symbiosis-firewall-whitelist

#! /usr/bin/ruby1.8
#
# NAME
#   symbiosis-firewall-whitelist -- Automatically whitelist IP addresses.
#
# SYNOPSIS
#  symbiosis-firewall-whitelist [ -h | --help ] [-m | --manual]
#       [ -v | --verbose ] [ -x | --no-exec] [ -d | --no-delete ]
#       [ -e | --expire-after <n> ] [ -w | --wtmp-file <file> ]
#       [ -p | --prefix <dir> ] [ -t | --template-d <dir> ] 
#
# OPTIONS
#  -h, --help              Show a help message, and exit.
# 
#  -m, --manual            Show this manual, and exit.
#
#  -v, --verbose           Show verbose errors.
#
#  -x, --no-exec           Do not execute the generated firewall rules.
#
#  -d, --no-delete         Do not delete the generated script.
#
#  -e, --expire-after <n>  Number of days after which whitelisted IPs should be
#                          expired. Defaults to 8.
#
#  -w, --wtmp-file <file>  wtmp(5) file to read to find IPs to whitelist.
#                          Defaults to /var/log/wtmp.
#
#
#  -p, --prefix <dir>      Directory where action.d, incoming.d, outgoing.d etc.
#                          are located. Defaults to /etc/symbiosis/firewall.
#
#  -t, --template-d <dir>  Additional directory to search for templates.
#
# USAGE
#
# This script is designed to automatically whitelist IP addresses which
# have been used to successfully login via SSH.
#
# It does this by opening the wtmp file, and looking for IP addresses. Once it
# has found some, it records them in /etc/symbiosis/firewall/whitelist.d/.
# Each addition is one of the two forms:
#
#   1.2.3.4.auto                The IPv4 address 1.2.3.4
#   2001:123:456:789::|64.auto  The IPv6 range 2001:123:456:789::/64
#
# Once that directory has been written, symbiosis-firewall(1) is called with
# the reload-whitelist action.
#
# Most of the flags above are passed straight on to symbiosis-firewall(1).
#
# AUTHOR
#
#  Steve Kemp <steve@bytemark.co.uk>
#

#
#  Modules we require
#

require 'getoptlong'
require 'tempfile'
require 'fileutils'
require 'symbiosis/utmp'
require 'symbiosis/firewall/directory'
require 'symbiosis/firewall/template'
require 'symbiosis/firewall/ipaddr'


#
#  The options set by the command line.
#
help         = false
manual       = false
$VERBOSE     = false
base_dir     = "/etc/symbiosis/firewall/"
wtmp_file    = "/var/log/wtmp"
delete       = false
execute      = false
template_dir = nil
force        = false
expire_after = 8

opts = GetoptLong.new(
         [ '--help',       '-h', GetoptLong::NO_ARGUMENT ],
         [ '--manual',     '-m', GetoptLong::NO_ARGUMENT ],
         [ '--verbose',    '-v', GetoptLong::NO_ARGUMENT ],
         [ '--no-execute', '-x', GetoptLong::NO_ARGUMENT ],
         [ '--no-delete',  '-d', GetoptLong::NO_ARGUMENT ],
         [ '--force',      '-f', GetoptLong::NO_ARGUMENT ],
         [ '--prefix',     '-p', GetoptLong::REQUIRED_ARGUMENT ],
         [ '--template-d', '-t', GetoptLong::REQUIRED_ARGUMENT ],
         [ '--wtmp-file',  '-w', GetoptLong::REQUIRED_ARGUMENT ],
         [ '--expire-after', '-e', GetoptLong::REQUIRED_ARGUMENT ]
       )

opts.each do |opt,arg|
  case opt
  when '--help'
    help = true
  when '--manual'
    manual = true
  when '--verbose'
    $VERBOSE = true
  when '--test'
    test = true
  when '--no-execute'
    execute = false
  when '--no-delete'
    delete = false
  when '--force'
    force = true
  when '--prefix'
    base_dir     = File.expand_path(arg)
  when '--template-d'
    template_dir = File.expand_path(arg)
  when '--expire-after'
    expire_after = arg.to_i
  when '--wtmp-file'
    wtmp_file = arg
  end
end

#
# CAUTION! Here be quality kode.
#
if manual or help
  # Open the file, stripping the shebang line
  lines = File.open(__FILE__){|fh| fh.readlines}[1..-1]

  found_synopsis = false

  lines.each do |line|

    line.chomp!
    break if line.empty?

    if help and !found_synopsis
      found_synopsis = (line =~ /^#\s+SYNOPSIS\s*$/)
      next
    end

    puts line[2..-1].to_s

    break if help and found_synopsis and line =~ /^#\s*$/

  end

  exit 0
end

#
# Exit if we've been disabled
#
if File.exists?(File.join(base_dir, "disabled.whitelist"))
  puts "Firewall whitelist disabled.  Exiting." if $VERBOSE
  exit 0
end

#
# Basics.
#
expired = 0
whitelist_d = File.join(base_dir, "whitelist.d")

# ensure the directory exists.
unless File.directory?(whitelist_d)
  FileUtils.mkdir_p(whitelist_d)
end

expire_before = Time.now - ( expire_after * 24 * 60 * 60 )

#
#  Expire old entries first of all, then add new ones.
#
puts "Expiring old whitelist entries" if ( $VERBOSE )

Dir.glob( File.join(whitelist_d,"*.auto" ) ).each do |entry|

  if  File.mtime(entry) < expire_before

    puts "Removing #{entry}" if ( $VERBOSE )
    File.unlink(entry)
    expired += 1

  end

end

puts "Expiring done - removed #{expired} file(s)" if ( $VERBOSE )

#
#  Did we update?
#
updated=false

#
#
# Fetch the IP addresses
#
Symbiosis::Utmp.read(wtmp_file).each do |entry|

  begin
    ip = Symbiosis::Firewall::IPAddr.new(entry['ip'].to_s)
  rescue ArgumentError
    #
    # Oops.  Can't interpret the IP.
    #
    next
  end
  at = entry['time']

  #
  # Make sure the record isn't already expired.
  #
  next unless at > expire_before

  #
  # Mask IPv6 to /64s.
  #
  ip = ip.mask(64) if ip.ipv6?

  #
  # Mask IPv4 to /32s.
  #
  ip = ip.mask(32) if ip.ipv4?
  
  #
  # Only include globally routable IPs.
  #
  # FIXME: Need better IPv6 conditions.
  #
  next if ip.ipv4? and (IPAddr.new("127.0.0.1/8").include?(ip) or IPAddr.new("0.0.0.0") == ip )
  next if ip.ipv6? and !IPAddr.new("2000::/3").include?(ip)

  puts "Found IP address: #{ip}" if ( $VERBOSE )

  #
  # Check filename without .auto first.
  #
  fn = File.join(whitelist_d,ip.to_s.gsub("/","|"))

  if ( File.exists?(fn) )
    puts "\tAlready manually whitelisted" if ( $VERBOSE )

  else
    #
    # Automatically whitelist.
    #
    fn += ".auto"

    if ! File.exists?(fn)
      updated=true 
      puts "\tAdding to whitelist" if ( $VERBOSE )

      #
      # Create a new file.
      #
      FileUtils.touch(fn, :mtime => at)

    elsif File.mtime(fn) < at
      #
      # Update the mtime, if this entry is newer.
      #
      puts "\tUpdating whitelist entry" if ( $VERBOSE )
      FileUtils.touch(fn, :mtime => at)
    end

  end

end

#
# Re-generate the whitelist chain
#
if ( updated || expired > 0 || force )
  cmd = %w(symbiosis-firewall)
  cmd << "--verbose" if $VERBOSE
  cmd << "--no-execute" unless execute
  cmd << "--no-delete"  unless delete
  cmd += ["--prefix", base_dir]
  cmd += ["--template-d", template_dir] unless template_dir.nil?
  cmd << "reload-whitelist"
  puts "Executing #{cmd.join(" ")}" if $VERBOSE
  exec(*cmd)
end