Added a relaxed mode.

This allows to run nether in a permissive/relaxed
mode where all DENY requestes are actualy allowed
but logged via AUDIT.

Change-Id: I0f67f061b2697a80d610d1988b706bd92de05944

diff --git a/include/nether_Types.h b/include/nether_Types.h
index 83e9962..a862da4 100644 (file)
--- a/include/nether_Types.h
+++ b/include/nether_Types.h
@@ -99,6 +99,7 @@
 #define NETHER_MAX_USER_LEN                            32
 #define NETLINK_DROP_MARK                              3
 #define NETLINK_ALLOWLOG_MARK                  4
+#define NETLINK_QUEUE_NUM                              0
 #define NETHER_LOG_BACKEND                             NetherLogBackendType::stderrBackend
 #define NETHER_IPTABLES_RESTORE_PATH   "/usr/sbin/iptables-restore"
 
@@ -179,10 +180,11 @@ struct NetherConfig
        int backupBackendRetries                                        = 3;
        int debugMode                                                           = 0;
        int daemonMode                                                          = 0;
-       int queueNumber                                                         = 0;
+       int queueNumber                                                         = NETLINK_QUEUE_NUM;
        int enableAudit                                                         = 0;
        int noRules                                                                     = 0;
        int copyPackets                                                         = NETLINK_COPY_PACKETS;
+       int relaxed                                                                     = 0;
        int interfaceInfo                                                       = NETLINK_INTERFACE_INFO;
        std::string backupBackendArgs                           = NETHER_POLICY_FILE;
        std::string rulesPath                                           = NETHER_RULES_PATH;

diff --git a/src/nether_Main.cpp b/src/nether_Main.cpp
index eca8914..1ab5820 100644 (file)
--- a/src/nether_Main.cpp
+++ b/src/nether_Main.cpp
@@ -44,6 +44,7 @@ int main(int argc, char *argv[])
                {"no-rules",                no_argument,        &netherConfig.noRules,                  0},
                {"copy-packets",                        no_argument,            &netherConfig.copyPackets,              0},
                {"interface-info",                      no_argument,            &netherConfig.interfaceInfo,    0},
+               {"relaxed",                                     no_argument,            &netherConfig.relaxed,                  0},
                {"log",                     required_argument,  0,                                                              'l'},
                {"log-args",                required_argument,  0,                                                              'L'},
                {"default-verdict",         required_argument,  0,                                                              'V'},
@@ -62,7 +63,7 @@ int main(int argc, char *argv[])
 
        while(1)
        {
-               c = getopt_long(argc, argv, ":daxcIl:L:V:p:P:b:B:q:m:M:a:r:i:h", longOptions, &optionIndex);
+               c = getopt_long(argc, argv, ":daxcIRl:L:V:p:P:b:B:q:m:M:a:r:i:h", longOptions, &optionIndex);
 
                if(c == -1)
                        break;
@@ -93,6 +94,10 @@ int main(int argc, char *argv[])
                                netherConfig.enableAudit            = 1;
                                break;
 #endif
+                       case 'R':
+                               netherConfig.relaxed                            = 1;
+                               break;
+
                        case 'l':
                                netherConfig.logBackend             = stringToLogBackendType(optarg);
                                break;
@@ -203,6 +208,7 @@ int main(int argc, char *argv[])
                 << " iptables-restore-path="   << netherConfig.iptablesRestorePath);
        LOGD("interface-info="                          << (netherConfig.interfaceInfo ? "yes" : "no")
                << " copy-packets="                             << (netherConfig.copyPackets ? "yes" : "no"));
+       LOGD("relaxed="                                         << (netherConfig.relaxed ? "yes" : "no"));
 
        NetherManager manager(netherConfig);
 
@@ -241,6 +247,7 @@ void showHelp(char *arg)
        cout<< "  -x,--no-rules\t\t\t\tDon't load iptables rules on start (default:no)\n";
        cout<< "  -c,--copy-packets\t\t\tCopy entire packets, needed to read TCP/IP information (default:no)\n";
        cout<< "  -I,--interface-info\t\t\tGet interface info for every packet (default:no)\n";
+       cout<< "  -R,--relaxed\t\t\t\tRun in relaxed mode, instrad of deny do ACCEPT_LOG(default:no)\n";
        cout<< "  -l,--log=<backend>\t\t\tSet logging backend STDERR,SYSLOG";
 #if defined(HAVE_SYSTEMD_JOURNAL)
        cout << ",JOURNAL\n";
@@ -260,7 +267,7 @@ void showHelp(char *arg)
 #endif
        cout<< ",FILE,NONE (defualt:"<< backendTypeToString(NETHER_BACKUP_BACKEND)<< ")\n";
        cout<< "  -B,--backup-backend-args=<arguments>\tBackup policy backend arguments (default:" << NETHER_POLICY_FILE << ")\n";
-       cout<< "  -q,--queue-num=<queue number>\t\tNFQUEUE queue number to use for receiving packets\n";
+       cout<< "  -q,--queue-num=<queue number>\t\tNFQUEUE queue number to use for receiving packets (default:" << NETLINK_QUEUE_NUM << ")\n";
        cout<< "  -m,--mark-deny=<mark>\t\t\tPacket mark to use for DENY verdicts (default:"<< NETLINK_DROP_MARK << ")\n";
        cout<< "  -M,--mark-allow-log=<mark>\t\tPacket mark to use for ALLOW_LOG verdicts (default:" << NETLINK_ALLOWLOG_MARK << ")\n";
 #if defined(HAVE_AUDIT)

diff --git a/src/nether_Netlink.cpp b/src/nether_Netlink.cpp
index 08af86f..bb91510 100644 (file)
--- a/src/nether_Netlink.cpp
+++ b/src/nether_Netlink.cpp
@@ -184,8 +184,16 @@ void NetherNetlink::setVerdict(const u_int32_t packetId, const NetherVerdict ver
 
        if(verdict == NetherVerdict::allow)
                ret = nfq_set_verdict(queueHandle, packetId, NF_ACCEPT, 0, NULL);
+
        if(verdict == NetherVerdict::deny)
-               ret = nfq_set_verdict2(queueHandle, packetId, NF_ACCEPT, netherConfig.markDeny, 0, NULL);
+               ret = nfq_set_verdict2(queueHandle,
+                                                               packetId,
+                                                               NF_ACCEPT,
+                                                               /* if we're relaxed, let's not stress out */
+                                                               netherConfig.relaxed ? netherConfig.markAllowAndLog : netherConfig.markDeny,
+                                                               0,
+                                                               NULL);
+
        if(verdict == NetherVerdict::allowAndLog)
                ret = nfq_set_verdict2(queueHandle, packetId, NF_ACCEPT, netherConfig.markAllowAndLog, 0, NULL);
 

diff --git a/src/nether_Utils.cpp b/src/nether_Utils.cpp
index 29554e0..2d231eb 100644 (file)
--- a/src/nether_Utils.cpp
+++ b/src/nether_Utils.cpp
@@ -128,7 +128,7 @@ std::string transportToString(const NetherTransportType transportType)
                        return ("IGMP");
                case NetherTransportType::unknownTransportType:
                default:
-                       return ("UNKNOWN");
+                       return ("(unknown)");
        }
 }
 
@@ -141,7 +141,7 @@ std::string protocolToString(const NetherProtocolType protocolType)
                case NetherProtocolType::IPv6:
                        return ("IPv6");
                default:
-                       return ("UNKNOWN");
+                       return ("(unknown)");
        }
 }