verzia 2.108, 2016/02/26 03:11:01 |
verzia 2.111, 2016/05/05 23:54:19 |
|
|
# Licensed under terms of GNU General Public License. |
# Licensed under terms of GNU General Public License. |
# All rights reserved. |
# All rights reserved. |
# |
# |
# $Platon: scripts/shell/firewall/fw-universal.sh,v 2.107 2016/02/26 02:53:42 nepto Exp $ |
# $Platon: scripts/shell/firewall/fw-universal.sh,v 2.110 2016/05/05 21:07:54 rajo Exp $ |
# |
# |
# Changelog: |
# Changelog: |
# 2003-10-24 - created |
# 2003-10-24 - created |
|
|
fi |
fi |
# }}} |
# }}} |
|
|
|
# Define function which can be used in config file |
|
# Usage: |
|
# load_subnets eth0_ACCEPT_INPUT_TCP Slovakia.txt 22 |
|
load_subnets() |
|
{ # {{{ |
|
cfgvar="$1"; |
|
cfgfile="$2"; |
|
port="$3"; |
|
|
|
print_info "LOAD_SUBNETS: $*"; |
|
|
|
if [ -f "$DEFAULT_FIREWALL_CONFIG_DIR/subnets/$cfgfile" ]; then |
|
cfgfound="$DEFAULT_FIREWALL_CONFIG_DIR/subnets/$cfgfile"; |
|
else if [ -f "$DIST_FIREWALL_CONFIG_DIR/subnets/$cfgfile" ]; then |
|
cfgfound="$DIST_FIREWALL_CONFIG_DIR/subnets/$cfgfile"; |
|
else |
|
print_info "LOAD_SUBNETS: config file not found: $cfgfile"; |
|
return 1 |
|
fi fi |
|
LOADED_CONFIG_FILES="$LOADED_CONFIG_FILES $cfgfound"; |
|
|
|
print_info "LOAD_SUBNETS: found $cfgfile: $cfgfound"; |
|
print_info "LOAD_SUBNETS: mapping $cfgfile to $cfgvar, port $port" |
|
|
|
lines=0; |
|
while read subnet ; do |
|
case "$subnet" in |
|
""|\#*) |
|
continue |
|
;; |
|
esac |
|
eval "$cfgvar=\"\$$cfgvar $subnet:$port\""; |
|
lines=$(($lines + 1)); |
|
done < $cfgfound |
|
print_info "LOAD_SUBNETS: $lines subnets loaded from $cfgfile" |
|
} # }}} |
|
|
if [ -f "$DEFAULT_FIREWALL_CONFIG" ]; then |
if [ -f "$DEFAULT_FIREWALL_CONFIG" ]; then |
print_info "Reading config file $DEFAULT_FIREWALL_CONFIG" |
print_info "Reading config file $DEFAULT_FIREWALL_CONFIG" |
. $DEFAULT_FIREWALL_CONFIG |
. $DEFAULT_FIREWALL_CONFIG |
|
|
|
|
config=""; |
config=""; |
if [ -r "$DEFAULT_FIREWALL_CONFIG" ]; then |
if [ -r "$DEFAULT_FIREWALL_CONFIG" ]; then |
config="$config ` cat \"$DEFAULT_FIREWALL_CONFIG\" `"; |
config="$config ` md5sum \"$DEFAULT_FIREWALL_CONFIG\" `"; |
fi |
fi |
if [ -r "$0" ]; then |
if [ -r "$0" ]; then |
config="$config ` cat \"$0\" `"; |
config="$config ` md5sum \"$0\" `"; |
fi |
fi |
if [ -r "$DEFAULT_FIREWALL_CONFIG_DIR/deploy-servers.list" ]; then |
if [ -r "$DEFAULT_FIREWALL_CONFIG_DIR/deploy-servers.list" ]; then |
config="$config ` cat \"$DEFAULT_FIREWALL_CONFIG_DIR/deploy-servers.list\" `"; |
config="$config ` md5sum \"$DEFAULT_FIREWALL_CONFIG_DIR/deploy-servers.list\" `"; |
fi |
fi |
if [ -r "$DEFAULT_FIREWALL_CONFIG_DIR/BANNED_IP.conf" ]; then |
if [ -r "$DEFAULT_FIREWALL_CONFIG_DIR/BANNED_IP.conf" ]; then |
config="$config ` cat \"$DEFAULT_FIREWALL_CONFIG_DIR/BANNED_IP.conf\" `"; |
config="$config ` md5sum \"$DEFAULT_FIREWALL_CONFIG_DIR/BANNED_IP.conf\" `"; |
fi |
fi |
|
for lc in $LOADED_CONFIG_FILES; do |
|
echo "CHECKSUM $lc"; |
|
config="$config ` md5sum \"$lc\" `"; |
|
done |
md5key=`echo "config='$config' parsed_interfaces='$parsed_interfaces' parsed_routes='$parsed_routes'" | md5sum | $AWK '{print $1;}'`; |
md5key=`echo "config='$config' parsed_interfaces='$parsed_interfaces' parsed_routes='$parsed_routes'" | md5sum | $AWK '{print $1;}'`; |
CACHE_FILE="$DEFAULT_CACHE_DIR/$md5key" |
CACHE_FILE="$DEFAULT_CACHE_DIR/$md5key" |
|
|
Riadok 1250 allow_output() |
|
Riadok 1291 allow_output() |
|
accept_output_udp="${iface}_ACCEPT_OUTPUT_UDP" |
accept_output_udp="${iface}_ACCEPT_OUTPUT_UDP" |
ACCEPT_OUTPUT_UDP="${!accept_output_udp}" |
ACCEPT_OUTPUT_UDP="${!accept_output_udp}" |
|
|
|
# UDP *must* go before TCP |
|
# |
|
# Reason: we need to have working DNS resolving, which works over |
|
# port 53/UDP. Resolving is required for those rules, which use |
|
# hostname instead of IP address, for example cvs.platon.sk:2401. |
|
|
# TCP |
# UDP |
if [ -z "$ACCEPT_OUTPUT_TCP" ]; then |
if [ -z "$ACCEPT_OUTPUT_UDP" ]; then |
if [ -n "${!gateway}" ]; then |
if [ -n "${!gateway}" ]; then |
for ip in ${!IPS}; do |
for ip in ${!IPS}; do |
output_tcp_str="$output_tcp_str $ip:${!riface}:${!gateway}"; |
output_udp_str="$output_udp_str $ip:${!riface}:${!gateway}"; |
$IPTABLES -A OUTPUT -p TCP -o ${!riface} -s $ip -j ACCEPT |
$IPTABLES -A OUTPUT -p UDP -o ${!riface} -s $ip -j ACCEPT |
done |
done |
fi |
fi |
else |
else |
print_info -en "$iface: Accepting OUTPUT TCP connections to ports:" |
print_info -en "$iface: Accepting OUTPUT UDP connections to ports:" |
for port in $ACCEPT_OUTPUT_TCP; do |
for port in $ACCEPT_OUTPUT_UDP; do |
dest_ip="" |
dest_ip="" |
eval `echo $port | awk -v FS=: '/:/ { printf "dest_ip=\"%s\"; port=\"%s\";", $1, $2; }'` |
eval `echo $port | awk -v FS=: '/:/ { printf "dest_ip=\"%s\"; port=\"%s\";", $1, $2; }'` |
if [ -n "$dest_ip" -a "$port" = "0" ]; then |
if [ -n "$dest_ip" -a "$port" = "0" ]; then |
Riadok 1269 allow_output() |
|
Riadok 1315 allow_output() |
|
fi |
fi |
print_info -en " $port"`[ ! -z "$dest_ip" ] && echo "[$dest_ip]"` |
print_info -en " $port"`[ ! -z "$dest_ip" ] && echo "[$dest_ip]"` |
if [ -z "$dest_ip" ]; then |
if [ -z "$dest_ip" ]; then |
$IPTABLES -A OUTPUT -o ${!riface} -p TCP --dport $port -j ACCEPT |
$IPTABLES -A OUTPUT -o ${!riface} -p UDP --dport $port -j ACCEPT |
else |
else |
if [ "$port" = "ALL" ]; then |
if [ "$port" = "ALL" ]; then |
$IPTABLES -A OUTPUT -o ${!riface} -d $dest_ip -p TCP -j ACCEPT |
$IPTABLES -A OUTPUT -o ${!riface} -d $dest_ip -p UDP -j ACCEPT |
else |
else |
$IPTABLES -A OUTPUT -o ${!riface} -d $dest_ip -p TCP --dport $port -j ACCEPT |
$IPTABLES -A OUTPUT -o ${!riface} -d $dest_ip -p UDP --dport $port -j ACCEPT |
fi |
fi |
fi |
fi |
done |
done |
print_info " done." |
print_info " done." |
fi |
fi |
|
|
# UDP |
# TCP |
if [ -z "$ACCEPT_OUTPUT_UDP" ]; then |
if [ -z "$ACCEPT_OUTPUT_TCP" ]; then |
if [ -n "${!gateway}" ]; then |
if [ -n "${!gateway}" ]; then |
for ip in ${!IPS}; do |
for ip in ${!IPS}; do |
output_udp_str="$output_udp_str $ip:${!riface}:${!gateway}"; |
output_tcp_str="$output_tcp_str $ip:${!riface}:${!gateway}"; |
$IPTABLES -A OUTPUT -p UDP -o ${!riface} -s $ip -j ACCEPT |
$IPTABLES -A OUTPUT -p TCP -o ${!riface} -s $ip -j ACCEPT |
done |
done |
fi |
fi |
else |
else |
print_info -en "$iface: Accepting OUTPUT UDP connections to ports:" |
print_info -en "$iface: Accepting OUTPUT TCP connections to ports:" |
for port in $ACCEPT_OUTPUT_UDP; do |
for port in $ACCEPT_OUTPUT_TCP; do |
dest_ip="" |
dest_ip="" |
eval `echo $port | awk -v FS=: '/:/ { printf "dest_ip=\"%s\"; port=\"%s\";", $1, $2; }'` |
eval `echo $port | awk -v FS=: '/:/ { printf "dest_ip=\"%s\"; port=\"%s\";", $1, $2; }'` |
if [ -n "$dest_ip" -a "$port" = "0" ]; then |
if [ -n "$dest_ip" -a "$port" = "0" ]; then |
Riadok 1299 allow_output() |
|
Riadok 1345 allow_output() |
|
fi |
fi |
print_info -en " $port"`[ ! -z "$dest_ip" ] && echo "[$dest_ip]"` |
print_info -en " $port"`[ ! -z "$dest_ip" ] && echo "[$dest_ip]"` |
if [ -z "$dest_ip" ]; then |
if [ -z "$dest_ip" ]; then |
$IPTABLES -A OUTPUT -o ${!riface} -p UDP --dport $port -j ACCEPT |
$IPTABLES -A OUTPUT -o ${!riface} -p TCP --dport $port -j ACCEPT |
else |
else |
if [ "$port" = "ALL" ]; then |
if [ "$port" = "ALL" ]; then |
$IPTABLES -A OUTPUT -o ${!riface} -d $dest_ip -p UDP -j ACCEPT |
$IPTABLES -A OUTPUT -o ${!riface} -d $dest_ip -p TCP -j ACCEPT |
else |
else |
$IPTABLES -A OUTPUT -o ${!riface} -d $dest_ip -p UDP --dport $port -j ACCEPT |
$IPTABLES -A OUTPUT -o ${!riface} -d $dest_ip -p TCP --dport $port -j ACCEPT |
fi |
fi |
fi |
fi |
done |
done |
|
|
done |
done |
} # }}} |
} # }}} |
|
|
map_subnet() |
|
{ # {{{ |
|
cfgvar=$1 |
|
cfgfile=$2 |
|
port=$3 |
|
|
|
if [ -f "$DEFAULT_FIREWALL_CONFIG_DIR/subnets/$cfgfile" ]; then |
|
cfgfound="$DEFAULT_FIREWALL_CONFIG_DIR/subnets/$cfgfile"; |
|
else |
|
if [ -f "$DIST_FIREWALL_CONFIG_DIR/subnets/$cfgfile" ]; then |
|
cfgfound="$DIST_FIREWALL_CONFIG_DIR/subnets/$cfgfile"; |
|
else |
|
"Config file '$cfgfile' not found" |
|
exit 1 |
|
fi |
|
fi |
|
|
|
echo "Mapping $cfgfound map file to $cfgvar, port $port" |
|
while read subnet ; do |
|
case "$subnet" in |
|
""|\#*) |
|
continue |
|
;; |
|
esac |
|
echo "$cfgvar=\"\$$cfgvar $subnet:$port\"" >> "$DEFAULT_FIREWALL_CONFIG_DIR/$cfgfile" |
|
done < $cfgfound |
|
|
|
} # }}} |
|
|
|
# Parse output from ifconfig: - tested on Linux and FreeBSD |
# Parse output from ifconfig: - tested on Linux and FreeBSD |
# http://platon.sk/cvs/cvs.php/scripts/shell/firewall/ifconfig-parse.sh |
# http://platon.sk/cvs/cvs.php/scripts/shell/firewall/ifconfig-parse.sh |
parse_ifconfig() |
parse_ifconfig() |
|
|
remote) |
remote) |
remote; |
remote; |
;; |
;; |
map-subnet) |
|
shift; |
|
map_subnet $*; |
|
;; |
|
*) |
*) |
echo "Usage: $0 {start|stop|really-off|status|purge|block|deploy-block|deploy-update|update}" >&2 |
echo "Usage: $0 {start|stop|really-off|status|purge|block|deploy-block|deploy-update|update}" >&2 |
exit 1 |
exit 1 |