|
|
|
|
|
|
|
Last version : 0.5 / 08 2004
XMLFILTER is a structured XML configuration model for Netfilter. XMLFILTER does a bit the same for Netfilter as m4 does for sendmail.
There is four main ideas behind XMLFILTER :
See the Iptables tutorial for informations about the usual way to configure Netfilter
Below are some of XMLFILTER features :
TODO :
The XML file is parsed to generate an iptables script which is run to configure Netfilter and IP security related kernel flags.
An XSLT transform sheet is used for the transformation. See the w3c recommandation for informations about XSLT transformations :
A perl utility program (xmlfilter.pl) take the XML file as argument, generate the iptables script, and run it. The gnome parser is used as it's more quick and reliable than the native XML PERL module. See the Gnome project XML and CPAN pages for informations :
xmlfilter -c [netfilter_config.xml]
There are three branch elements :
The <GATEWAY> branch contains everything about forwarded packets.
Its members are one or more <FORWARD> flow elements depending on the number of interfaces.
The <FW_HOST> branch contains everything about packets destinated or coming from a local process of the firewall.
Its members are one or more <INPUT> and <OUTPUT> flow elements depending on the number of interfaces.
The <POLICY> branch (mandatory) is used to set general parameters and kernel options.
It contains the following policy elements :
ip_forwarding : set to "yes" enable routing between interfaces
no_source_routing : set to "yes" tell the kernel to ignore source routed packets
secure_redirects : set to "yes" tell the kernel to
ignore ICMP redirects from sources that are not known gateways
policy : set the default rule for incoming packets destinated
to the firewall host to : "ACCEPT" (accept packet, disadvised ;),
"DROP" (silently trash the packet) or "REJECT" (trash packet and
send ICMP unreachable information)
policy : set the default rule for outgoing packets from
the firewall host to : "ACCEPT" (accept packet, disadvised ;),
"DROP" (silently trash the packet) or "REJECT" (trash packet and
send ICMP unreachable information)
policy : set the default rule for forwarded packets to :
"ACCEPT" (accept packet, disadvised ;), "DROP" (silently trash
the packet) or "REJECT" (trash packet and send ICMP unreachable
information)
catch_orpheans : set to "yes" drop or log framents of packets that are not related to any tracked connexion
catch_synscan : set to "yes" drop or log synscan attempts
catch_invalid : set to "yes" drop or log invalids packets
catch_invalid : set to "yes" drop or log invalids packets
log : set to "yes" tell if we should log packets before dropping
log_martians : set to "yes" log packets with impossible IP address
homenet : set the network address and mask of the protected
network in the www.xxx.yyy.zzz/mm format
extern_if : set the name of extern interface where to apply
antispoofing
statefull_inspection : set to "yes" activate connexion tracking
conntrack_max : set the max connexion tracking cache size
value (usually 16535 is a good value)
The element <FORWARD> is used to set the filtering rules concerning forwarded packets for a given set of two interfaces.
It has two attributes :
in : name of the input interface (eth0, ppp0, ...) out : name of the output interface (eth0, ppp0, ...) |
It can contain <FILTER_RULE> , <TOS_RULE> , <LOG_RULE> or <NAT_RULE> elements
The element <INPUT> is used to set the filtering rules concerning incoming packets destinated to the firewall host, for a given interface.
It has one attribute :
in : name of the input interface (eth0, ppp0, ...) |
It can contain <FILTER_RULE> , <TOS_RULE> or <LOG_RULE> elements
The element <OUTPUT> is used to set the filtering rules concerning outgoing packets coming originating from the firewall (or firewalled host), for a given interface, process or user.
It has the following attributes :
out : name of the output interface (eth0, ppp0, ...) - mandatory process : process name (ssh, wget, ...) - optional user : userid (0, 500, ...) - optional group : groupid (0, 100, ...) - optional |
It can contain <FILTER_RULE> , <TOS_RULE> or <LOG_RULE> elements
saddress : source IP address to match
daddress : destination IP address to match
proto : protocol (tcp, udp, icmp,..., or protocol number)
tcp_flag : TCP flag (syn, ack, rst, psh, urg, fin)
icmp_type : icmp type (number or name of icmp type, see IPTABLES documentation)
sport : source port number
dport : destination port number
limit : number of packets per time unit ex : 20/s, 3/minute, ...
burst : initial/burst number of packets
ttl : matches the IP time to live of the packet
tos : matches the TOS option of the packet
action : what to do with packet (ACCEPT, DROP, REJECT) (mandatory)
The limit="X/T" and burst="Y" attributes manage a token bucket filter. The bucket is initially filled with Y tokens. Each time a packet match the rule, the bucket leaks 1 token. The bucket is refilled with X tokens per time-unit T. The result is true as long as the bucket is not empty. The maximum (burst) number of tokens is Y.
saddress : source IP address to match
daddress : destination IP address to match
proto : protocol (tcp, udp, icmp,..., or protocol number)
tcp_flag : TCP flag (syn, ack, rst, psh, urg, fin)
icmp_type : icmp type (number or name of icmp type, see IPTABLES documentation)
sport : source port number
dport : destination port number
nat_to : translated IP, port number, or the www.xxx.yyy.zzz:mm format
action : what to do with packet (SNAT, DNAT, MASQUERADE) (mandatory)
The DNAT action is used to do Destination Network Address Translation, which means that it is used to rewrite the Destination IP address and/or port number of a packet.
The SNAT action is used to do Source Network Address Translation, which means that this action will rewrite the Source IP address in the IP header of the packet.
The MASQUERADE action is used to do Dynamic Source Network Address and Port Translation (DSNAPT). When you masquerade a connection, it means that we set the source IP address used on a specific network interface.
saddress : source IP address to match
daddress : destination IP address to match
chain : chain (INPUT, OUTPUT, FORWARD) (mandatory)
proto : protocol (tcp, udp, icmp,..., or protocol number)
tcp_flag : TCP flag (syn, ack, rst, psh, urg, fin)
icmp_type : icmp type (number or name of icmp type, see IPTABLES documentation)
sport : source port number
dport : destination port number
limit : number of packets per time unit ex : 20/s, 3/minute, ...
burst : initial/burst number of packets
ttl : matches the IP time to live of the packet
tos : matches the TOS option of the packet
prefix : text to be inserted at the begining of the log line
saddress : source IP address to match
daddress : destination IP address to match
proto : protocol (tcp, udp, icmp,..., or protocol number)
tcp_flag : TCP flag (syn, ack, rst, psh, urg, fin)
icmp_type : icmp type (number or name of icmp type, see IPTABLES documentation)
sport : source port number
dport : destination port number
ttl : matches the IP time to live of the packet
tos : matches the TOS option of the packet
set_tos : type of service to set to the packet
IP types of service can be set as follow : Minimize-Delay 16 (0x10), Maximize-Throughput 8 (0x08), Maximize-Reliability 4 (0x04), Minimize-Cost 2 (0x02), and Normal-Service 0 (0x00)
XMLFILTER can be downloaded here :
The following libraries are needed to run xmlfilter.pl :
The Lib-XML and Lib-XSLT Perl modules are included in the xmlfilter package, but more recent versions may be retrieved from CPAN (modification of Makefile will be needed). All modules are installed first by "make install" (some Perl modules need to compile their connector with the Gnome Libxml2: so gcc is needed)
Do a "make install" in the "XMLFILTER" directory to install everything, do a "make uninstall" to uninstall Xmlfilter and the Perl modules ;))
JAXE can be downloaded here :
GNU GENERAL PUBLIC LICENSE © http://www.gnu.org/copyleft/gpl.html
|