From d61ac72d49282daa1136aebddab13ff2ce62e681 Mon Sep 17 00:00:00 2001 From: nser77 <104022475+nser77@users.noreply.github.com> Date: Mon, 14 Oct 2024 11:13:39 +0200 Subject: [PATCH 1/4] Update tests_firewalls --- include/tests_firewalls | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/include/tests_firewalls b/include/tests_firewalls index f55f74e3..be8bb083 100644 --- a/include/tests_firewalls +++ b/include/tests_firewalls @@ -114,7 +114,7 @@ do ${IPTABLESBINARY} -t "${t}" -S -w 1 2>/dev/zero | { - while IFS="\n" read -r line + while IFS="$(printf '\n')" read -r line do set -- ${line} while [ $# -gt 0 ] @@ -163,7 +163,7 @@ done # resume if [ ! "${SORTBINARY}" = "" ]; then eq="$( echo "${errqueue}" | ${SORTBINARY} -u )"; else eq="${errqueue}"; fi - echo "${eq}" | while IFS="\n" read -r eql + echo "${eq}" | while IFS="$(printf '\n')" read -r eql do if [ ! "$eql" = "" ] then From 06b220e503d23375a142376dee95fefa0ce270b7 Mon Sep 17 00:00:00 2001 From: nser77 <104022475+nser77@users.noreply.github.com> Date: Mon, 14 Oct 2024 12:10:58 +0200 Subject: [PATCH 2/4] Update tests_firewalls --- include/tests_firewalls | 49 +++++++++++++++++++++++------------------ 1 file changed, 27 insertions(+), 22 deletions(-) diff --git a/include/tests_firewalls b/include/tests_firewalls index be8bb083..831c19b2 100644 --- a/include/tests_firewalls +++ b/include/tests_firewalls @@ -109,65 +109,70 @@ Register --test-no FIRE-4508 --preqs-met ${PREQS_MET} --os Linux --weight L --network NO --root-only YES --category security --description "Check used policies of iptables chains" if [ ${SKIPTEST} -eq 0 ]; then Display --indent 4 --text "- Checking iptables policies of chains" --result "${STATUS_FOUND}" --color GREEN - tables="filter nat mangle raw security" - for t in ${tables} + IPTABLES_TABLES="filter nat mangle raw security" + for IPTABLES_TABLE in ${IPTABLES_TABLES} do - ${IPTABLESBINARY} -t "${t}" -S -w 1 2>/dev/zero | + ${IPTABLESBINARY} -t "${IPTABLES_TABLE}" --list-rules --wait 1 2>/dev/zero | { - while IFS="$(printf '\n')" read -r line + while IFS="$(printf '\n')" read -r IPTABLES_OUTPUT_LINE do - set -- ${line} + set -- ${IPTABLES_OUTPUT_LINE} while [ $# -gt 0 ] do if [ "${1}" = "-P" ] then - c="${2}" - j="${3}" + IPTABLES_CHAIN="${2}" + IPTABLES_TARGET="${3}" shift 3 elif [ "${1}" = "-A" ] || [ "${1}" = "-N" ] then - c="${2}" + IPTABLES_CHAIN="${2}" shift 2 elif [ "${1}" = "-j" ] then - j="${2}" + IPTABLES_TARGET="${2}" shift else shift fi done # logics - if [ "${t}" = "filter" ] || [ "${t}" = "security" ] + if [ "${IPTABLES_TABLE}" = "filter" ] || [ "${IPTABLES_TABLE}" = "security" ] then - if [ "${c}" = "INPUT" ] + if [ "${IPTABLES_CHAIN}" = "INPUT" ] then - if [ "${j}" = "ACCEPT" ] + if [ "${IPTABLES_TARGET}" = "ACCEPT" ] then - errqueue="${errqueue}\n${t} ${c} ${j} YELLOW" + IPTABLES_OUTPUT_QUEUE="${IPTABLES_OUTPUT_QUEUE}\n${IPTABLES_TABLE} ${IPTABLES_CHAIN} ${IPTABLES_TARGET} YELLOW" AddHP 1 3 - elif [ "${j}" = "DROP" ] + elif [ "${IPTABLES_TARGET}" = "DROP" ] then - errqueue="${errqueue}\n${t} ${c} ${j} GREEN" + IPTABLES_OUTPUT_QUEUE="${IPTABLES_OUTPUT_QUEUE}\n${IPTABLES_TABLE} ${IPTABLES_CHAIN} ${IPTABLES_TARGET} GREEN" AddHP 3 3 fi fi - if [ "${c}" = "INPUT" ] || [ "${c}" = "FORWARD" ] || [ "${c}" = "OUTPUT" ] + if [ "${IPTABLES_CHAIN}" = "INPUT" ] || [ "${IPTABLES_CHAIN}" = "FORWARD" ] || [ "${IPTABLES_CHAIN}" = "OUTPUT" ] then - if [ "${j}" = "NFQUEUE" ] + if [ "${IPTABLES_TARGET}" = "NFQUEUE" ] then - errqueue="${errqueue}\n${t} ${c} ${j} RED" + IPTABLES_OUTPUT_QUEUE="${IPTABLES_OUTPUT_QUEUE}\n${IPTABLES_TABLE} ${IPTABLES_CHAIN} ${IPTABLES_TARGET} RED" AddHP 0 3 fi fi fi done # resume - if [ ! "${SORTBINARY}" = "" ]; then eq="$( echo "${errqueue}" | ${SORTBINARY} -u )"; else eq="${errqueue}"; fi - echo "${eq}" | while IFS="$(printf '\n')" read -r eql + if [ ! "${SORTBINARY}" = "" ] + then + IPTABLES_OUTPUT="$( echo "${IPTABLES_OUTPUT_QUEUE}" | ${SORTBINARY} -u )" + else + IPTABLES_OUTPUT="${IPTABLES_OUTPUT_QUEUE}" + fi + echo "${IPTABLES_OUTPUT}" | while IFS="$(printf '\n')" read -r IPTABLES_OUTPUT_LINE do - if [ ! "$eql" = "" ] + if [ ! "$IPTABLES_OUTPUT_LINE" = "" ] then - set -- ${eql} + set -- ${IPTABLES_OUTPUT_LINE} while [ $# -gt 0 ] do Display --indent 6 --text "- Checking chain ${2} (table: ${1}, target: ${3})" --result "${3}" --color "${4}" From ade45301a81e2b1e39198d0c90283131274c2a10 Mon Sep 17 00:00:00 2001 From: nser77 <104022475+nser77@users.noreply.github.com> Date: Mon, 14 Oct 2024 15:58:14 +0200 Subject: [PATCH 3/4] Update tests_firewalls --- include/tests_firewalls | 40 +++++++++++++++++++++++----------------- 1 file changed, 23 insertions(+), 17 deletions(-) diff --git a/include/tests_firewalls b/include/tests_firewalls index 831c19b2..223fe63d 100644 --- a/include/tests_firewalls +++ b/include/tests_firewalls @@ -114,9 +114,9 @@ do ${IPTABLESBINARY} -t "${IPTABLES_TABLE}" --list-rules --wait 1 2>/dev/zero | { - while IFS="$(printf '\n')" read -r IPTABLES_OUTPUT_LINE + while IFS="$(printf '\n')" read -r IPTABLES_LINES do - set -- ${IPTABLES_OUTPUT_LINE} + set -- ${IPTABLES_LINES} while [ $# -gt 0 ] do if [ "${1}" = "-P" ] @@ -137,26 +137,29 @@ fi done # logics - if [ "${IPTABLES_TABLE}" = "filter" ] || [ "${IPTABLES_TABLE}" = "security" ] + if [ ! "${IPTABLES_TABLE}" = "" ] && [ ! "${IPTABLES_CHAIN}" = "" ] && [ ! "${IPTABLES_TARGET}" = "" ] then - if [ "${IPTABLES_CHAIN}" = "INPUT" ] + if [ "${IPTABLES_TABLE}" = "filter" ] || [ "${IPTABLES_TABLE}" = "security" ] then - if [ "${IPTABLES_TARGET}" = "ACCEPT" ] + if [ "${IPTABLES_CHAIN}" = "INPUT" ] then - IPTABLES_OUTPUT_QUEUE="${IPTABLES_OUTPUT_QUEUE}\n${IPTABLES_TABLE} ${IPTABLES_CHAIN} ${IPTABLES_TARGET} YELLOW" - AddHP 1 3 - elif [ "${IPTABLES_TARGET}" = "DROP" ] - then - IPTABLES_OUTPUT_QUEUE="${IPTABLES_OUTPUT_QUEUE}\n${IPTABLES_TABLE} ${IPTABLES_CHAIN} ${IPTABLES_TARGET} GREEN" - AddHP 3 3 + if [ "${IPTABLES_TARGET}" = "ACCEPT" ] + then + IPTABLES_OUTPUT_QUEUE="${IPTABLES_OUTPUT_QUEUE}\n${IPTABLES_TABLE} ${IPTABLES_CHAIN} ${IPTABLES_TARGET} YELLOW" + AddHP 1 3 + elif [ "${IPTABLES_TARGET}" = "DROP" ] + then + IPTABLES_OUTPUT_QUEUE="${IPTABLES_OUTPUT_QUEUE}\n${IPTABLES_TABLE} ${IPTABLES_CHAIN} ${IPTABLES_TARGET} GREEN" + AddHP 3 3 + fi fi - fi - if [ "${IPTABLES_CHAIN}" = "INPUT" ] || [ "${IPTABLES_CHAIN}" = "FORWARD" ] || [ "${IPTABLES_CHAIN}" = "OUTPUT" ] - then - if [ "${IPTABLES_TARGET}" = "NFQUEUE" ] + if [ "${IPTABLES_CHAIN}" = "INPUT" ] || [ "${IPTABLES_CHAIN}" = "FORWARD" ] || [ "${IPTABLES_CHAIN}" = "OUTPUT" ] then - IPTABLES_OUTPUT_QUEUE="${IPTABLES_OUTPUT_QUEUE}\n${IPTABLES_TABLE} ${IPTABLES_CHAIN} ${IPTABLES_TARGET} RED" - AddHP 0 3 + if [ "${IPTABLES_TARGET}" = "NFQUEUE" ] + then + IPTABLES_OUTPUT_QUEUE="${IPTABLES_OUTPUT_QUEUE}\n${IPTABLES_TABLE} ${IPTABLES_CHAIN} ${IPTABLES_TARGET} RED" + AddHP 0 3 + fi fi fi fi @@ -185,8 +188,11 @@ fi done } + unset IPTABLES_TABLE done + unset IPTABLES_TABLES fi + unset PREQS_MET # ################################################################################# # From 7bdcd56f631cdcf9f1d0bd52d8b9e88ec08b9043 Mon Sep 17 00:00:00 2001 From: nser77 <104022475+nser77@users.noreply.github.com> Date: Mon, 14 Oct 2024 16:05:33 +0200 Subject: [PATCH 4/4] Update tests_firewalls --- include/tests_firewalls | 33 +++++++++++++++------------------ 1 file changed, 15 insertions(+), 18 deletions(-) diff --git a/include/tests_firewalls b/include/tests_firewalls index 223fe63d..fb8a731c 100644 --- a/include/tests_firewalls +++ b/include/tests_firewalls @@ -137,29 +137,26 @@ fi done # logics - if [ ! "${IPTABLES_TABLE}" = "" ] && [ ! "${IPTABLES_CHAIN}" = "" ] && [ ! "${IPTABLES_TARGET}" = "" ] + if [ "${IPTABLES_TABLE}" = "filter" ] || [ "${IPTABLES_TABLE}" = "security" ] then - if [ "${IPTABLES_TABLE}" = "filter" ] || [ "${IPTABLES_TABLE}" = "security" ] + if [ "${IPTABLES_CHAIN}" = "INPUT" ] then - if [ "${IPTABLES_CHAIN}" = "INPUT" ] + if [ "${IPTABLES_TARGET}" = "ACCEPT" ] then - if [ "${IPTABLES_TARGET}" = "ACCEPT" ] - then - IPTABLES_OUTPUT_QUEUE="${IPTABLES_OUTPUT_QUEUE}\n${IPTABLES_TABLE} ${IPTABLES_CHAIN} ${IPTABLES_TARGET} YELLOW" - AddHP 1 3 - elif [ "${IPTABLES_TARGET}" = "DROP" ] - then - IPTABLES_OUTPUT_QUEUE="${IPTABLES_OUTPUT_QUEUE}\n${IPTABLES_TABLE} ${IPTABLES_CHAIN} ${IPTABLES_TARGET} GREEN" - AddHP 3 3 - fi + IPTABLES_OUTPUT_QUEUE="${IPTABLES_OUTPUT_QUEUE}\n${IPTABLES_TABLE} ${IPTABLES_CHAIN} ${IPTABLES_TARGET} YELLOW" + AddHP 1 3 + elif [ "${IPTABLES_TARGET}" = "DROP" ] + then + IPTABLES_OUTPUT_QUEUE="${IPTABLES_OUTPUT_QUEUE}\n${IPTABLES_TABLE} ${IPTABLES_CHAIN} ${IPTABLES_TARGET} GREEN" + AddHP 3 3 fi - if [ "${IPTABLES_CHAIN}" = "INPUT" ] || [ "${IPTABLES_CHAIN}" = "FORWARD" ] || [ "${IPTABLES_CHAIN}" = "OUTPUT" ] + fi + if [ "${IPTABLES_CHAIN}" = "INPUT" ] || [ "${IPTABLES_CHAIN}" = "FORWARD" ] || [ "${IPTABLES_CHAIN}" = "OUTPUT" ] + then + if [ "${IPTABLES_TARGET}" = "NFQUEUE" ] then - if [ "${IPTABLES_TARGET}" = "NFQUEUE" ] - then - IPTABLES_OUTPUT_QUEUE="${IPTABLES_OUTPUT_QUEUE}\n${IPTABLES_TABLE} ${IPTABLES_CHAIN} ${IPTABLES_TARGET} RED" - AddHP 0 3 - fi + IPTABLES_OUTPUT_QUEUE="${IPTABLES_OUTPUT_QUEUE}\n${IPTABLES_TABLE} ${IPTABLES_CHAIN} ${IPTABLES_TARGET} RED" + AddHP 0 3 fi fi fi