_file);

    ### import alerting config (for ALERTING_METHODS keyword)
    &import_config($alerting_config_file);

    ### make sure all the vars we need are actually in the config file.
    &required_vars();

    ### validate config
    &validate_config();

    ### make sure there is not another knoptm process already running.
    &uniquepid();

    ### make sure command paths are correct
    &check_commands();

    unless ($debug) {
        my $pid = fork();
        exit 0 if $pid;
        die "[*] $0: Couldn't fork: $!" unless defined $pid;
        POSIX::setsid() or die "[*] $0: Can't start a new session: $!";
    }

    ### write our pid out to disk
    &writepid();

    ### Install signal handlers for debugging and for reaping zombie
    ### whois processes.
    $SIG{'__WARN__'} = \&warn_handler;
    $SIG{'__DIE__'}  = \&die_handler;
    $SIG{'CHLD'}     = \&REAPER;

    unlink $config{'KNOPTM_IP_TIMEOUT_SOCK'}
        if -e $config{'KNOPTM_IP_TIMEOUT_SOCK'};

    return;
}

### write a message to syslog (leaves off $prefix, which assigns a
### "type" to the message, when writing syslog; might add it later
sub logr() {
    my ($prefix, $msg, $send_email) = @_;
    if ($debug) {
        print STDERR "$prefix $msg\n";
    } else {
        unless ($config{'ALERTING_METHODS'} =~ /no.?syslog/i) {
            ### write a message to syslog
            openlog 'knoptm', LOG_DAEMON, LOG_LOCAL7;
            syslog LOG_INFO, $msg;
            closelog();
        }

        ### see if we need to send an email
        if ($send_email and $config{'ALERTING_METHODS'} !~ /noe?mail/i) {
            &sendmail("$prefix knoptm: $msg");
        }
    }
    return;
}

sub required_vars() {
    for my $var qw(KNOPTM_PID_FILE FWKNOP_DIR EMAIL_ADDRESSES AUTH_MODE
            KNOPTM_IP_TIMEOUT_SOCK ALERTING_METHODS) {
        unless (defined $config{$var}) {
            die "[*] Variable $var is not defined in $config_file";
        }
    }
    return;
}

sub validate_config() {

    die qq([*] Invalid EMAIL_ADDRESSES value: "$config{'EMAIL_ADDRESSES'}")
        unless $config{'EMAIL_ADDRESSES'} =~ /\S+\@\S+/;

    ### translate commas into spaces
    $config{'EMAIL_ADDRESSES'} =~ s/\s*\,\s/ /g;

    unless ($config{'AUTH_MODE'} eq 'KNOCK'
            or $config{'AUTH_MODE'} eq 'ULOG_PCAP'
            or $config{'AUTH_MODE'} eq 'PCAP') {
        die "[*] AUTH_MODE must be either KNOCK, ULOG_PCAP, or PCAP";
    }
    return;
}

sub die_handler() {
    $die_msg = shift;
    return;
}

### write all warnings to a logfile
sub warn_handler() {
    $warn_msg = shift;
    return;
}

sub REAPER {
    my $pid;
    $pid = waitpid(-1, WNOHANG);
#   if (WIFEXITED($?)) {
#          print STDERR "[+] **  Process $pid exited.\n";
#      }
    $SIG{'CHLD'} = \&REAPER;
    return;
}

sub append_die_msg() {
    open D, ">> $config{'FWKNOP_DIR'}/knoptm.die" or
        die "[*] Could not open $config{'FWKNOP_DIR'}/knoptm.die: $!";
    print D scalar localtime(), " $die_msg";
    close D;
    $die_msg = '';
    return;
}

sub append_warn_msg() {
    open D, ">> $config{'FWKNOP_DIR'}/knoptm.warn" or
        die "[*] Could not open $config{'FWKNOP_DIR'}/knoptm.warn: $!";
    print D scalar localtime(), " $warn_msg";
    close D;
    $warn_msg = '';
    return;
}

sub usage() {
    my $exit_status = shift;
    print <<_HELP_;
knoptm
    version: $version, by Michael Rash (mbr\@cipherdyne.org)

Usage: knoptm [-c <config file>]

Options:
    -c, --config <file>        - Specify path to config file instead of using
                                 the default $config_file.  This
                                 file is used only when knoptm is run as a
                                 daemon.
_HELP_
    exit $exit_status;
}