Good day, all,
I've got a 0.5.0 version of ipfwadm2ipchains ready. Feed an
ipfwadm ruleset to it and it gives you back an ipchains ruleset.
For example, if rust.examples (*1) holds:
#!/bin/bash
ipfwadm -F -p deny
ipfwadm -F -a m -S 192.168.0.0/24 -D 0.0.0.0/0
ipfwadm -I -a accept -V 10.1.2.1 -S 10.0.0.0/8 -D 0.0.0.0/0
typing
cat rust.examples | ipfwadm2ipchains >rust.ipchains
produces:
#!/bin/bash
ipchains -P forward DENY
ipchains -A forward -j MASQ -s 192.168.0.0/24 -d 0.0.0.0/0
ipchains -A input -j ACCEPT -i eth0 -s 10.0.0.0/8 -d 0.0.0.0/0
The script handles all the fields listed in the conversion table
in the ipchains-HOWTO appendix. It has had some basic testing, but no
torture tests yet. I know the people on these lists can provide the
toture tests. :-)
Could you take your ipfwadm rulesets and use this tool to convert
them to ipchains rulesets? I'd love to hear back if it converted them
correctly. I'd love to hear back even more if this failed to convert some
of the rules. Please send me a copy of the rules it had trouble with so I
can fix it. Constructive criticism and patches are also welcome.
I already know that this tool does not provide a strict check of
the rule syntax; it assumes that the rules you feed it already work on an
ipfwadm kernel. It doesn't know how to handle blank lines; make sure
every line has at least a "#" or it will terminate early. It also doesn't
handle lines with more than 60 words; let me know if you need more as it
can be trivially extended.
Rusty: would you consider putting this in the ipchains-scripts
package? David, Rusty, and Bernd: Could you provide pointers to it from
the ipchains-HOWTO, the Trinity OS, the IP Masquerade Resource, and
Freefire? The URL for it will be
http://www.pobox.com/~wstearns/ipfwadm2ipchains/
Once I've gotten some good feedback and have cleaned up the major
bugs I'll send it off to freshmeat...
Thanks for the help. Cheers,
- Bill
*1 The example rules from the ipchains-HOWTO
---------------------------------------------------------------------------
Opinions expressed are my own, but they should be everybody's.
(Courtesy of Doug Ledford <[EMAIL PROTECTED]>)
--------------------------------------------------------------------------
William Stearns ([EMAIL PROTECTED]) Mason, Buildkernel,
ipfwadm2ipchains and named2hosts are at: http://www.pobox.com/~wstearns
--------------------------------------------------------------------------
#!/bin/bash
#Copyright (c) 1999, William L. Stearns <[EMAIL PROTECTED]>
#Released under the GPL.
#Credit goes to Paul 'Rusty' Russell's ipchains-howto, especially
#the conversion table in the appendix.
#Home page is at http://www.pobox.com/~wstearns/ipfwadm2ipchains/
#Version 0.5.0, first release, May 2, 1999
ACCOUNTINGPREPARED=''
echo "------------------------------------------------------------------" >/dev/stderr
echo "---- ipfwadm2ipchains rule converter ----" >/dev/stderr
echo "---- See http://www.pobox.com/~wstearns/ for more info on ----" >/dev/stderr
echo "---- this and Mason, the automatic firewall creator. ----" >/dev/stderr
echo "---- Copyright (c) 1999 William Stearns <[EMAIL PROTECTED]> ----" >/dev/stderr
echo "---- Released under the GNU GPL. ----" >/dev/stderr
echo "------------------------------------------------------------------" >/dev/stderr
Fshift () {
F1=$F2 ; F2=$F3 ; F3=$F4 ; F4=$F5 ; F5=$F6
F6=$F7 ; F7=$F8 ; F8=$F9 ; F9=$F10 ; F10=$F11
F11=$F12 ; F12=$F13 ; F13=$F14 ; F14=$F15 ; F15=$F16
F16=$F17 ; F17=$F18 ; F18=$F19 ; F19=$F20 ; F20=$F21
F21=$F22 ; F22=$F23 ; F23=$F24 ; F24=$F25 ; F25=$F26
F26=$F27 ; F27=$F28 ; F28=$F29 ; F29=$F30 ; F30=$F31
F31=$F32 ; F32=$F33 ; F33=$F34 ; F34=$F35 ; F35=$F36
F36=$F37 ; F37=$F38 ; F38=$F39 ; F39=$F40 ; F40=$F41
F41=$F42 ; F42=$F43 ; F43=$F44 ; F44=$F45 ; F45=$F46
F46=$F47 ; F47=$F48 ; F48=$F49 ; F49=$F50 ; F50=$F51
F51=$F52 ; F52=$F53 ; F53=$F54 ; F54=$F55 ; F55=$F56
F56=$F57 ; F57=$F58 ; F58=$F59 ; F59=$F60 ;
F60=''
}
SetupAccounting () {
if [ "$ACCOUNTINGPREPARED" != 'YES' ]; then
echo \#The following block may be used to initialize the
echo \#Accounting chains that must be explicitly prepared
echo \#in ipchains. The lines starting with \"/sbin/ipchains\"
echo \#should be uncommented and a single
echo \#copy of the block placed at the top of your firewall.
echo \#/sbin/ipchains -N acctin
echo \#/sbin/ipchains -N acctout
echo \#/sbin/ipchains -N acctio
echo \#/sbin/ipchains -I 1 input -j acctio
echo \#/sbin/ipchains -I 1 input -j acctin
echo \#/sbin/ipchains -I 1 output -j acctio
echo \#/sbin/ipchains -I 1 output -j acctout
ACCOUNTINGPREPARED='YES'
fi
}
#Start of main loop. Read one ipfwadm rule for processing.
read F1 F2 F3 F4 F5 F6 F7 F8 F9 F10 \
F11 F12 F13 F14 F15 F16 F17 F18 F19 F20 \
F21 F22 F23 F24 F25 F26 F27 F28 F29 F30 \
F31 F32 F33 F34 F35 F36 F37 F38 F39 F40 \
F41 F42 F43 F44 F45 F46 F47 F48 F49 F50 \
F51 F52 F53 F54 F55 F56 F57 F58 F59 F60
CHAINRULE='' ; NEXT='' ; MASQ='' ; COMMENT=''
SOURCEPORT='' ; DESTPORT='' ; ACCTDIR='both'
REDIR='' ; REDIRPORT=''
while [ -n "$F1" ] && [ "$1" != '--help' ]; do #While there is
another line of input
while [ -n "$F1" ]; do #While there is another field to process in
this line
case "$F1" in
/sbin/ipfwadm)
CHAINRULE="$CHAINRULE /sbin/ipchains"
NEXT=''
;;
ipfwadm)
CHAINRULE="$CHAINRULE ipchains"
NEXT=''
;;
*/ipfwadm)
CHAINRULE="$CHAINRULE `echo $F1 | sed -e
's@/ipfwadm$@/ipchains@'`"
NEXT=''
;;
-A) #Create an accounting rule
SetupAccounting
CHAINRULE="$CHAINRULE -A ZZACCTDIRZZ"
NEXT='ACCTDIR'
;;
-F) #Forwarding rule
CHAIN='forward'
NEXT=''
;;
-I) #Input rule
CHAIN='input'
NEXT=''
;;
-O) #Output rule
CHAIN='output'
NEXT=''
;;
-M) #Masquerading administration (used for -l and -s)
CHAINRULE="$CHAINRULE -M"
NEXT=''
;;
-l) #List the rules in this chain
CHAINRULE="$CHAINRULE -L ZZCHAINZZ"
NEXT=''
;;
-s) #Set timeouts for masquerading
CHAINRULE="$CHAINRULE -S $F2 $F3 $F4" ; Fshift ; Fshift ;
Fshift
NEXT=''
;;
-a) #Append this rule
CHAINRULE="$CHAINRULE -A ZZCHAINZZ -j ZZPOLICYZZ"
NEXT='POLICY'
;;
-d) #Delete this rule
CHAINRULE="$CHAINRULE -D ZZCHAINZZ -j ZZPOLICYZZ"
NEXT='POLICY'
;;
-i) #Insert this rule
CHAINRULE="$CHAINRULE -I 1 ZZCHAINZZ -j ZZPOLICYZZ"
NEXT='POLICY'
;;
-z) #Zero out the counters
CHAINRULE="$CHAINRULE -Z"
NEXT=''
;;
-f) #Flush the rules in this chain
CHAINRULE="$CHAINRULE -F ZZCHAINZZ"
NEXT=''
;;
-p) #Default policy for the chain
CHAINRULE="$CHAINRULE -P ZZCHAINZZ ZZPOLICYZZ"
NEXT='POLICY'
;;
-c) #Check if packet would be accepted or not
CHAINRULE="$CHAINRULE -C"
NEXT=''
;;
-P) #Protocol
if [ "$F2" != "all" ]; then
CHAINRULE="$CHAINRULE -p $F2"
fi
Fshift
NEXT=''
;;
-S) #Specify packet source
CHAINRULE="$CHAINRULE -s $F2" ; Fshift
NEXT='SOURCEPORT'
;;
-D) #Specify packet destination
CHAINRULE="$CHAINRULE -d $F2" ; Fshift
NEXT='DESTPORT'
;;
-V) #Use this IP address; convert to an IF name.
HOSTIP="$F2"
IFNAME=`ifconfig | grep -B 1 "inet addr:$HOSTIP" | head -1 |
awk '{print $1}'`
if [ -z "$IFNAME" ]; then
HOSTIP=`host -t a $F2 2>/dev/null | grep 'has address'
| head -1 | awk '{print $4}'`
if [ -n "$HOSTIP" ]; then
IFNAME=`ifconfig | grep -B 1 "inet
addr:$HOSTIP" | head -1 | awk '{print $1}'`
else
echo Unable to find the interface name for $F2
. >/dev/stderr
echo Please convert it by hand. >/dev/stderr
IFNAME="interface_name_for_${F2}"
fi
fi
CHAINRULE="$CHAINRULE -i $IFNAME" ; Fshift
NEXT='' ; IFNAME='' ; HOSTIP=''
;;
-W) #Use this interface
CHAINRULE="$CHAINRULE -i $F2" ; Fshift
NEXT=''
;;
-b) #bidirectional mode
CHAINRULE="$CHAINRULE -b"
NEXT=''
;;
-e) #Extended/verbose output
CHAINRULE="$CHAINRULE -v"
NEXT=''
;;
-k) #Check ack flag
CHAINRULE="$CHAINRULE ! -y"
NEXT=''
;;
-m) #Masquerade this traffic
MASQ='YES' ; NEXT=''
;;
-n) #Numeric output
CHAINRULE="$CHAINRULE -n"
NEXT=''
;;
-o) #log these packets
CHAINRULE="$CHAINRULE -l"
NEXT=''
;;
-r) #REDIRECT to local port
REDIR='YES'
NEXT='REDIRPORT'
;;
-t) #Set TOS masks
CHAINRULE="$CHAINRULE -t $F2 $F3"
Fshift ; Fshift
NEXT=''
;;
-v) #Verbose
CHAINRULE="$CHAINRULE -v"
NEXT=''
;;
-x) #Expand numbers
CHAINRULE="$CHAINRULE -x"
NEXT=''
;;
-y) #Syn flag set and ack cleared
CHAINRULE="$CHAINRULE -y"
NEXT=''
;;
\#*) #Append comments verbatim.
while [ -n "$F1" ]; do
CHAINRULE="$CHAINRULE $F1"
Fshift
done
;;
*)
case "$NEXT" in
'ACCTDIR')
ACCTDIR="$F1" ; NEXT=''
;;
'REDIRPORT')
REDIRPORT="$F1" ; NEXT=''
;;
'SOURCEPORT')
if [ -z "`echo $CHAINRULE | grep 'ZZSOURCEPORTZZ'`" ];
then
CHAINRULE="$CHAINRULE ZZSOURCEPORTZZ"
fi
SOURCEPORT="$SOURCEPORT $F1"
;;
"DESTPORT")
if [ -z "`echo $CHAINRULE | grep 'ZZDESTPORTZZ'`" ];
then
CHAINRULE="$CHAINRULE ZZDESTPORTZZ"
fi
DESTPORT="$DESTPORT $F1"
;;
"POLICY")
POLICY=`echo $F1 | tr a-z A-Z`
case "$POLICY" in
A*) POLICY="ACCEPT"
;;
D*) POLICY="DENY"
;;
M*) POLICY="MASQ"
;;
R*) POLICY="REJECT"
;;
esac
NEXT=''
;;
*) #Just return the field - we don't know what to do.
CHAINRULE="$CHAINRULE $F1"
NEXT=''
;;
esac
esac
Fshift
done
#Replace Policy, Accounting and Chain placeholders
if [ "$MASQ" = "YES" ]; then
POLICY="MASQ"
fi
if [ "$REDIR" = "YES" ]; then
if [ -n "$REDIRPORT" ]; then
POLICY="REDIRECT $REDIRPORT"
else
POLICY="REDIRECT"
fi
fi
case "$ACCTDIR" in
'in')
CHAINRULE=`echo $CHAINRULE | sed -e "s/ZZACCTDIRZZ/acctin/g"` ;;
'out')
CHAINRULE=`echo $CHAINRULE | sed -e "s/ZZACCTDIRZZ/acctout/g"` ;;
'both'|''|*)
CHAINRULE=`echo $CHAINRULE | sed -e "s/ZZACCTDIRZZ/acctio/g"` ;;
esac
CHAINRULE=`echo $CHAINRULE | sed -e "s/ZZPOLICYZZ/$POLICY/g" \
-e "s/ZZCHAINZZ/$CHAIN/g"`
#Output the rule. Handle looping through multiple source and dest ports
if [ -z "$SOURCEPORT" ] && [ -z "$DESTPORT" ]; then #No src/dest ports
specified
echo $CHAINRULE
elif [ -n "$SOURCEPORT" ] && [ -z "$DESTPORT" ]; then #>=1 src port, no dest
ports
for ONESOURCE in $SOURCEPORT ; do
echo $CHAINRULE | sed -e "s/ZZSOURCEPORTZZ/$ONESOURCE/g"
done
elif [ -z "$SOURCEPORT" ] && [ -n "$DESTPORT" ]; then #no src ports, >=1 dest
port
for ONEDEST in $DESTPORT ; do
echo $CHAINRULE | sed -e "s/ZZDESTPORTZZ/$ONEDEST/g"
done
else #>=1 src port and >=1 dest port
for ONESOURCE in $SOURCEPORT ; do
for ONEDEST in $DESTPORT ; do
echo $CHAINRULE | sed -e
"s/ZZSOURCEPORTZZ/$ONESOURCE/g" -e "s/ZZDESTPORTZZ/$ONEDEST/g"
done
done
fi
#Read another line of input
read F1 F2 F3 F4 F5 F6 F7 F8 F9 F10 \
F11 F12 F13 F14 F15 F16 F17 F18 F19 F20 \
F21 F22 F23 F24 F25 F26 F27 F28 F29 F30 \
F31 F32 F33 F34 F35 F36 F37 F38 F39 F40 \
F41 F42 F43 F44 F45 F46 F47 F48 F49 F50 \
F51 F52 F53 F54 F55 F56 F57 F58 F59 F60
CHAINRULE='' ; NEXT='' ; MASQ='' ; COMMENT=''
SOURCEPORT='' ; DESTPORT='' ; ACCTDIR='both'
REDIR='' ; REDIRPORT=''
done
if [ "$1" = '--help' ]; then
echo Usage: $0 [--help] >/dev/stderr
echo This program converts ipfwadm rules to ipchains rules. >/dev/stderr
echo Example of use: >/dev/stderr
echo >/dev/stderr
echo cat ipfwadm_rulefile \| ipfwadm2ipchains \>ipchains_rulefile >/dev/stderr
echo echo if [ -f /proc/net/ip_fwchains ]\; then \>\>new_rules >/dev/stderr
echo cat ipchains_rulefile \>\>new_rules >/dev/stderr
echo echo elif [ -f /proc/net/ip_input ]\; then \>\>new_rules >/dev/stderr
echo cat ipfwadm_rulefile \>\>new_rules >/dev/stderr
echo echo fi \>\>new_rules >/dev/stderr
echo >/dev/stderr
echo The new_rules file will now work on ipchains and ipfwadm kernels.
>/dev/stderr
fi
_______________________________________________
Masq maillist - [EMAIL PROTECTED]
http://tiffany.indyramp.com/mailman/listinfo/masq
Admin requests can be handled by web (above) or [EMAIL PROTECTED]
