Appreciated hints about expected exact firewall-offline-cmd --direct --add-rule / --query-rule syntax (mainly about the priority field) or corresponding richlanguage syntax

Jan Lieskovsky jlieskov at redhat.com
Wed Aug 27 10:39:51 UTC 2014


Hello folks,

  I participate on developing SCAP content:
    [1] http://scap.nist.gov/

  within the SCAP Security Guide project:
    [2] https://fedorahosted.org/scap-security-guide/

Within that [2] project we develop security compliance guidance for Red Hat
products (content for RHEL-6, RHEL-7, Fedora already exist, content for products
like OpenStack, RHEVM3, JBossEAP5 needs care yet).

Within the process of identification, which parts of existing RHEL-6 content
would require modification when trying to port it to RHEL-7 we identified firewalld
as one of the components, that might require our attention.

FWIW regarding firewall configuration the system administrators situation slightly
changed when considering RHEL-6 and RHEL-7. For the very least, in RHEL-6 there was
system-config-firewall tool, which in RHEL-7 the firewall can be managed in two ways
(when not counting direct iptables command usage):
* via system-config-firewall or
* via firewalld.

  From the very introductory article:
    [3] http://www.oracle-base.com/articles/linux/linux-firewall-firewalld.php

each of these (system-config-firewall & firewalld) constitute different approaches
to the system's firewall administration / management. Starting from differing
config files (/etc/sysconfig/iptables, /etc/sysconfig/ip6tables for s-c-f vs
the XML format based configuration files in /usr/lib/firewalld/services -- the
services XML templates, and actually honoured configuration present in 
/etc/firewalld/services), through the concept of zones, firewalld introduced a
different view at system's firewall administration / management.

  Consider the use case:
  -----------------------

 What we have now are iptables rules defined in the form acceptable / generated
by s-c-f (for RHEL-6). But when checking RHEL-7 system to be security compliant
wrt to firewall settings we will also need to check the newly added config location
(/etc/firewalld/services) if it contains the corresponding rules expressed in the
form as accepted / expected by firewalld.

  Have searched the firewalld manual pages deeper and noticed firewalld package
provides firewall-offline-cmd for cases like this (when the firewalld service isn't
running) to migrate older s-c-f rules to newer firewalld syntax.

  Actually moved yet further, and tried firewall-offline-cmd --direct --add-rule
case.

  Suppose the old rule (from /etc/sysconfig/iptables for IPv4) has the form of
  (for simplicity):
  
    -A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT

  then the corresponding firewall-offline-cmd command syntax that came out from
reading of the manual pages for me is as follows:

   # firewall-offline-cmd --direct --add-rule ipv4 filter INPUT 0 -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT

Execution of this command succeeded & appropriate /etc/firewalld/direct.xml entry
was created.

Wanted to ask regarding the priority parameter ("0" in the above example) -- is it
a way how to specify "order / place" into which the rule would be added into the
XML file? IOW using 0 again second time would mean the second rule would be inserted
before the already existing rule (e.g. the behaviour of -I iptables option) or when
using priority 1 it would be appended instead at the end of the filter table & INPUT
chain of it (e.g. the behaviour would correspond to -A iptables option)?

Another question being -- also noticed firewalld provides concept of "richlanguage"
which allows (at least from what I got) the administrator to define the rules in
the iptables-like syntax. Since it's not mentioned in the manual page, does richlanguage
support concept of "match extensions", e.g. for example:

  -m iprange | -m limit | -m state | -m time | -m account ..

as known / supported by iptables? If yes, what would be the syntax to formulate these
in the richlanguage syntax? To mention some examples, suppose the following two
rules:

  iptables -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/s --limit-burst 10 -j ACCEPT
  iptables -A INPUT -p tcp --dport 50:55 -m iprange --dst-range 192.168.0.1-192.168.0.10 -j ACCEPT

Is there a way how to express them via firewalld's richlanguage constructs or would
the usage of firewall-offline-cmd --direct --add-rule be necessary?

Is it possible to commonly express what kind of former iptables rules are possible
to express via richlanguage & what kind of rules require use of firewall-offline-cmd
tool?

Thank you in advance for your time & reply.

Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Technologies Team


More information about the firewalld-users mailing list