From 4daf6b2bcb74a666527dd802dc54d3413914e70e Mon Sep 17 00:00:00 2001 From: RomanKubiak Date: Mon, 20 Jul 2015 16:11:10 +0200 Subject: [PATCH] Added audit support Updated cmake to include certain constants Made boost optional not required Fixed spec Added iptables-restore support Change-Id: I3b965023bd5c5a07612f80fa2e040454e7db42a2 --- CMakeLists.txt | 33 +++++++++++++++- cmake/Findaudit.cmake | 35 +++++++++++++++++ conf/CMakeLists.txt | 26 ++++++++++++ conf/nether.policy | 29 ++++++++++++++ conf/nether.rules | 41 +++++++++++++++++++ conf/systemd/nether.service.in | 29 ++++++++++++++ config/nether.policy | 7 ---- config/nether.rules | 29 -------------- config/setrules.sh | 85 ---------------------------------------- include/nether_CynaraBackend.h | 8 ++-- include/nether_DummyBackend.h | 23 +++++++++++ include/nether_FileBackend.h | 2 +- include/nether_Manager.h | 15 +++++-- include/nether_Netlink.h | 2 +- include/nether_PolicyBackend.h | 2 +- include/nether_Types.h | 33 +++++++++++++--- include/nether_Utils.h | 2 +- nether.cbp | 12 ++++-- packaging/nether.manifest | 5 --- packaging/nether.spec | 55 +++++++++++++------------- src/CMakeLists.txt | 89 ++++++++++++++++++++++++++++++++---------- src/logger/backend-stderr.cpp | 8 +++- src/logger/level.cpp | 26 +++++++++++- src/nether_CynaraBackend.cpp | 14 +++---- src/nether_FileBackend.cpp | 4 +- src/nether_Main.cpp | 89 +++++++++++++++++++++++++++++++----------- src/nether_Manager.cpp | 70 ++++++++++++++++++++++++++++++++- src/nether_Netlink.cpp | 6 ++- src/nether_NetworkUtils.cpp | 2 +- 29 files changed, 548 insertions(+), 233 deletions(-) create mode 100644 cmake/Findaudit.cmake create mode 100644 conf/CMakeLists.txt create mode 100644 conf/nether.policy create mode 100644 conf/nether.rules create mode 100644 conf/systemd/nether.service.in delete mode 100644 config/nether.policy delete mode 100644 config/nether.rules delete mode 100644 config/setrules.sh delete mode 100644 packaging/nether.manifest diff --git a/CMakeLists.txt b/CMakeLists.txt index d372f16..18fbea1 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -1,5 +1,34 @@ +# +# Copyright (c) 2015 Samsung Electronics Co., Ltd All Rights Reserved +# +# Contact: Roman Kubiak (r.kubiak@samsung.com) +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License +# + CMAKE_MINIMUM_REQUIRED (VERSION 2.6) PROJECT (nether) -INCLUDE(FindPkgConfig) +INCLUDE (FindPkgConfig) SET (CMAKE_CXX_FLAGS "-std=c++11") -ADD_SUBDIRECTORY(src) +SET (CMAKE_MODULE_PATH ${CMAKE_CURRENT_SOURCE_DIR}/cmake) + +IF (NOT DEFINED SYSCONF_INSTALL_DIR) + SET(SYSCONF_INSTALL_DIR "/etc") +ENDIF (NOT DEFINED SYSCONF_INSTALL_DIR) + +IF (NOT DEFINED SYSTEMD_UNIT_DIR) + SET(SYSTEMD_UNIT_DIR "${CMAKE_INSTALL_PREFIX}/lib/systemd/system") +ENDIF (NOT DEFINED SYSTEMD_UNIT_DIR) + +ADD_SUBDIRECTORY (src) +ADD_SUBDIRECTORY (conf) diff --git a/cmake/Findaudit.cmake b/cmake/Findaudit.cmake new file mode 100644 index 0000000..f33bb25 --- /dev/null +++ b/cmake/Findaudit.cmake @@ -0,0 +1,35 @@ +# +# Copyright (c) 2015 Samsung Electronics Co., Ltd All Rights Reserved +# +# Contact: Roman Kubiak (r.kubiak@samsung.com) +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License +# + +FIND_PATH (AUDIT_INCLUDE_DIR libaudit.h /usr/include /usr/local/include) +FIND_LIBRARY (AUDIT_LIBRARY NAMES libaudit.a PATH /usr/lib /usr/local/lib) + +IF (AUDIT_INCLUDE_DIR AND AUDIT_LIBRARY) + SET (AUDIT_FOUND TRUE) +ENDIF (AUDIT_INCLUDE_DIR AND AUDIT_LIBRARY) + + +IF (AUDIT_FOUND) + IF (NOT audit_FIND_QUIETLY) + MESSAGE(STATUS "Found audit: ${AUDIT_LIBRARY}") + ENDIF (NOT audit_FIND_QUIETLY) +ELSE (AUDIT_FOUND) + IF (audit_FIND_REQUIRED) + MESSAGE(FATAL_ERROR "Could not find audit") + ENDIF (audit_FIND_REQUIRED) +ENDIF (AUDIT_FOUND) diff --git a/conf/CMakeLists.txt b/conf/CMakeLists.txt new file mode 100644 index 0000000..be55e51 --- /dev/null +++ b/conf/CMakeLists.txt @@ -0,0 +1,26 @@ +# +# Copyright (c) 2015 Samsung Electronics Co., Ltd All Rights Reserved +# +# Contact: Roman Kubiak (r.kubiak@samsung.com) +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License +# + +MESSAGE(STATUS "Installing config files") + +CONFIGURE_FILE(systemd/nether.service.in systemd/nether.service) + +INSTALL(FILES nether.policy DESTINATION ${SYSCONF_INSTALL_DIR}/nether) +INSTALL(FILES nether.rules DESTINATION ${SYSCONF_INSTALL_DIR}/nether) +INSTALL(FILES systemd/nether.service DESTINATION ${SYSTEMD_UNIT_DIR}) +INSTALL(FILES systemd/nether.service DESTINATION ${SYSTEMD_UNIT_DIR}/multi-user.target.wants) diff --git a/conf/nether.policy b/conf/nether.policy new file mode 100644 index 0000000..5161dd3 --- /dev/null +++ b/conf/nether.policy @@ -0,0 +1,29 @@ +# +# Copyright (c) 2015 Samsung Electronics Co., Ltd All Rights Reserved +# +# Contact: Roman Kubiak (r.kubiak@samsung.com) +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License +# + +# +# Nether policy +# $UID:$GID:$SECCTX ALLOW|DENY|ALLOW_LOG +# If no match is found for a pcket +# the default verdict is used (can be set via +# command line) +# + +0::_:ALLOW +5002::_:DENY +1354787703::_:ALLOW diff --git a/conf/nether.rules b/conf/nether.rules new file mode 100644 index 0000000..b1ed24c --- /dev/null +++ b/conf/nether.rules @@ -0,0 +1,41 @@ +# +# Copyright (c) 2015 Samsung Electronics Co., Ltd All Rights Reserved +# +# Contact: Roman Kubiak (r.kubiak@samsung.com) +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License +# + +# nether iptables rules +*mangle +:PREROUTING ACCEPT [1008811:2134498122] +:INPUT ACCEPT [948545:2129919738] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [816152:74580343] +:POSTROUTING ACCEPT [824147:75308906] +-A OUTPUT -p tcp -j NFQUEUE --queue-num 0 --queue-bypass +-A OUTPUT -p udp -j NFQUEUE --queue-num 0 --queue-bypass +-A OUTPUT -p icmp -j NFQUEUE --queue-num 0 --queue-bypass +COMMIT +*filter +:INPUT ACCEPT [927054:2081201095] +:FORWARD ACCEPT [0:0] +:OUTPUT ACCEPT [805408:74228055] +:NETHER-ALLOWLOG - [0:0] +:NETHER-DENY - [0:0] +-A OUTPUT -m mark --mark 0x3 -j NETHER-DENY +-A OUTPUT -m mark --mark 0x4 -j NETHER-ALLOWLOG +-A NETHER-ALLOWLOG -j AUDIT --type accept +-A NETHER-DENY -j AUDIT --type reject +-A NETHER-DENY -j REJECT --reject-with icmp-port-unreachable +COMMIT diff --git a/conf/systemd/nether.service.in b/conf/systemd/nether.service.in new file mode 100644 index 0000000..2ccc4fc --- /dev/null +++ b/conf/systemd/nether.service.in @@ -0,0 +1,29 @@ +# +# Copyright (c) 2015 Samsung Electronics Co., Ltd All Rights Reserved +# +# Contact: Roman Kubiak (r.kubiak@samsung.com) +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License +# + +[Unit] +Description=nether service + +[Service] +Type=simple +ExecStart=${CMAKE_INSTALL_PREFIX}/bin/nether -d -l JOURNAL -B ${SYSCONF_INSTALL_DIR}/nether/nether.policy -r ${SYSCONF_INSTALL_DIR}/nether/nether.rules +Restart=on-failure +ExecReload=/bin/kill -HUP $MAINPID + +[Install] +WantedBy=multi-user.target diff --git a/config/nether.policy b/config/nether.policy deleted file mode 100644 index 324a7e3..0000000 --- a/config/nether.policy +++ /dev/null @@ -1,7 +0,0 @@ -# Nether policy -# $UID:$GID:$SECCTX ALLOW|DENY|ALLOW_LOG -# - -0::_:ALLOW -5002::_:DENY -1354787703::_:ALLOW \ No newline at end of file diff --git a/config/nether.rules b/config/nether.rules deleted file mode 100644 index 72d4ebe..0000000 --- a/config/nether.rules +++ /dev/null @@ -1,29 +0,0 @@ -# nether iptables rules -*nat -:PREROUTING ACCEPT [214977:18048203] -:INPUT ACCEPT [24506:3910785] -:OUTPUT ACCEPT [46836:3016993] -:POSTROUTING ACCEPT [45527:2930737] -COMMIT -*mangle -:PREROUTING ACCEPT [1008811:2134498122] -:INPUT ACCEPT [948545:2129919738] -:FORWARD ACCEPT [0:0] -:OUTPUT ACCEPT [816152:74580343] -:POSTROUTING ACCEPT [824147:75308906] --A OUTPUT -p tcp -m state --state NEW -m tcp --dport 443 -j NFQUEUE --queue-num 0 --queue-bypass --A OUTPUT -p udp -j NFQUEUE --queue-num 0 --queue-bypass --A OUTPUT -p icmp -j NFQUEUE --queue-num 0 --queue-bypass -COMMIT -*filter -:INPUT ACCEPT [927054:2081201095] -:FORWARD ACCEPT [0:0] -:OUTPUT ACCEPT [805408:74228055] -:NETHER-ALLOWLOG - [0:0] -:NETHER-DENY - [0:0] --A OUTPUT -m mark --mark 0x3 -j NETHER-DENY --A OUTPUT -m mark --mark 0x4 -j NETHER-ALLOWLOG --A NETHER-ALLOWLOG -j AUDIT --type accept --A NETHER-DENY -j AUDIT --type reject --A NETHER-DENY -j REJECT --reject-with icmp-port-unreachable -COMMIT diff --git a/config/setrules.sh b/config/setrules.sh deleted file mode 100644 index 9c2d168..0000000 --- a/config/setrules.sh +++ /dev/null @@ -1,85 +0,0 @@ -# -# Copyright (c) 2014 Samsung Electronics Co., Ltd All Rights Reserved -# -# Contact: Roman Kubiak (r.kubiak@samsung.com) -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License -# -#!/bin/bash -DENY_CHAIN="NETHER-DENY" -ALLOWLOG_CHAIN="NETHER-ALLOWLOG" -TEST_HOST="198.145.20.7" -TEST_PORT=443 -TEST_PROTO="tcp" -TEST_QUEUE=0 -AUDITCTL=auditctl -DENY_MARK="0x3" -ALLOWLOG_MARK="0x4" - -function runcmd { - echo -ne "\t>> $@\n" - $@ -} - -function clean { - echo "Cleanup" - echo - iptables -t mangle -D OUTPUT -m state --state NEW -p $TEST_PROTO -d $TEST_HOST --dport $TEST_PORT -j NFQUEUE --queue-num 0 --queue-bypass 2> /dev/null - iptables -D OUTPUT -m mark --mark $DENY_MARK -j $DENY_CHAIN 2> /dev/null - iptables -D OUTPUT -m mark --mark $ALLOWLOG_MARK -j $ALLOWLOG_CHAIN 2> /dev/null - iptables -F $DENY_CHAIN 2> /dev/null - iptables -F $ALLOWLOG_CHAIN 2> /dev/null - iptables -X $DENY_CHAIN 2> /dev/null - iptables -X $ALLOWLOG_CHAIN 2> /dev/null - echo -} - -function create { - echo "Creating chain" - echo - runcmd iptables -N $DENY_CHAIN - runcmd iptables -N $ALLOWLOG_CHAIN - runcmd iptables -A $DENY_CHAIN -j AUDIT --type REJECT - runcmd iptables -A $DENY_CHAIN -j REJECT - runcmd iptables -A $ALLOWLOG_CHAIN -j AUDIT --type ACCEPT - echo -} - -function create_rules { - echo "Writing rules to output chain $OUTPUT_CHAIN" - echo - runcmd iptables -t mangle -A OUTPUT -m state --state NEW -p $TEST_PROTO -d $TEST_HOST --dport $TEST_PORT -j NFQUEUE --queue-num 0 --queue-bypass - runcmd iptables -A OUTPUT -m mark --mark $DENY_MARK -j $DENY_CHAIN - runcmd iptables -A OUTPUT -m mark --mark $ALLOWLOG_MARK -j $ALLOWLOG_CHAIN - echo -} - -function enable_audit { - if type $AUDITCTL; then - echo -n "Enable audit: " - runcmd $AUDITCTL -e 1 >/dev/null - if [ $? == 0 ]; then - echo "OK" - else - echo "Failed" - fi - else - echo "$AUDITCTL does not exist, can't enable audit" - fi - echo -} - -clean -create -create_rules -enable_audit diff --git a/include/nether_CynaraBackend.h b/include/nether_CynaraBackend.h index a8bc88e..fc21d68 100644 --- a/include/nether_CynaraBackend.h +++ b/include/nether_CynaraBackend.h @@ -1,5 +1,5 @@ /* - * Copyright (c) 2014 Samsung Electronics Co., Ltd All Rights Reserved + * Copyright (c) 2015 Samsung Electronics Co., Ltd All Rights Reserved * * Contact: Roman Kubiak (r.kubiak@samsung.com) * @@ -25,7 +25,7 @@ #ifndef NETHER_CYNARA_BACKEND_H #define NETHER_CYNARA_BACKEND_H -// #ifdef HAVE_CYNARA +#ifdef HAVE_CYNARA #include #include "nether_PolicyBackend.h" @@ -70,5 +70,5 @@ class NetherCynaraBackend : public NetherPolicyBackend int cynaraLastResult; }; -// #endif -#endif +#endif // HAVE_CYNARA +#endif // NETHER_CYNARA_BACKEND_H diff --git a/include/nether_DummyBackend.h b/include/nether_DummyBackend.h index 438e0f7..8bbee85 100644 --- a/include/nether_DummyBackend.h +++ b/include/nether_DummyBackend.h @@ -1,3 +1,26 @@ +/* + * Copyright (c) 2015 Samsung Electronics Co., Ltd All Rights Reserved + * + * Contact: Roman Kubiak (r.kubiak@samsung.com) + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License + */ + +/** + * @file + * @author Roman Kubiak (r.kubiak@samsung.com) + * @brief Dummy policy backend + */ #ifndef NETHER_DUMMY_BACKEND_H #define NETHER_DUMMY_BACKEND_H diff --git a/include/nether_FileBackend.h b/include/nether_FileBackend.h index 213b87f..c3cd544 100644 --- a/include/nether_FileBackend.h +++ b/include/nether_FileBackend.h @@ -1,5 +1,5 @@ /* - * Copyright (c) 2014 Samsung Electronics Co., Ltd All Rights Reserved + * Copyright (c) 2015 Samsung Electronics Co., Ltd All Rights Reserved * * Contact: Roman Kubiak (r.kubiak@samsung.com) * diff --git a/include/nether_Manager.h b/include/nether_Manager.h index aa8630e..5407a63 100644 --- a/include/nether_Manager.h +++ b/include/nether_Manager.h @@ -1,5 +1,5 @@ /* - * Copyright (c) 2014 Samsung Electronics Co., Ltd All Rights Reserved + * Copyright (c) 2015 Samsung Electronics Co., Ltd All Rights Reserved * * Contact: Roman Kubiak (r.kubiak@samsung.com) * @@ -41,15 +41,24 @@ class NetherManager : public NetherVerdictListener, public NetherProcessedPacket static NetherPolicyBackend *getPolicyBackend(const NetherConfig &netherConfig, const bool primary = true); bool verdictCast (const u_int32_t packetId, const NetherVerdict verdict); void packetReceived (const NetherPacket &packet); + const bool restoreRules(); private: + static const bool isCommandAvailable(const std::string &command); void handleSignal(); const bool handleNetlinkpacket(); void setupSelectSockets(fd_set &watchedReadDescriptorsSet, fd_set &watchedWriteDescriptorsSet, struct timeval &timeoutSpecification); - std::unique_ptr netherPrimaryPolicyBackend, netherBackupPolicyBackend, netherFallbackPolicyBackend; + std::unique_ptr netherPrimaryPolicyBackend; + std::unique_ptr netherBackupPolicyBackend; + std::unique_ptr netherFallbackPolicyBackend; std::unique_ptr netherNetlink; NetherConfig netherConfig; - int netlinkDescriptor, backendDescriptor, signalDescriptor; + int netlinkDescriptor; + int backendDescriptor; + int signalDescriptor; +#ifdef HAVE_AUDIT + int auditDescriptor; +#endif // HAVE_AUDIT sigset_t signalMask; }; diff --git a/include/nether_Netlink.h b/include/nether_Netlink.h index eac959c..df852e9 100644 --- a/include/nether_Netlink.h +++ b/include/nether_Netlink.h @@ -1,5 +1,5 @@ /* - * Copyright (c) 2014 Samsung Electronics Co., Ltd All Rights Reserved + * Copyright (c) 2015 Samsung Electronics Co., Ltd All Rights Reserved * * Contact: Roman Kubiak (r.kubiak@samsung.com) * diff --git a/include/nether_PolicyBackend.h b/include/nether_PolicyBackend.h index 222780c..dc9ecd6 100644 --- a/include/nether_PolicyBackend.h +++ b/include/nether_PolicyBackend.h @@ -1,5 +1,5 @@ /* - * Copyright (c) 2014 Samsung Electronics Co., Ltd All Rights Reserved + * Copyright (c) 2015 Samsung Electronics Co., Ltd All Rights Reserved * * Contact: Roman Kubiak (r.kubiak@samsung.com) * diff --git a/include/nether_Types.h b/include/nether_Types.h index e3ce8c0..1e67a0b 100644 --- a/include/nether_Types.h +++ b/include/nether_Types.h @@ -1,5 +1,5 @@ /* - * Copyright (c) 2014 Samsung Electronics Co., Ltd All Rights Reserved + * Copyright (c) 2015 Samsung Electronics Co., Ltd All Rights Reserved * * Contact: Roman Kubiak (r.kubiak@samsung.com) * @@ -34,6 +34,8 @@ #include #include +#include +#include #include #include #include @@ -44,19 +46,28 @@ #include #include #include + +#if defined(HAVE_AUDIT) + #include +#endif // HAVE_AUDIT + #include #include "logger/logger.hpp" #include "logger/backend-file.hpp" #include "logger/backend-stderr.hpp" #include "logger/backend-syslog.hpp" -#ifdef HAVE_CYNARA +#if defined(HAVE_SYSTEMD_JOURNAL) + #include "logger/backend-journal.hpp" +#endif // HAVE_SYSTEMD_JOURNAL + +#if defined(HAVE_CYNARA) #define NETHER_PRIMARY_BACKEND cynaraBackend #define NETHER_BACKUP_BACKEND fileBackend #else #define NETHER_PRIMARY_BACKEND fileBackend #define NETHER_BACKUP_BACKEND dummyBackend -#endif +#endif // HAVE_CYNARA #define NETHER_DEFAULT_VERDICT allowAndLog #define NETHER_PACKET_BUFFER_SIZE 4096 @@ -69,6 +80,14 @@ #define NETLINK_DROP_MARK 3 #define NETLINK_ALLOWLOG_MARK 4 #define NETHER_LOG_BACKEND stderrBackend +#define NETHER_IPTABLES_RESTORE_PATH "/usr/sbin/iptables-restore" +#ifndef NETHER_RULES_PATH + #define NETHER_RULES_PATH "/etc/nether/nether.rules" +#endif // NETHER_RULES_PATH + +#ifndef NETHER_POLICY_FILE + #define NETHER_POLICY_FILE "/etc/nether/nether.policy" +#endif // NETHER_POLICY_FILE enum NetherPolicyBackendType { @@ -143,13 +162,17 @@ struct NetherConfig int primaryBackendRetries = 3; int backupBackendRetries = 3; int debugMode = 0; - int nodaemonMode = 0; + int daemonMode = 0; int queueNumber = 0; - std::string backupBackendArgs; + std::string backupBackendArgs = NETHER_POLICY_FILE; std::string primaryBackendArgs; std::string logBackendArgs; + std::string rulesPath = NETHER_RULES_PATH; + std::string iptablesRestorePath = NETHER_IPTABLES_RESTORE_PATH; uint8_t markDeny = NETLINK_DROP_MARK; uint8_t markAllowAndLog = NETLINK_ALLOWLOG_MARK; + int enableAudit = 0; + int noRules = 0; }; class NetherVerdictListener diff --git a/include/nether_Utils.h b/include/nether_Utils.h index 90505a4..8fe6e28 100644 --- a/include/nether_Utils.h +++ b/include/nether_Utils.h @@ -1,5 +1,5 @@ /* - * Copyright (c) 2014 Samsung Electronics Co., Ltd All Rights Reserved + * Copyright (c) 2015 Samsung Electronics Co., Ltd All Rights Reserved * * Contact: Roman Kubiak (r.kubiak@samsung.com) * diff --git a/nether.cbp b/nether.cbp index 5ee498d..c53b6fc 100644 --- a/nether.cbp +++ b/nether.cbp @@ -20,7 +20,7 @@