
#-----------------------------------------------------------------------
# Copyright (C) 2000-2001, Jean-Sebastien Morisset <jsmoriss@mvlan.net>
#-----------------------------------------------------------------------
# $Id: private_net_chains.sh,v 1.2 2001/08/11 17:01:20 jsmoriss Exp $
#-----------------------------------------------------------------------
#  $RCSfile: private_net_chains.sh,v $
#   $Author: jsmoriss $
# $Revision: 1.2 $
#     $Date: 2001/08/11 17:01:20 $
#   $Locker:  $ 
#     $Name:  $
#-----------------------------------------------------------------------
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by 
# the Free Software Foundation <http://www.gnu.org/copyleft/gpl.txt>.
# 
# This program is distributed in the hope that it will be useful, but
# WITHOUT ANY WARRANTY; without even the implied warranty of 
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
# General Public License (LICENSE file in archive) for more details.
#
#-----------------------------------------------------------------------
# README
#-----------------------------------------------------------------------
#
# A bourne shell function used by rcf; a very secure, fast, and complete
# firewall for linux <http://jsmoriss.mvlan.net/linux/rcf.html>.
#
# This function defines a special in/output chains to block private
# networks addresses on public interfaces. All packets on public 
# interfaces will jump to these chains AFTER DHCP clients and BEFORE
# any service use the "any/0" wildcard.
#
#-----------------------------------------------------------------------
# FUNCTION
#-----------------------------------------------------------------------

Is_Private_Subnet () {
	[ "`Address_Octet $1 1`" = "`Address_Octet $CLASS_A_PRIVATE 1`" ] && echo "A"
	[ "`Address_Octet $1 1`" = "`Address_Octet $CLASS_B_PRIVATE 1`" -a \
	  "$((`Address_Octet $1 2` & 240))" = "`Address_Octet $CLASS_B_PRIVATE 2`" ] && echo "B"
	[ "`Address_Octet $1 1`" = "`Address_Octet $CLASS_C_PRIVATE 1`" -a \
	  "`Address_Octet $1 2`" = "`Address_Octet $CLASS_C_PRIVATE 2`" ] && echo "C"
	unset subnet
}

Private_Net_Chains () {

	if [ "$PUBLIC_INTERFACES" -o "$DMZ_INTERFACES" ]
	then
		echo "Creating prii/prio Chains and Adding Deny/Reject Rules"

		if [ ! "$REFRESH_INTERFACES" ]
		then
			ipchains -N prii
			ipchains -N prio
		else
			ipchains -F prii
			ipchains -F prio
		fi

		# Allow packets from private interfaces with source addresses
		# in those networks connected to the interface.

		for private_interface in $PRIVATE_INTERFACES $MZ_INTERFACES
		do
			echo "  Accept Private Networks from $private_interface $LOG_MSG"
			for private_network in `{
					Get_Interface_Vars "$private_interface" "PRIVATE"
					Device_Subnets PRIVATE
				} | sort | Sed_Uniq`
			do
				if [ "`Is_Private_Subnet $private_network`" ]
				then
					ipchains -A prii -j RETURN -i $private_interface -s $private_network $LOG
				fi
			done
		done
		unset private_interface private_networks

		echo "Deny/Reject Private Networks (logged)"

		ipchains -A prii -j DENY   -s $CLASS_A_PRIVATE -l
		ipchains -A prii -j DENY   -d $CLASS_A_PRIVATE -l
		ipchains -A prio -j REJECT -s $CLASS_A_PRIVATE -l
		ipchains -A prio -j REJECT -d $CLASS_A_PRIVATE -l

		ipchains -A prii -j DENY   -s $CLASS_B_PRIVATE -l
		ipchains -A prii -j DENY   -d $CLASS_B_PRIVATE -l
		ipchains -A prio -j REJECT -s $CLASS_B_PRIVATE -l
		ipchains -A prio -j REJECT -d $CLASS_B_PRIVATE -l

		ipchains -A prii -j DENY   -s $CLASS_C_PRIVATE -l
		ipchains -A prii -j DENY   -d $CLASS_C_PRIVATE -l
		ipchains -A prio -j REJECT -s $CLASS_C_PRIVATE -l
		ipchains -A prio -j REJECT -d $CLASS_C_PRIVATE -l

		ipchains -A prii -j DENY   -s $CLASS_E_RESERVED_NET -l

		# If the end of a user-defined chain is reached, or a rule
		# with target RETURN is matched, then the next rule in the
		# previous (calling) chain is examined.  
		#
		# If the end of a builtin chain is reached, or a rule  
		# in a builtin chain with target RETURN is matched, 
		# the target specified by the chain policy determines
		# the fate of the packet.

		##ipchains -A prii -j RETURN $LOG
		##ipchains -A prio -j RETURN $LOG

	fi
}

