Platon Technologies
neprihlásený Prihlásiť Registrácia
SlovakEnglish
open source software development oslavujeme 10 rokov vývoja otvoreného softvéru! Štvrtok, 28. marec 2024

Rozdiely pre scripts/shell/firewall/fw-universal.sh medzi verziami 2.13 a 2.16

verzia 2.13, 2005/01/16 11:06:10 verzia 2.16, 2005/01/16 15:27:15
Riadok 9 
Riadok 9 
 # Licensed under terms of GNU General Public License.  # Licensed under terms of GNU General Public License.
 # All rights reserved.  # All rights reserved.
 #  #
 # $Platon: scripts/shell/firewall/fw-universal.sh,v 2.12 2005/01/16 10:55:39 rajo Exp $  # $Platon: scripts/shell/firewall/fw-universal.sh,v 2.15 2005/01/16 12:13:32 rajo Exp $
 #  #
 # Changelog:  # Changelog:
 # 2003-10-24 - created  # 2003-10-24 - created
Riadok 48  AWK="${AWK:=/usr/bin/awk}"
Riadok 48  AWK="${AWK:=/usr/bin/awk}"
 LO_IFACE="${LO_IFACE:=lo}"  LO_IFACE="${LO_IFACE:=lo}"
 LO_IP="IP_$LO_IFACE"  LO_IP="IP_$LO_IFACE"
   
 # Which ports will be allowed on INPUT (TCP connections)  #
 ALL_ACCEPT_INPUT_TCP="${ALL_ACCEPT_INPUT_TCP:=}"  # CONSTANTS - Do not edit
 # interface eth0  #
 eth0_ACCEPT_INPUT_TCP="${eth0_ACCEPT_INPUT_TCP:=}"  ANYWHERE="0.0.0.0/0"                            # Match any IP address
 # interface ppp0  BROADCAST_SRC="0.0.0.0"                         # Broadcast Source Address
 ppp0_ACCEPT_INPUT_TCP="${ppp0_ACCEPT_INPUT_TCP:=}"  BROADCAST_DEST="255.255.255.255"        # Broadcast Destination Address
   CLASS_A="10.0.0.0/8"                            # Class-A Private (RFC-1918) Networks
 # Which ports will be allowed on INPUT (UDP connections)  CLASS_B="172.16.0.0/12"                         # Class-B Private (RFC-1918) Networks
 # interface eth0  CLASS_C="192.168.0.0/16"                        # Class-C Private (RFC-1918) Networks
 eth0_ACCEPT_INPUT_UDP="${eth0_ACCEPT_INPUT_UDP:=}"  CLASS_D_MULTICAST="224.0.0.0/4"         # Class-D Multicast Addresses
 # interface ppp0  CLASS_E_RESERVED_NET="240.0.0.0/5"      # Class-E Reserved Addresses
 ppp0_ACCEPT_INPUT_UDP="${ppp0_ACCEPT_INPUT_UDP:=}"  PRIVPORTS="0:1023"                                      # Well-Known, Privileged Port Range
   UNPRIVPORTS="1024:65535"                        # Unprivileged Port Range
   TRACEROUTE_SRC_PORTS="32769:65535"      # Traceroute Source Ports
   TRACEROUTE_DEST_PORTS="33434:33523"     # Traceroute Destination Ports
   
   
 # allow some ICMP packets - needed for ping etc.  # allow some ICMP packets - needed for ping etc.
 ACCEPT_ICMP_PACKETS="${ACCEPT_ICMP_PACKETS:=echo-reply destination-unreachable echo-request time-exceeded}"  ACCEPT_ICMP_PACKETS="${ACCEPT_ICMP_PACKETS:=echo-reply destination-unreachable echo-request time-exceeded}"
   
   
 # load necessary modules from $MODULES variable  # load necessary modules from $MODULES variable
 load_modules()  load_modules()
 { # {{{  { # {{{
Riadok 124  remove_chains()
Riadok 129  remove_chains()
   
 } # }}}  } # }}}
   
 # all packets on loopback are accpted  
 set_loopback()  
 { # {{{  
         $IPTABLES -A INPUT  -j ACCEPT -i $LO_IFACE  
         $IPTABLES -A OUTPUT -j ACCEPT -o $LO_IFACE  
 } # }}}  
   
 # DROP packages from nmap(1)  # DROP packages from nmap(1)
 nmap_scan_filter()  nmap_scan_filter()
 { # {{{  { # {{{
Riadok 392  drop_output()
Riadok 390  drop_output()
   
 } # }}}  } # }}}
   
 allow_input()  allow_accept_all()
 { # {{{  { # {{{
   
         if [ ! -z "$IFACE_ACCEPT_ALL" ]; then          if [ ! -z "$IFACE_ACCEPT_ALL" ]; then
                 echo -en "Accepting ALL packets on interfaces:"                  echo -en "Accepting ALL packets on interfaces:"
                 for iface in $IFACE_ACCEPT_ALL; do                  for iface in $IFACE_ACCEPT_ALL; do
Riadok 405  allow_input()
Riadok 402  allow_input()
                 done                  done
                 echo " done."                  echo " done."
         fi          fi
   } # }}}
   
   allow_input()
   { # {{{
   
         if [ ! -z "$ALL_ACCEPT_INPUT_TCP" ]; then          if [ ! -z "$ALL_ACCEPT_INPUT_TCP" ]; then
                 echo -en "Accepting ALL INPUT TCP connections on ports:"                  echo -en "Accepting ALL INPUT TCP connections on ports:"
Riadok 457  allow_input()
Riadok 458  allow_input()
                 fi                  fi
         done          done
   
           # Enable outgoing TRACEROUTE requests (required e.g. by Skype, http://www.skype.com)
           if [ ! -z "$TRACEROUTE_IFACE" ]; then
                   ip="IP_$ANTISPOOF_IFACE";
                   echo -en "Accepting traceroute:"
   
                   $IPTABLES -A OUTPUT -o $ANTISPOOF_IFACE -p UDP \
                           --sport $TRACEROUTE_SRC_PORTS --dport $TRACEROUTE_DEST_PORTS \
                           -s ${!ip} -d $ANYWHERE -j ACCEPT
   
                   for iface in $TRACEROUTE_IFACE; do
                           $IPTABLES -A FORWARD -p UDP -i $iface --sport $TRACEROUTE_SRC_PORTS \
                                   --dport $TRACEROUTE_DEST_PORTS -j ACCEPT
                   done
                   echo " done."
           fi
   
 } # }}}  } # }}}
   
 # ACCEPT all packets from our IP address  # ACCEPT all packets from our IP address
Riadok 594  parse_ifconfig()
Riadok 611  parse_ifconfig()
 parse_ifconfig  parse_ifconfig
 print_iface_status  print_iface_status
   
 # $interfaces - all interfaces  #
   # Split interfaces into 2 groups:
   #
   # $INTERFACES_ACCEPT_ALL - interfaces withouth restrictions
   #
 # $INTERFACES - all interfaces withouth loopback  # $INTERFACES - all interfaces withouth loopback
   #               and devices without restrictions (e.g. tun0 tun1 tap0 ...)
   #
   # list of all interfaces is in $interfaces variable
   #
 INTERFACES=""  INTERFACES=""
   INTERFACES_ACCEPT_ALL=""
   regexp='^\('`echo $IFACE_ACCEPT_ALL | sed 's/ /\\\|/g; s/+/.*/g;'`'\)$'
 for iface in $interfaces; do  for iface in $interfaces; do
         if [ "o$iface" = "olo" ]; then continue; fi          #if [ "o$iface" = "olo" ]; then continue; fi
         INTERFACES="$INTERFACES $iface";          echo $iface | grep -q -e "$regexp"
           if [ $? = 0 ] || [ "o$iface" = "olo" ]; then # lo interface is always here
                   INTERFACES_ACCEPT_ALL="$INTERFACES_ACCEPT_ALL $iface";
           else
                   INTERFACES="$INTERFACES $iface";
           fi
 done  done
   
   
Riadok 614  case "$1" in
Riadok 646  case "$1" in
                 #                  #
                 # (un)commnet next lines as needed                  # (un)commnet next lines as needed
                 #                  #
                 set_loopback                  allow_accept_all
                 nmap_scan_filter                  nmap_scan_filter
                 invalid_packet_filter                  invalid_packet_filter
                 anti_spoof_filter                  anti_spoof_filter

Legend:
Odstranené z verzie2.13  
zmenené riadky
  Pridané vo verzii2.16

Platon Group <platon@platon.sk> http://platon.sk/
Copyright © 2002-2006 Platon Group
Stránka používa redakčný systém Metafox
Na začiatok