verzia 2.105, 2015/10/19 14:00:33 |
verzia 2.107, 2016/02/26 02:53:42 |
|
|
# Licensed under terms of GNU General Public License. |
# Licensed under terms of GNU General Public License. |
# All rights reserved. |
# All rights reserved. |
# |
# |
# $Platon: scripts/shell/firewall/fw-universal.sh,v 2.104 2015/10/12 22:41:24 rajo Exp $ |
# $Platon: scripts/shell/firewall/fw-universal.sh,v 2.106 2016/01/17 15:03:29 rajo Exp $ |
# |
# |
# Changelog: |
# Changelog: |
# 2003-10-24 - created |
# 2003-10-24 - created |
Riadok 39 DEFAULT_FIREWALL_CONFIG="${DEFAULT_FIREW |
|
Riadok 39 DEFAULT_FIREWALL_CONFIG="${DEFAULT_FIREW |
|
DEFAULT_FIREWALL_CONFIG_DIR="${DEFAULT_FIREWALL_CONFIG_DIR:=/etc/default/firewall.d}" |
DEFAULT_FIREWALL_CONFIG_DIR="${DEFAULT_FIREWALL_CONFIG_DIR:=/etc/default/firewall.d}" |
DEFAULT_CACHE_DIR="${DEFAULT_CACHE_DIR:=/var/cache/firewall}" |
DEFAULT_CACHE_DIR="${DEFAULT_CACHE_DIR:=/var/cache/firewall}" |
|
|
|
DIST_FIREWALL_CONFIG_DIR="${DIST_FIREWALL_CONFIG_DIR:=/etc/firewall/firewall.d}" |
|
|
# quiet output? {{{ |
# quiet output? {{{ |
if [ "x$1" = "xblock" ] || [ "x$QUIET" = "xyes" ]; then |
if [ "x$1" = "xblock" ] || [ "x$QUIET" = "xyes" ]; then |
print_info() |
print_info() |
Riadok 910 reject_input() |
|
Riadok 912 reject_input() |
|
allow_input() |
allow_input() |
{ # {{{ |
{ # {{{ |
if [ ! -z "$ALL_ACCEPT_INPUT_TCP" ]; then |
if [ ! -z "$ALL_ACCEPT_INPUT_TCP" ]; then |
print_info -en "Accepting ALL INPUT TCP connections on ports:" |
print_info -e "Accepting ALL INPUT TCP connections on ports:" |
for port in $ALL_ACCEPT_INPUT_TCP; do |
for port in $ALL_ACCEPT_INPUT_TCP; do |
src_ip="" |
src_ip="" |
eval `echo $port | awk -v FS=: '/:/ { printf "src_ip=\"%s\"; port=\"%s\";", $1, $2; }'` |
eval `echo $port | awk -v FS=: '/:/ { printf "src_ip=\"%s\"; port=\"%s\";", $1, $2; }'` |
|
|
fi |
fi |
for iface in $INTERFACES; do |
for iface in $INTERFACES; do |
riface="IFname_$iface"; |
riface="IFname_$iface"; |
|
if [ "$last_port" != "$port" -a -n "$src_ip" ]; then counter=0; print_info ""; fi |
print_info -en " $port($iface)"`[ ! -z "$src_ip" ] && echo "[$src_ip]"` |
print_info -en " $port($iface)"`[ ! -z "$src_ip" ] && echo "[$src_ip]"` |
|
if [ $(( ++counter )) -ge 5 ]; then counter=0; print_info ""; fi; |
|
last_port="$port"; |
IPS="IP_$iface"; |
IPS="IP_$iface"; |
for ip in ${!IPS}; do |
for ip in ${!IPS}; do |
if [ -z "$src_ip" ]; then |
if [ -z "$src_ip" ]; then |
|
|
print_info " done." |
print_info " done." |
fi |
fi |
if [ ! -z "$ALL_ACCEPT_INPUT_UDP" ]; then |
if [ ! -z "$ALL_ACCEPT_INPUT_UDP" ]; then |
print_info -en "Accepting ALL INPUT UDP connections on ports:" |
print_info -e "Accepting ALL INPUT UDP connections on ports:" |
for port in $ALL_ACCEPT_INPUT_UDP; do |
for port in $ALL_ACCEPT_INPUT_UDP; do |
src_ip="" |
src_ip="" |
eval `echo $port | awk -v FS=: '/:/ { printf "src_ip=\"%s\"; port=\"%s\";", $1, $2; }'` |
eval `echo $port | awk -v FS=: '/:/ { printf "src_ip=\"%s\"; port=\"%s\";", $1, $2; }'` |
|
|
fi |
fi |
for iface in $INTERFACES; do |
for iface in $INTERFACES; do |
riface="IFname_$iface"; |
riface="IFname_$iface"; |
|
if [ "$last_port" != "$port" -a -n "$src_ip" ]; then counter=0; print_info ""; fi |
print_info -en " $port($iface)"`[ ! -z "$src_ip" ] && echo "[$src_ip]"` |
print_info -en " $port($iface)"`[ ! -z "$src_ip" ] && echo "[$src_ip]"` |
|
if [ $(( ++counter )) -ge 5 ]; then counter=0; print_info ""; fi; |
|
last_port="$port"; |
IPS="IP_$iface"; |
IPS="IP_$iface"; |
if [ "x$port" = "x67" ]; then # DHCP requests doesn't have destination IP specified |
if [ "x$port" = "x67" ]; then # DHCP requests doesn't have destination IP specified |
$IPTABLES -A INPUT -i ${!riface} -p UDP --dport $port -j ACCEPT |
$IPTABLES -A INPUT -i ${!riface} -p UDP --dport $port -j ACCEPT |
|
|
fi |
fi |
|
|
if [ ! -z "$REAL_ACCEPT_INPUT_TCP" ]; then |
if [ ! -z "$REAL_ACCEPT_INPUT_TCP" ]; then |
print_info -en "Accepting REAL all INPUT TCP connections for ALL interfaces on ports:" |
print_info -e "Accepting REAL all INPUT TCP connections for ALL interfaces on ports:" |
for port in $REAL_ACCEPT_INPUT_TCP; do |
for port in $REAL_ACCEPT_INPUT_TCP; do |
src_ip="" |
src_ip="" |
eval `echo $port | awk -v FS=: '/:/ { printf "src_ip=\"%s\"; port=\"%s\";", $1, $2; }'` |
eval `echo $port | awk -v FS=: '/:/ { printf "src_ip=\"%s\"; port=\"%s\";", $1, $2; }'` |
|
if [ "$last_port" != "$port" -a -n "$src_ip" ]; then counter=0; print_info ""; fi |
print_info -en " $port(ALL)"`[ ! -z "$src_ip" ] && echo "[$src_ip]"` |
print_info -en " $port(ALL)"`[ ! -z "$src_ip" ] && echo "[$src_ip]"` |
|
if [ $(( ++counter )) -ge 5 ]; then counter=0; print_info ""; fi; |
|
last_port="$port"; |
echo $port | grep -q , |
echo $port | grep -q , |
multiport="$?"; |
multiport="$?"; |
if [ "$multiport" -eq 0 ]; then |
if [ "$multiport" -eq 0 ]; then |
|
Riadok 1001 allow_input() |
|
print_info " done." |
print_info " done." |
fi |
fi |
if [ ! -z "$REAL_ACCEPT_INPUT_UDP" ]; then |
if [ ! -z "$REAL_ACCEPT_INPUT_UDP" ]; then |
print_info -en "Accepting REAL all INPUT UDP connections for ALL interfaces on ports:" |
print_info -e "Accepting REAL all INPUT UDP connections for ALL interfaces on ports:" |
for port in $REAL_ACCEPT_INPUT_UDP; do |
for port in $REAL_ACCEPT_INPUT_UDP; do |
src_ip="" |
src_ip="" |
eval `echo $port | awk -v FS=: '/:/ { printf "src_ip=\"%s\"; port=\"%s\";", $1, $2; }'` |
eval `echo $port | awk -v FS=: '/:/ { printf "src_ip=\"%s\"; port=\"%s\";", $1, $2; }'` |
|
if [ "$last_port" != "$port" -a -n "$src_ip" ]; then counter=0; print_info ""; fi |
print_info -en " $port(ALL)"`[ ! -z "$src_ip" ] && echo "[$src_ip]"` |
print_info -en " $port(ALL)"`[ ! -z "$src_ip" ] && echo "[$src_ip]"` |
|
if [ $(( ++counter )) -ge 5 ]; then counter=0; print_info ""; fi; |
|
last_port="$port"; |
echo $port | grep -q , |
echo $port | grep -q , |
multiport="$?"; |
multiport="$?"; |
if [ "$multiport" -eq 0 ]; then |
if [ "$multiport" -eq 0 ]; then |
Riadok 1122 allow_input() |
|
Riadok 1136 allow_input() |
|
|
|
# ACCEPT {{{ |
# ACCEPT {{{ |
if [ ! -z "$ACCEPT_INPUT_TCP" ]; then |
if [ ! -z "$ACCEPT_INPUT_TCP" ]; then |
print_info -en "$iface: Accepting INPUT TCP connections on ports:" |
print_info -e "$iface: Accepting INPUT TCP connections on ports:" |
counter=0; |
counter=0; |
for port in $ACCEPT_INPUT_TCP; do |
for port in $ACCEPT_INPUT_TCP; do |
src_ip="" |
src_ip="" |
Riadok 1130 allow_input() |
|
Riadok 1144 allow_input() |
|
if [ -n "$src_ip" -a "$port" = "0" ]; then |
if [ -n "$src_ip" -a "$port" = "0" ]; then |
port="ALL"; |
port="ALL"; |
fi |
fi |
|
if [ "$last_port" != "$port" -a -n "$src_ip" ]; then counter=0; print_info ""; fi |
print_info -en " $port"`[ ! -z "$src_ip" ] && echo "[$src_ip]"` |
print_info -en " $port"`[ ! -z "$src_ip" ] && echo "[$src_ip]"` |
if [ $(( ++counter )) -ge 5 -o "x$port" = "x10050" ]; then counter=0; print_info ""; fi; |
if [ $(( ++counter )) -ge 5 ]; then counter=0; print_info ""; fi; |
|
last_port="$port"; |
echo $port | grep -q , |
echo $port | grep -q , |
multiport="$?"; |
multiport="$?"; |
if [ "$multiport" -eq 0 ]; then |
if [ "$multiport" -eq 0 ]; then |
|
|
done |
done |
} # }}} |
} # }}} |
|
|
|
map_subnet() |
|
{ # {{{ |
|
cfgvar=$1 |
|
cfgfile=$2 |
|
port=$3 |
|
|
|
if [ -f "$DEFAULT_FIREWALL_CONFIG_DIR/subnets/$cfgfile" ]; then |
|
cfgfound="$DEFAULT_FIREWALL_CONFIG_DIR/subnets/$cfgfile"; |
|
else |
|
if [ -f "$DIST_FIREWALL_CONFIG_DIR/subnets/$cfgfile" ]; then |
|
cfgfound="$DIST_FIREWALL_CONFIG_DIR/subnets/$cfgfile"; |
|
else |
|
"Config file '$cfgfile' not found" |
|
exit 1 |
|
fi |
|
fi |
|
|
|
echo "Mapping $cfgfound map file to $cfgvar, port $port" |
|
while read subnet ; do |
|
case "$subnet" in |
|
""|\#*) |
|
continue |
|
;; |
|
esac |
|
echo "$cfgvar=\"\$$cfgvar $subnet:$port\"" >> "$DEFAULT_FIREWALL_CONFIG_DIR/$cfgfile" |
|
done < $cfgfound |
|
|
|
} # }}} |
|
|
# Parse output from ifconfig: - tested on Linux and FreeBSD |
# Parse output from ifconfig: - tested on Linux and FreeBSD |
# http://platon.sk/cvs/cvs.php/scripts/shell/firewall/ifconfig-parse.sh |
# http://platon.sk/cvs/cvs.php/scripts/shell/firewall/ifconfig-parse.sh |
parse_ifconfig() |
parse_ifconfig() |
|
|
remote) |
remote) |
remote; |
remote; |
;; |
;; |
|
map-subnet) |
|
shift; |
|
map_subnet $*; |
|
;; |
*) |
*) |
echo "Usage: $0 {start|stop|really-off|status|purge|block|deploy-block|deploy-update|update}" >&2 |
echo "Usage: $0 {start|stop|really-off|status|purge|block|deploy-block|deploy-update|update}" >&2 |
exit 1 |
exit 1 |