extern/shorewall_code
1
0
Fork 1
mirror of https://gitlab.com/shorewall/code.git synced 2024-12-22 06:10:42 +01:00
Code Issues Packages Projects Releases Wiki Activity

Implement common lib.base, lib.cli and CLI for Shorewall[6][-lite]

Browse Source 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
This commit is contained in:
Tom Eastep 2011-12-03 10:59:01 -08:00
parent dbf75af411
commit 4161c35108
4 changed files with 731 additions and 351 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

184
Shorewall-lite/shorewall-lite
View File

@ -25,65 +25,6 @@
# #
# If an error occurs while starting or restarting the firewall, the # If an error occurs while starting or restarting the firewall, the
# firewall is automatically stopped. # firewall is automatically stopped.
#
# Commands are:
#
# shorewall-lite dump Dumps all Shorewall-related information
# for problem analysis
# shorewall-lite start Starts the firewall
# shorewall-lite restart Restarts the firewall
# shorewall-lite stop Stops the firewall
# shorewall-lite status Displays firewall status
# shorewall-lite reset Resets iptables packet and
# byte counts
# shorewall-lite clear Open the floodgates by
# removing all iptables rules
# and setting the three permanent
# chain policies to ACCEPT
# shorewall-lite show <chain> [ <chain> ... ] Display the rules in each <chain> listed
# shorewall-lite show log Print the last 20 log messages
# shorewall-lite show connections Show the kernel's connection
# tracking table
# shorewall-lite show nat Display the rules in the nat table
# shorewall-lite show {mangle|tos} Display the rules in the mangle table
# shorewall-lite show tc Display traffic control info
# shorewall-lite show classifiers Display classifiers
# shorewall-lite show capabilities Display iptables/kernel capabilities
# shorewall-lite show vardir Display VARDIR setting
# shorewall-lite version Display the installed version id
# shorewall-lite logwatch [ refresh-interval ] Monitor the local log for Shorewall
# messages.
# shorewall-lite drop <address> ... Temporarily drop all packets from the
# listed address(es)
# shorewall-lite reject <address> ... Temporarily reject all packets from the
# listed address(es)
# shorewall-lite allow <address> ... Reenable address(es) previously
# disabled with "drop" or "reject"
# shorewall-lite save [ <file> ] Save the list of "rejected" and
# "dropped" addresses so that it will
# be automatically reinstated the
# next time that Shorewall starts.
# Save the current state so that 'shorewall
# restore' can be used.
#
# shorewall-lite forget [ <file> ] Discard the data saved by 'shorewall save'
#
# shorewall-lite restore [ <file> ] Restore the state of the firewall from
# previously saved information.
#
# shorewall-lite ipaddr { <address>/<cidr> | <address> <netmask> }
#
# Displays information about the network
# defined by the argument[s]
#
# shorewall-lite iprange <address>-<address> Decomposes a range of IP addresses into
# a list of network/host addresses.
#
# shorewall-lite ipdecimal { <address> | <integer> }
#
# Displays the decimal equivalent of an IP
# address and vice versa.
# #
# Set the configuration variables from shorewall-lite.conf # Set the configuration variables from shorewall-lite.conf
# #
@ -113,17 +54,36 @@ get_config() {
[ -n "$FW" ] || FW=fw [ -n "$FW" ] || FW=fw
if [ -n "$IPTABLES" ]; then if [ $g_family -eq 4 ]; then
if [ ! -x "$IPTABLES" ]; then if [ -n "$IPTABLES" ]; then
echo " ERROR: The program specified in IPTABLES does not exist or is not executable" >&2 if [ ! -x "$IPTABLES" ]; then
exit 2 echo " ERROR: The program specified in IPTABLES does not exist or is not executable" >&2
exit 2
fi
else
IPTABLES=$(mywhich iptables 2> /dev/null)
if [ -z "$IPTABLES" ] ; then
echo " ERROR: Can't find iptables executable" >&2
exit 2
fi
fi fi
g_tool=#$IPTABLES
else else
IPTABLES=$(mywhich iptables 2> /dev/null) if [ -n "$IP6TABLES" ]; then
if [ -z "$IPTABLES" ] ; then if [ ! -x "$IP6TABLES" ]; then
echo " ERROR: Can't find iptables executable" >&2 echo " ERROR: The program specified in IP6TABLES does not exist or is not executable" >&2
exit 2 exit 2
fi
else
IP6TABLES=$(mywhich ip6tables 2> /dev/null)
if [ -z "$IP6TABLES" ] ; then
echo " ERROR: Can't find ip6tables executable" >&2
exit 2
fi
fi fi
g_tool=$IP6TABLES
fi fi
if [ -n "$SHOREWALL_SHELL" ]; then if [ -n "$SHOREWALL_SHELL" ]; then
@ -165,7 +125,7 @@ get_config() {
# #
verify_firewall_script() { verify_firewall_script() {
if [ ! -f $g_firewall ]; then if [ ! -f $g_firewall ]; then
echo " ERROR: Shorewall Lite is not properly installed" >&2 echo " ERROR: $g_product is not properly installed" >&2
if [ -L $g_firewall ]; then if [ -L $g_firewall ]; then
echo " $g_firewall is a symbolic link to a" >&2 echo " $g_firewall is a symbolic link to a" >&2
echo " non-existant file" >&2 echo " non-existant file" >&2
@ -203,7 +163,7 @@ start_command() {
rc=$? rc=$?
else else
error_message "${LITEDIR}/firewall is missing or is not executable" error_message "${LITEDIR}/firewall is missing or is not executable"
logger -p kern.err "ERROR:Shorewall Lite start failed" logger -p kern.err "ERROR:$g_product start failed"
rc=2 rc=2
fi fi
@ -213,8 +173,13 @@ start_command() {
verify_firewall_script verify_firewall_script
if shorewall_is_started; then if product_is_started; then
error_message "Shorewall is already running" if [ $g_family -eq 4 ]; then
error_message "Shorewall is already running"
else
error_message "Shorewall6 is already running"
fi
exit 0 exit 0
fi fi
@ -271,10 +236,10 @@ start_command() {
g_restorepath=${VARDIR}/$RESTOREFILE g_restorepath=${VARDIR}/$RESTOREFILE
if [ -x $g_restorepath ]; then if [ -x $g_restorepath ]; then
echo Restoring Shorewall Lite... echo Restoring $g_product...
run_it $g_restorepath restore run_it $g_restorepath restore
date > ${VARDIR}/restarted date > ${VARDIR}/restarted
progress_message3 Shorewall Lite restored from $g_restorepath progress_message3 $g_product restored from $g_restorepath
else else
do_it do_it
fi fi
@ -346,7 +311,7 @@ restart_command() {
rc=$? rc=$?
else else
error_message "${LITEDIR}/firewall is missing or is not executable" error_message "${LITEDIR}/firewall is missing or is not executable"
logger -p kern.err "ERROR:Shorewall Lite restart failed" logger -p kern.err "ERROR:$g_product restart failed"
rc=2 rc=2
fi fi
@ -371,9 +336,13 @@ usage() # $1 = exit status
echo " enable <interface>" echo " enable <interface>"
echo " forget [ <file name> ]" echo " forget [ <file name> ]"
echo " help" echo " help"
echo " ipcalc { <address>/<vlsm> | <address> <netmask> }"
echo " ipdecimal { <address> | <integer> }" if [ $g_family -eq 4 ]; then
echo " iprange <address>-<address>" echo " ipcalc { <address>/<vlsm> | <address> <netmask> }"
echo " ipdecimal { <address> | <integer> }"
echo " iprange <address>-<address>"
fi
echo " logdrop <address> ..." echo " logdrop <address> ..."
echo " logreject <address> ..." echo " logreject <address> ..."
echo " logwatch [<refresh interval>]" echo " logwatch [<refresh interval>]"
@ -390,7 +359,7 @@ usage() # $1 = exit status
echo " show filters" echo " show filters"
echo " show ip" echo " show ip"
echo " show [ -m ] log [<regex>]" echo " show [ -m ] log [<regex>]"
echo " show [ -x ] mangle|nat|raw|routing" echo " show [ -x ] mangle|nat|raw|rawpost|routing"
echo " show policies" echo " show policies"
echo " show tc [ device ]" echo " show tc [ device ]"
echo " show vardir" echo " show vardir"
@ -444,8 +413,8 @@ version_command() {
echo $SHOREWALL_VERSION echo $SHOREWALL_VERSION
if [ -n "$all" ]; then if [ -n "$all" ]; then
for product in shorewall shorewall6 shorewall6-lite shorewall-init; do for product in shorewall shorewall6 shorewall-lite shorewall6-lite shorewall-init; do
if [ -f /usr/share/$product/version ]; then if [ $product ~= $g_program] && [ -f /usr/share/$product/version ]; then
echo "$product: $(cat /usr/share/$product/version)" echo "$product: $(cat /usr/share/$product/version)"
fi fi
done done
@ -476,6 +445,7 @@ g_use_verbosity=
g_noroutes= g_noroutes=
g_timestamp= g_timestamp=
g_recovering= g_recovering=
g_purge=
g_logread= g_logread=
# #
@ -569,14 +539,30 @@ fi
PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin
MUTEX_TIMEOUT= MUTEX_TIMEOUT=
SHAREDIR=/usr/share/shorewall-lite g_program=$(basename $0)
CONFDIR=/etc/shorewall-lite
g_product="Shorewall Lite" if [ $g_program = shorewall6-lite ]; then
SHAREDIR=/usr/share/shorewall6-lite
CONFDIR=/etc/shorewall6-lite
g_product="Shorewall6 Lite"
g_family=6
g_base=shorewall6
g_tool=ip6tables
else
g_program=shorewall-lite
SHAREDIR=/usr/share/shorewall-lite
CONFDIR=/etc/shorewall-lite
g_product="Shorewall Lite"
g_family=4
g_base=shorewall
g_tool=iptables
fi
g_libexec=share g_libexec=share
[ -f ${CONFDIR}/vardir ] && . ${CONFDIR}/vardir ] [ -f ${CONFDIR}/vardir ] && . ${CONFDIR}/vardir ]
[ -n "${VARDIR:=/var/lib/shorewall-lite}" ] [ -n "${VARDIR:=/var/lib/${g_base}-lite}" ]
[ -d $VARDIR ] || mkdir -p $VARDIR || fatal_error "Unable to create $VARDIR" [ -d $VARDIR ] || mkdir -p $VARDIR || fatal_error "Unable to create $VARDIR"
@ -588,7 +574,7 @@ done
ensure_config_path ensure_config_path
config=$(find_file shorewall-lite.conf) config=$(find_file ${g_base}-lite.conf)
if [ -f $config ]; then if [ -f $config ]; then
if [ -r $config ]; then if [ -r $config ]; then
@ -615,12 +601,12 @@ g_firewall=$LITEDIR/firewall
if [ -f $version_file ]; then if [ -f $version_file ]; then
SHOREWALL_VERSION=$(cat $version_file) SHOREWALL_VERSION=$(cat $version_file)
else else
echo " ERROR: Shorewall Lite is not properly installed" >&2 echo " ERROR: $g_product is not properly installed" >&2
echo " The file $version_file does not exist" >&2 echo " The file $version_file does not exist" >&2
exit 1 exit 1
fi fi
banner="Shorewall Lite $SHOREWALL_VERSION Status at $g_hostname -" banner="$g_product $SHOREWALL_VERSION Status at $g_hostname -"
case $(echo -e) in case $(echo -e) in
-e*) -e*)
@ -658,7 +644,7 @@ case "$COMMAND" in
;; ;;
restart) restart)
shift shift
restart_command restart_command @
;; ;;
show|list) show|list)
shift shift
@ -667,13 +653,13 @@ case "$COMMAND" in
status) status)
[ $# -eq 1 ] || usage 1 [ $# -eq 1 ] || usage 1
[ "$(id -u)" != 0 ] && fatal_error "The status command may only be run by root" [ "$(id -u)" != 0 ] && fatal_error "The status command may only be run by root"
echo "Shorewall Lite $SHOREWALL_VERSION Status at $g_hostname - $(date)" echo "$g_product $SHOREWALL_VERSION Status at $g_hostname - $(date)"
echo echo
if shorewall_is_started ; then if product_is_started ; then
echo "Shorewall Lite is running" echo "$g_product is running"
status=0 status=0
else else
echo "Shorewall Lite is stopped" echo "$g_product is stopped"
status=4 status=4
fi fi
@ -710,36 +696,36 @@ case "$COMMAND" in
drop) drop)
[ -n "$debugging" ] && set -x [ -n "$debugging" ] && set -x
[ $# -eq 1 ] && usage 1 [ $# -eq 1 ] && usage 1
if shorewall_is_started ; then if product_is_started ; then
[ -n "$nolock" ] || mutex_on [ -n "$nolock" ] || mutex_on
block DROP Dropped $* block DROP Dropped $*
[ -n "$nolock" ] || mutex_off [ -n "$nolock" ] || mutex_off
else else
error_message "ERROR: Shorewall Lite is not started" error_message "ERROR: $g_product is not started"
exit 2 exit 2
fi fi
;; ;;
logdrop) logdrop)
[ -n "$debugging" ] && set -x [ -n "$debugging" ] && set -x
[ $# -eq 1 ] && usage 1 [ $# -eq 1 ] && usage 1
if shorewall_is_started ; then if product_is_started ; then
[ -n "$nolock" ] || mutex_on [ -n "$nolock" ] || mutex_on
block logdrop Dropped $* block logdrop Dropped $*
[ -n "$nolock" ] || mutex_off [ -n "$nolock" ] || mutex_off
else else
error_message "ERROR: Shorewall Lite is not started" error_message "ERROR: $g_product is not started"
exit 2 exit 2
fi fi
;; ;;
reject|logreject) reject|logreject)
[ -n "$debugging" ] && set -x [ -n "$debugging" ] && set -x
[ $# -eq 1 ] && usage 1 [ $# -eq 1 ] && usage 1
if shorewall_is_started ; then if product_is_started ; then
[ -n "$nolock" ] || mutex_on [ -n "$nolock" ] || mutex_on
block $COMMAND Rejected $* block $COMMAND Rejected $*
[ -n "$nolock" ] || mutex_off [ -n "$nolock" ] || mutex_off
else else
error_message "ERROR: Shorewall Lite is not started" error_message "ERROR: $g_product is not started"
exit 2 exit 2
fi fi
;; ;;
@ -758,7 +744,7 @@ case "$COMMAND" in
;; ;;
disable|enable) disable|enable)
get_config Yes get_config Yes
if shorewall_is_started; then if product_is_started; then
run_it ${VARDIR}/firewall $g_debugging $@ run_it ${VARDIR}/firewall $g_debugging $@
else else
fatal_error "Shorewall is not running" fatal_error "Shorewall is not running"

16
Shorewall/lib.base
View File

@ -23,16 +23,17 @@
# This library contains the code common to all Shorewall components. # This library contains the code common to all Shorewall components.
# #
# - It is loaded by /sbin/shorewall. # - It is loaded by /sbin/shorewall.
# - It is released as part of Shorewall Lite where it is used by /sbin/shorewall-lite # - It is released as part of Shorewall[6] Lite where it is used by /sbin/shorewall[6]-lite
# and /usr/share/shorewall-lite/shorecap. # and /usr/share/shorewall[6]-lite/shorecap.
# #
SHOREWALL_LIBVERSION=40407 SHOREWALL_LIBVERSION=40407
SHOREWALL_CAPVERSION=40426 SHOREWALL_CAPVERSION=40426
[ -n "${VARDIR:=/var/lib/shorewall}" ] [ -n "${g_program:=shorewall}" ]
[ -n "${SHAREDIR:=/usr/share/shorewall}" ] [ -n "${VARDIR:=/var/lib/$g_program}" ]
[ -n "${CONFDIR:=/etc/shorewall}" ] [ -n "${SHAREDIR:=/usr/share/g_program}" ]
[ -n "${CONFDIR:=/etc/$g_program}" ]
# #
# Conditionally produce message # Conditionally produce message
@ -378,9 +379,8 @@ resolve_file() # $1 = file name
esac esac
} }
# Function to truncate a string -- It uses 'cut -b -<n>' #
# rather than ${v:first:last} because light-weight shells like ash and # Determine how to do "echo -e"
# dash do not support that form of expansion.
# #
find_echo() { find_echo() {

677
Shorewall/lib.cli
View File

File diff suppressed because it is too large Load Diff

205
Shorewall/shorewall
View File

@ -24,11 +24,11 @@
# along with this program; if not, write to the Free Software # along with this program; if not, write to the Free Software
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
# #
# For a list of supported commands, type 'shorewall help' # For a list of supported commands, type 'shorewall help' or 'shorewall6 help'
# #
################################################################################################ ################################################################################################
# #
# Set the configuration variables from shorewall.conf # Set the configuration variables from the .conf file
# #
# $1 = Yes: read the params file # $1 = Yes: read the params file
# $2 = Yes: check for STARTUP_ENABLED # $2 = Yes: check for STARTUP_ENABLED
@ -47,7 +47,7 @@ get_config() {
fi fi
fi fi
config=$(find_file shorewall.conf) config=$(find_file $g_program.conf)
if [ -f $config ]; then if [ -f $config ]; then
if [ -r $config ]; then if [ -r $config ]; then
@ -80,17 +80,36 @@ get_config() {
fi fi
fi fi
if [ -n "$IPTABLES" ]; then if [ $g_family -eq 4 ]; then
if [ ! -x "$IPTABLES" ]; then if [ -n "$IPTABLES" ]; then
echo " ERROR: The program specified in IPTABLES does not exist or is not executable" >&2 if [ ! -x "$IPTABLES" ]; then
exit 2 echo " ERROR: The program specified in IPTABLES does not exist or is not executable" >&2
exit 2
fi
else
IPTABLES=$(mywhich iptables 2> /dev/null)
if [ -z "$IPTABLES" ] ; then
echo " ERROR: Can't find iptables executable" >&2
exit 2
fi
fi fi
g_tool=$IPTABLES
else else
IPTABLES=$(mywhich iptables 2> /dev/null) if [ -n "$IP6TABLES" ]; then
if [ -z "$IPTABLES" ] ; then if [ ! -x "$IP6TABLES" ]; then
echo " ERROR: Can't find iptables executable" >&2 echo " ERROR: The program specified in IP6TABLES does not exist or is not executable" >&2
exit 2 exit 2
fi
else
IP6TABLES=$(mywhich ip6tables 2> /dev/null)
if [ -z "$IP6TABLES" ] ; then
echo " ERROR: Can't find ip6tables executable" >&2
exit 2
fi
fi fi
g_tool=$IP6TABLES
fi fi
if [ -n "$IP" ]; then if [ -n "$IP" ]; then
@ -165,7 +184,7 @@ get_config() {
if [ "$2" = Yes ]; then if [ "$2" = Yes ]; then
case $STARTUP_ENABLED in case $STARTUP_ENABLED in
No|no|NO) No|no|NO)
echo " ERROR: Shorewall startup is disabled. To enable startup, set STARTUP_ENABLED=Yes in ${CONFDIR}/shorewall.conf" >&2 echo " ERROR: $g_product startup is disabled. To enable startup, set STARTUP_ENABLED=Yes in ${CONFDIR}/${g_program}.conf" >&2
exit 2 exit 2
;; ;;
Yes|yes|YES) Yes|yes|YES)
@ -358,8 +377,8 @@ compiler() {
pc=$g_libexec/shorewall/compiler.pl pc=$g_libexec/shorewall/compiler.pl
if [ $(id -u) -ne 0 ]; then if [ $(id -u) -ne 0 ]; then
if [ -z "$SHOREWALL_DIR" -o "$SHOREWALL_DIR" = /etc/shorewall ]; then if [ -z "$SHOREWALL_DIR" -o "$SHOREWALL_DIR" = /etc/$g_program ]; then
startup_error "Ordinary users may not compile the /etc/shorewall configuration" startup_error "Ordinary users may not compile the /etc/$g_program configuration"
fi fi
fi fi
# #
@ -369,7 +388,7 @@ compiler() {
# #
# Get the config from $SHOREWALL_DIR # Get the config from $SHOREWALL_DIR
# #
[ -n "$SHOREWALL_DIR" -a "$SHOREWALL_DIR" != /etc/shorewall ] && get_config [ -n "$SHOREWALL_DIR" -a "$SHOREWALL_DIR" != /etc/$g_program ] && get_config
case $COMMAND in case $COMMAND in
*start|try|refresh) *start|try|refresh)
@ -390,7 +409,7 @@ compiler() {
[ "$1" = nolock ] && shift; [ "$1" = nolock ] && shift;
shift shift
options="--verbose=$VERBOSITY --config_path=$CONFIG_PATH" options="--verbose=$VERBOSITY --family=$g_family --config_path=$CONFIG_PATH"
[ -n "$STARTUP_LOG" ] && options="$options --log=$STARTUP_LOG" [ -n "$STARTUP_LOG" ] && options="$options --log=$STARTUP_LOG"
[ -n "$LOG_VERBOSITY" ] && options="$options --log_verbosity=$LOG_VERBOSITY"; [ -n "$LOG_VERBOSITY" ] && options="$options --log_verbosity=$LOG_VERBOSITY";
[ -n "$g_export" ] && options="$options --export" [ -n "$g_export" ] && options="$options --export"
@ -423,6 +442,17 @@ compiler() {
fi fi
} }
#
# Determine if the current product is in the started state
#
product_is_started() {
if [ $g_family -eq 4 ]; then
shorewall_is_started
else
shorewall6_is_started
fi
}
# #
# Start Command Executor # Start Command Executor
# #
@ -449,14 +479,14 @@ start_command() {
[ -n "$nolock" ] || mutex_off [ -n "$nolock" ] || mutex_off
else else
rc=$? rc=$?
logger -p kern.err "ERROR:Shorewall start failed" logger -p kern.err "ERROR:$g_product start failed"
fi fi
fi fi
exit $rc exit $rc
} }
if shorewall_is_started; then if product_is_started; then
error_message "Shorewall is already running" error_message "Shorewall is already running"
exit 0 exit 0
fi fi
@ -552,7 +582,7 @@ start_command() {
run_it $g_restorepath restore run_it $g_restorepath restore
rc=$? rc=$?
[ -n "$nolock" ] || mutex_off [ -n "$nolock" ] || mutex_off
[ $rc -eq 0 ] && progress_message3 "Shorewall restored from $g_restorepath" [ $rc -eq 0 ] && progress_message3 "$g_product restored from $g_restorepath"
exit $rc exit $rc
else else
do_it do_it
@ -916,7 +946,7 @@ restart_command() {
[ -n "$nolock" ] || mutex_off [ -n "$nolock" ] || mutex_off
else else
rc=$? rc=$?
logger -p kern.err "ERROR:Shorewall restart failed" logger -p kern.err "ERROR:$g_product restart failed"
fi fi
else else
[ -x ${VARDIR}/firewall ] || fatal_error "No ${VARDIR}/firewall file found" [ -x ${VARDIR}/firewall ] || fatal_error "No ${VARDIR}/firewall file found"
@ -973,7 +1003,7 @@ refresh_command() {
g_refreshchains=:refresh: g_refreshchains=:refresh:
fi fi
shorewall_is_started || fatal_error "Shorewall is not running" product_is_started || fatal_error "$g_product is not running"
[ -n "$STARTUP_ENABLED" ] || fatal_error "Startup is disabled" [ -n "$STARTUP_ENABLED" ] || fatal_error "Startup is disabled"
@ -1058,7 +1088,7 @@ safe_commands() {
[ -n "$STARTUP_ENABLED" ] || fatal_error "Startup is disabled" [ -n "$STARTUP_ENABLED" ] || fatal_error "Startup is disabled"
if shorewall_is_started; then if product_is_started; then
running=Yes running=Yes
else else
running= running=
@ -1071,7 +1101,7 @@ safe_commands() {
fi fi
if [ "$COMMAND" = "safe-start" -o -z "$running" ]; then if [ "$COMMAND" = "safe-start" -o -z "$running" ]; then
# the command is safe-start or shorewall is not started yet # the command is safe-start or shorewall[6] is not started yet
command="start" command="start"
else else
# the command is safe-restart and the firewall is already running # the command is safe-restart and the firewall is already running
@ -1200,14 +1230,14 @@ try_command() {
[ -n "$STARTUP_ENABLED" ] || fatal_error "Startup is disabled" [ -n "$STARTUP_ENABLED" ] || fatal_error "Startup is disabled"
if shorewall_is_started; then if product_is_started; then
running=Yes running=Yes
else else
running= running=
fi fi
if [ -z "$running" ]; then if [ -z "$running" ]; then
# shorewall is not started yet # shorewall[6] is not started yet
command="start" command="start"
else else
# the firewall is already running # the firewall is already running
@ -1289,7 +1319,7 @@ reload_command() # $* = original arguments less the command.
local libexec local libexec
libexec=/usr/share libexec=/usr/share
litedir=/var/lib/shorewall-lite litedir=/var/lib/${g_program}-lite
while [ $finished -eq 0 -a $# -gt 0 ]; do while [ $finished -eq 0 -a $# -gt 0 ]; do
option=$1 option=$1
@ -1344,11 +1374,11 @@ reload_command() # $* = original arguments less the command.
;; ;;
esac esac
temp=$(rsh_command /sbin/shorewall-lite show config 2> /dev/null | grep ^LITEDIR | sed 's/LITEDIR is //') temp=$(rsh_command /sbin/${g_program}-lite show config 2> /dev/null | grep ^LITEDIR | sed 's/LITEDIR is //')
[ -n "$temp" ] && litedir="$temp" [ -n "$temp" ] && litedir="$temp"
temp=$(rsh_command /sbin/shorewall-lite show config 2> /dev/null | grep ^LIBEXEC | sed 's/LIBEXEC is //') temp=$(rsh_command /sbin/${g_program}-lite show config 2> /dev/null | grep ^LIBEXEC | sed 's/LIBEXEC is //')
if [ -n "$temp" ]; then if [ -n "$temp" ]; then
case $temp in case $temp in
@ -1368,12 +1398,12 @@ reload_command() # $* = original arguments less the command.
[ -f $capabilities ] || getcaps=Yes [ -f $capabilities ] || getcaps=Yes
fi fi
if [ -f $directory/shorewall.conf ]; then if [ -f $directory/${g_program}.conf ]; then
if [ -f $directory/params ]; then if [ -f $directory/params ]; then
. $directory/params . $directory/params
fi fi
. $directory/shorewall.conf . $directory/$g_program.conf
ensure_config_path ensure_config_path
fi fi
@ -1382,7 +1412,11 @@ reload_command() # $* = original arguments less the command.
[ -n "$DONT_LOAD" ] && DONT_LOAD="$(echo $DONT_LOAD | tr ',' ' ')" [ -n "$DONT_LOAD" ] && DONT_LOAD="$(echo $DONT_LOAD | tr ',' ' ')"
progress_message "Getting Capabilities on system $system..." progress_message "Getting Capabilities on system $system..."
if ! rsh_command "MODULESDIR=$MODULESDIR MODULE_SUFFIX=\"$MODULE_SUFFIX\" IPTABLES=$IPTABLES DONT_LOAD=\"$DONT_LOAD\" $libexec/shorewall-lite/shorecap" > $directory/capabilities; then if [ $g_family -eq 4 ]; then
if ! rsh_command "MODULESDIR=$MODULESDIR MODULE_SUFFIX=\"$MODULE_SUFFIX\" IPTABLES=$IPTABLES DONT_LOAD=\"$DONT_LOAD\" $libexec/shorewall-lite/shorecap" > $directory/capabilities; then
fatal_error "Capturing capabilities on system $system failed"
fi
elif ! rsh_command "MODULESDIR=$MODULESDIR MODULE_SUFFIX=\"$MODULE_SUFFIX\" IP6TABLES=$IP6TABLES DONT_LOAD=\"$DONT_LOAD\" $libexec/shorewall6-lite/shorecap" > $directory/capabilities; then
fatal_error "Capturing capabilities on system $system failed" fatal_error "Capturing capabilities on system $system failed"
fi fi
fi fi
@ -1391,25 +1425,25 @@ reload_command() # $* = original arguments less the command.
[ -n "$g_timestamp" ] && timestamp='-t' || timestamp= [ -n "$g_timestamp" ] && timestamp='-t' || timestamp=
if shorewall $g_debugging $verbose $timestamp compile -e $directory $directory/firewall && \ if $g_program $g_debugging $verbose $timestamp compile -e $directory $directory/firewall && \
progress_message3 "Copying $file and ${file}.conf to ${system}:${litedir}..." && \ progress_message3 "Copying $file and ${file}.conf to ${system}:${litedir}..." && \
rcp_command "$directory/firewall $directory/firewall.conf" ${litedir} rcp_command "$directory/firewall $directory/firewall.conf" ${litedir}
then then
save=$(find_file save); save=$(find_file save);
[ -f $save ] && progress_message3 "Copying $save to ${system}:/etc/shorewall-lite/" && rcp_command $save /etc/shorewall-lite/ [ -f $save ] && progress_message3 "Copying $save to ${system}:/etc/${g_program}-lite/" && rcp_command $save /etc/shorewall-lite/
progress_message3 "Copy complete" progress_message3 "Copy complete"
if [ $COMMAND = reload ]; then if [ $COMMAND = reload ]; then
rsh_command "/sbin/shorewall-lite $g_debugging $verbose $timestamp restart" && \ rsh_command "/sbin/${g_program}-lite $g_debugging $verbose $timestamp restart" && \
progress_message3 "System $system reloaded" || saveit= progress_message3 "System $system reloaded" || saveit=
else else
rsh_command "/sbin/shorewall-lite $g_debugging $verbose $timestamp start" && \ rsh_command "/sbin/${g_program}-lite $g_debugging $verbose $timestamp start" && \
progress_message3 "System $system loaded" || saveit= progress_message3 "System $system loaded" || saveit=
fi fi
if [ -n "$saveit" ]; then if [ -n "$saveit" ]; then
rsh_command "/sbin/shorewall-lite $g_debugging $verbose $timestamp save" && \ rsh_command "/sbin/${g_program}-lite $g_debugging $verbose $timestamp save" && \
progress_message3 "Configuration on system $system saved" progress_message3 "Configuration on system $system saved"
fi fi
fi fi
@ -1464,7 +1498,7 @@ export_command() # $* = original arguments less the command.
target=$2 target=$2
;; ;;
*) *)
fatal_error "Invalid command syntax (\"man shorewall\" for help)" fatal_error "Invalid command syntax (\"man $g_program\" for help)"
;; ;;
esac esac
@ -1478,7 +1512,7 @@ export_command() # $* = original arguments less the command.
file=$(resolve_file $directory/firewall) file=$(resolve_file $directory/firewall)
if shorewall $g_debugging $verbose compile -e $directory $directory/firewall && \ if $g_program $g_debugging $verbose compile -e $directory $directory/firewall && \
echo "Copying $file and ${file}.conf to ${target#*@}..." && \ echo "Copying $file and ${file}.conf to ${target#*@}..." && \
scp $directory/firewall $directory/firewall.conf $target scp $directory/firewall $directory/firewall.conf $target
then then
@ -1510,16 +1544,26 @@ usage() # $1 = exit status
echo " export [ <directory1> ] [<user>@]<system>[:<directory2>]" echo " export [ <directory1> ] [<user>@]<system>[:<directory2>]"
echo " forget [ <file name> ]" echo " forget [ <file name> ]"
echo " help" echo " help"
echo " hits [ -t ]"
echo " ipcalc { <address>/<vlsm> | <address> <netmask> }" if [ $g_family -eq 4 ]; then
echo " ipdecimal { <address> | <integer> }" echo " hits [ -t ]"
echo " iprange <address>-<address>" echo " ipcalc { <address>/<vlsm> | <address> <netmask> }"
echo " ipdecimal { <address> | <integer> }"
echo " iprange <address>-<address>"
fi
echo " iptrace <iptables match expression>" echo " iptrace <iptables match expression>"
echo " load [ -s ] [ -c ] [ -r <root user> ] [ <directory> ] <system>" echo " load [ -s ] [ -c ] [ -r <root user> ] [ <directory> ] <system>"
echo " logdrop <address> ..." echo " logdrop <address> ..."
echo " logreject <address> ..." echo " logreject <address> ..."
echo " logwatch [<refresh interval>]" echo " logwatch [<refresh interval>]"
echo " noiptrace <iptables match expression>"
if [ $g_family -eq 4 ]; then
echo " noiptrace <iptables match expression>"
else
echo " noiptrace <ip6tables match expression>"
fi
echo " refresh [ <chain>... ]" echo " refresh [ <chain>... ]"
echo " reject <address> ..." echo " reject <address> ..."
echo " reload [ -s ] [ -c ] [ -r <root user> ] [ <directory> ] <system>" echo " reload [ -s ] [ -c ] [ -r <root user> ] [ <directory> ] <system>"
@ -1538,7 +1582,7 @@ usage() # $1 = exit status
echo " show dynamic <zone>" echo " show dynamic <zone>"
echo " show filters" echo " show filters"
echo " show ip" echo " show ip"
echo " show ipa" [ $g_family -eq 4 ] && echo " show ipa"
echo " show [ -m ] log [<regex>]" echo " show [ -m ] log [<regex>]"
echo " show macro <macro>" echo " show macro <macro>"
echo " show macros" echo " show macros"
@ -1599,8 +1643,8 @@ version_command() {
echo $SHOREWALL_VERSION echo $SHOREWALL_VERSION
if [ -n "$all" ]; then if [ -n "$all" ]; then
for product in shorewall6 shorewall-lite shorewall6-lite shorewall-init; do for product in shorewall shorewall6 shorewall-lite shorewall6-lite shorewall-init; do
if [ -f /usr/share/$product/version ]; then if [ $product != $g_program -a -f /usr/share/$product/version ]; then
echo "$product: $(cat /usr/share/$product/version)" echo "$product: $(cat /usr/share/$product/version)"
fi fi
done done
@ -1748,9 +1792,22 @@ fi
PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin
MUTEX_TIMEOUT= MUTEX_TIMEOUT=
SHAREDIR=/usr/share/shorewall g_program=$(basename $0)
CONFDIR=/etc/shorewall
g_product="Shorewall" if [ $g_program = shorewall6 ]; then
SHAREDIR=/usr/share/shorewall6
CONFDIR=/etc/shorewall6
g_product="Shorewall6"
g_family=6
g_tool=
else
g_program=shorewall
SHAREDIR=/usr/share/shorewall
CONFDIR=/etc/shorewall
g_product="Shorewall"
g_family=4
fi
g_recovering= g_recovering=
g_timestamp= g_timestamp=
g_libexec=/usr/share g_libexec=/usr/share
@ -1758,7 +1815,7 @@ g_perllib=/usr/share/shorewall
[ -f ${CONFDIR}/vardir ] && . ${CONFDIR}/vardir [ -f ${CONFDIR}/vardir ] && . ${CONFDIR}/vardir
[ -n "${VARDIR:=/var/lib/shorewall}" ] [ -n "${VARDIR:=/var/lib/$g_program}" ]
if [ ! -f ${VARDIR}/firewall ]; then if [ ! -f ${VARDIR}/firewall ]; then
[ -f ${VARDIR}/.restore ] && cp -f ${VARDIR}/.restore ${VARDIR}/firewall [ -f ${VARDIR}/.restore ] && cp -f ${VARDIR}/.restore ${VARDIR}/firewall
@ -1774,12 +1831,12 @@ version_file=$SHAREDIR/version
if [ -f $version_file ]; then if [ -f $version_file ]; then
SHOREWALL_VERSION=$(cat $version_file) SHOREWALL_VERSION=$(cat $version_file)
else else
echo " ERROR: Shorewall is not properly installed" >&2 echo " ERROR: $g_product is not properly installed" >&2
echo " The file $version_file does not exist" >&2 echo " The file $version_file does not exist" >&2
exit 1 exit 1
fi fi
banner="Shorewall-$SHOREWALL_VERSION Status at $g_hostname -" banner="${g_product}-${SHOREWALL_VERSION} Status at $g_hostname -"
case $(echo -e) in case $(echo -e) in
-e*) -e*)
@ -1812,7 +1869,7 @@ case "$COMMAND" in
stop|clear) stop|clear)
[ $# -ne 1 ] && usage 1 [ $# -ne 1 ] && usage 1
get_config get_config
[ -x $g_firewall ] || fatal_error "Shorewall has never been started" [ -x $g_firewall ] || fatal_error "$g_product has never been started"
[ -n "$nolock" ] || mutex_on [ -n "$nolock" ] || mutex_on
run_it $g_firewall $g_debugging $COMMAND run_it $g_firewall $g_debugging $COMMAND
[ -n "$nolock" ] || mutex_off [ -n "$nolock" ] || mutex_off
@ -1821,7 +1878,7 @@ case "$COMMAND" in
get_config get_config
shift shift
[ -n "$nolock" ] || mutex_on [ -n "$nolock" ] || mutex_on
[ -x $g_firewall ] || fatal_error "Shorewall has never been started" [ -x $g_firewall ] || fatal_error "$g_product has never been started"
run_it $g_firewall $g_debugging reset $@ run_it $g_firewall $g_debugging reset $@
[ -n "$nolock" ] || mutex_off [ -n "$nolock" ] || mutex_off
;; ;;
@ -1852,7 +1909,7 @@ case "$COMMAND" in
;; ;;
disable|enable) disable|enable)
get_config Yes get_config Yes
if shorewall_is_started; then if product_is_started; then
run_it ${VARDIR}/firewall $g_debugging $@ run_it ${VARDIR}/firewall $g_debugging $@
else else
fatal_error "Shorewall is not running" fatal_error "Shorewall is not running"
@ -1877,13 +1934,13 @@ case "$COMMAND" in
[ $# -eq 1 ] || usage 1 [ $# -eq 1 ] || usage 1
[ "$(id -u)" != 0 ] && fatal_error "The status command may only be run by root" [ "$(id -u)" != 0 ] && fatal_error "The status command may only be run by root"
get_config get_config
echo "Shorewall-$SHOREWALL_VERSION Status at $g_hostname - $(date)" echo "${g_product}-$SHOREWALL_VERSION Status at $g_hostname - $(date)"
echo echo
if shorewall_is_started ; then if product_is_started ; then
echo "Shorewall is running" echo "$g_product is running"
status=0 status=0
else else
echo "Shorewall is stopped" echo "$g_product is stopped"
status=4 status=4
fi fi
@ -1907,6 +1964,7 @@ case "$COMMAND" in
dump_command $@ dump_command $@
;; ;;
hits) hits)
[ $g_family -eq 6 ] && usage 1
get_config Yes No Yes get_config Yes No Yes
[ -n "$g_debugging" ] && set -x [ -n "$g_debugging" ] && set -x
shift shift
@ -1923,14 +1981,14 @@ case "$COMMAND" in
;; ;;
logwatch) logwatch)
get_config Yes Yes Yes get_config Yes Yes Yes
banner="Shorewall-$SHOREWALL_VERSION Logwatch at $g_hostname -" banner="${g_product}-$SHOREWALL_VERSION Logwatch at $g_hostname -"
logwatch_command $@ logwatch_command $@
;; ;;
drop) drop)
get_config get_config
[ -n "$g_debugging" ] && set -x [ -n "$g_debugging" ] && set -x
[ $# -eq 1 ] && usage 1 [ $# -eq 1 ] && usage 1
if shorewall_is_started ; then if product_is_started ; then
if ! chain_exists dynamic; then if ! chain_exists dynamic; then
echo "Dynamic blacklisting is not supported in the current $g_product configuration" echo "Dynamic blacklisting is not supported in the current $g_product configuration"
exit 2 exit 2
@ -1940,14 +1998,14 @@ case "$COMMAND" in
block DROP Dropped $* block DROP Dropped $*
[ -n "$nolock" ] || mutex_off [ -n "$nolock" ] || mutex_off
else else
fatal_error "Shorewall is not started" fatal_error "$g_product is not started"
fi fi
;; ;;
logdrop) logdrop)
get_config get_config
[ -n "$g_debugging" ] && set -x [ -n "$g_debugging" ] && set -x
[ $# -eq 1 ] && usage 1 [ $# -eq 1 ] && usage 1
if shorewall_is_started ; then if product_is_started ; then
if ! chain_exists dynamic; then if ! chain_exists dynamic; then
echo "Dynamic blacklisting is not supported in the current $g_product configuration" echo "Dynamic blacklisting is not supported in the current $g_product configuration"
exit 2 exit 2
@ -1957,19 +2015,19 @@ case "$COMMAND" in
block logdrop Dropped $* block logdrop Dropped $*
[ -n "$nolock" ] || mutex_off [ -n "$nolock" ] || mutex_off
else else
fatal_error "Shorewall is not started" fatal_error "$g_product is not started"
fi fi
;; ;;
reject|logreject) reject|logreject)
get_config get_config
[ -n "$g_debugging" ] && set -x [ -n "$g_debugging" ] && set -x
[ $# -eq 1 ] && usage 1 [ $# -eq 1 ] && usage 1
if shorewall_is_started ; then if product_is_started ; then
[ -n "$nolock" ] || mutex_on [ -n "$nolock" ] || mutex_on
block $COMMAND Rejected $* block $COMMAND Rejected $*
[ -n "$nolock" ] || mutex_off [ -n "$nolock" ] || mutex_off
else else
fatal_error "Shorewall is not started" fatal_error "$g_product is not started"
fi fi
;; ;;
allow) allow)
@ -2036,11 +2094,12 @@ case "$COMMAND" in
rm -f ${g_restorepath}-ipsets rm -f ${g_restorepath}-ipsets
echo " $g_restorepath removed" echo " $g_restorepath removed"
elif [ -f $g_restorepath ]; then elif [ -f $g_restorepath ]; then
echo " $g_restorepath exists and is not a saved Shorewall configuration" echo " $g_restorepath exists and is not a saved $g_product configuration"
fi fi
rm -f ${VARDIR}/save rm -f ${VARDIR}/save
;; ;;
ipcalc) ipcalc)
[ $g_family -eq 6 ] && usage 1
[ -n "$g_debugging" ] && set -x [ -n "$g_debugging" ] && set -x
if [ $# -eq 2 ]; then if [ $# -eq 2 ]; then
address=${2%/*} address=${2%/*}
@ -2120,20 +2179,20 @@ case "$COMMAND" in
get_config get_config
shift shift
if shorewall_is_started ; then if shorewall_is_started ; then
$IPTABLES -t raw -A PREROUTING $@ -j TRACE $g_tool -t raw -A PREROUTING $@ -j TRACE
$IPTABLES -t raw -A OUTPUT $@ -j TRACE $g_tool -t raw -A OUTPUT $@ -j TRACE
else else
fatal_error "Shorewall is not started" fatal_error "$g_product is not started"
fi fi
;; ;;
noiptrace) noiptrace)
get_config get_config
shift shift
if shorewall_is_started ; then if shorewall_is_started ; then
$IPTABLES -t raw -D PREROUTING $@ -j TRACE $g_tool -t raw -D PREROUTING $@ -j TRACE
$IPTABLES -t raw -D OUTPUT $@ -j TRACE $g_tool -t raw -D OUTPUT $@ -j TRACE
else else
fatal_error "Shorewall is not started" fatal_error "$g_product is not started"
fi fi
;; ;;
*) *)