mirror of
https://gitlab.com/shorewall/code.git
synced 2024-11-08 00:34:04 +01:00
Implement common lib.base, lib.cli and CLI for Shorewall[6][-lite]
Signed-off-by: Tom Eastep <teastep@shorewall.net>
This commit is contained in:
Tom Eastep
parent
dbf75af411
commit
4161c35108
@ -25,65 +25,6 @@
|
||||
#
|
||||
# If an error occurs while starting or restarting the firewall, the
|
||||
# firewall is automatically stopped.
|
||||
#
|
||||
# Commands are:
|
||||
#
|
||||
# shorewall-lite dump Dumps all Shorewall-related information
|
||||
# for problem analysis
|
||||
# shorewall-lite start Starts the firewall
|
||||
# shorewall-lite restart Restarts the firewall
|
||||
# shorewall-lite stop Stops the firewall
|
||||
# shorewall-lite status Displays firewall status
|
||||
# shorewall-lite reset Resets iptables packet and
|
||||
# byte counts
|
||||
# shorewall-lite clear Open the floodgates by
|
||||
# removing all iptables rules
|
||||
# and setting the three permanent
|
||||
# chain policies to ACCEPT
|
||||
# shorewall-lite show <chain> [ <chain> ... ] Display the rules in each <chain> listed
|
||||
# shorewall-lite show log Print the last 20 log messages
|
||||
# shorewall-lite show connections Show the kernel's connection
|
||||
# tracking table
|
||||
# shorewall-lite show nat Display the rules in the nat table
|
||||
# shorewall-lite show {mangle|tos} Display the rules in the mangle table
|
||||
# shorewall-lite show tc Display traffic control info
|
||||
# shorewall-lite show classifiers Display classifiers
|
||||
# shorewall-lite show capabilities Display iptables/kernel capabilities
|
||||
# shorewall-lite show vardir Display VARDIR setting
|
||||
# shorewall-lite version Display the installed version id
|
||||
# shorewall-lite logwatch [ refresh-interval ] Monitor the local log for Shorewall
|
||||
# messages.
|
||||
# shorewall-lite drop <address> ... Temporarily drop all packets from the
|
||||
# listed address(es)
|
||||
# shorewall-lite reject <address> ... Temporarily reject all packets from the
|
||||
# listed address(es)
|
||||
# shorewall-lite allow <address> ... Reenable address(es) previously
|
||||
# disabled with "drop" or "reject"
|
||||
# shorewall-lite save [ <file> ] Save the list of "rejected" and
|
||||
# "dropped" addresses so that it will
|
||||
# be automatically reinstated the
|
||||
# next time that Shorewall starts.
|
||||
# Save the current state so that 'shorewall
|
||||
# restore' can be used.
|
||||
#
|
||||
# shorewall-lite forget [ <file> ] Discard the data saved by 'shorewall save'
|
||||
#
|
||||
# shorewall-lite restore [ <file> ] Restore the state of the firewall from
|
||||
# previously saved information.
|
||||
#
|
||||
# shorewall-lite ipaddr { <address>/<cidr> | <address> <netmask> }
|
||||
#
|
||||
# Displays information about the network
|
||||
# defined by the argument[s]
|
||||
#
|
||||
# shorewall-lite iprange <address>-<address> Decomposes a range of IP addresses into
|
||||
# a list of network/host addresses.
|
||||
#
|
||||
# shorewall-lite ipdecimal { <address> | <integer> }
|
||||
#
|
||||
# Displays the decimal equivalent of an IP
|
||||
# address and vice versa.
|
||||
|
||||
#
|
||||
# Set the configuration variables from shorewall-lite.conf
|
||||
#
|
||||
@ -113,17 +54,36 @@ get_config() {
|
||||
|
||||
[ -n "$FW" ] || FW=fw
|
||||
|
||||
if [ -n "$IPTABLES" ]; then
|
||||
if [ ! -x "$IPTABLES" ]; then
|
||||
echo " ERROR: The program specified in IPTABLES does not exist or is not executable" >&2
|
||||
exit 2
|
||||
if [ $g_family -eq 4 ]; then
|
||||
if [ -n "$IPTABLES" ]; then
|
||||
if [ ! -x "$IPTABLES" ]; then
|
||||
echo " ERROR: The program specified in IPTABLES does not exist or is not executable" >&2
|
||||
exit 2
|
||||
fi
|
||||
else
|
||||
IPTABLES=$(mywhich iptables 2> /dev/null)
|
||||
if [ -z "$IPTABLES" ] ; then
|
||||
echo " ERROR: Can't find iptables executable" >&2
|
||||
exit 2
|
||||
fi
|
||||
fi
|
||||
|
||||
g_tool=#$IPTABLES
|
||||
else
|
||||
IPTABLES=$(mywhich iptables 2> /dev/null)
|
||||
if [ -z "$IPTABLES" ] ; then
|
||||
echo " ERROR: Can't find iptables executable" >&2
|
||||
exit 2
|
||||
if [ -n "$IP6TABLES" ]; then
|
||||
if [ ! -x "$IP6TABLES" ]; then
|
||||
echo " ERROR: The program specified in IP6TABLES does not exist or is not executable" >&2
|
||||
exit 2
|
||||
fi
|
||||
else
|
||||
IP6TABLES=$(mywhich ip6tables 2> /dev/null)
|
||||
if [ -z "$IP6TABLES" ] ; then
|
||||
echo " ERROR: Can't find ip6tables executable" >&2
|
||||
exit 2
|
||||
fi
|
||||
fi
|
||||
|
||||
g_tool=$IP6TABLES
|
||||
fi
|
||||
|
||||
if [ -n "$SHOREWALL_SHELL" ]; then
|
||||
@ -165,7 +125,7 @@ get_config() {
|
||||
#
|
||||
verify_firewall_script() {
|
||||
if [ ! -f $g_firewall ]; then
|
||||
echo " ERROR: Shorewall Lite is not properly installed" >&2
|
||||
echo " ERROR: $g_product is not properly installed" >&2
|
||||
if [ -L $g_firewall ]; then
|
||||
echo " $g_firewall is a symbolic link to a" >&2
|
||||
echo " non-existant file" >&2
|
||||
@ -203,7 +163,7 @@ start_command() {
|
||||
rc=$?
|
||||
else
|
||||
error_message "${LITEDIR}/firewall is missing or is not executable"
|
||||
logger -p kern.err "ERROR:Shorewall Lite start failed"
|
||||
logger -p kern.err "ERROR:$g_product start failed"
|
||||
rc=2
|
||||
fi
|
||||
|
||||
@ -213,8 +173,13 @@ start_command() {
|
||||
|
||||
verify_firewall_script
|
||||
|
||||
if shorewall_is_started; then
|
||||
error_message "Shorewall is already running"
|
||||
if product_is_started; then
|
||||
if [ $g_family -eq 4 ]; then
|
||||
error_message "Shorewall is already running"
|
||||
else
|
||||
error_message "Shorewall6 is already running"
|
||||
fi
|
||||
|
||||
exit 0
|
||||
fi
|
||||
|
||||
@ -271,10 +236,10 @@ start_command() {
|
||||
g_restorepath=${VARDIR}/$RESTOREFILE
|
||||
|
||||
if [ -x $g_restorepath ]; then
|
||||
echo Restoring Shorewall Lite...
|
||||
echo Restoring $g_product...
|
||||
run_it $g_restorepath restore
|
||||
date > ${VARDIR}/restarted
|
||||
progress_message3 Shorewall Lite restored from $g_restorepath
|
||||
progress_message3 $g_product restored from $g_restorepath
|
||||
else
|
||||
do_it
|
||||
fi
|
||||
@ -346,7 +311,7 @@ restart_command() {
|
||||
rc=$?
|
||||
else
|
||||
error_message "${LITEDIR}/firewall is missing or is not executable"
|
||||
logger -p kern.err "ERROR:Shorewall Lite restart failed"
|
||||
logger -p kern.err "ERROR:$g_product restart failed"
|
||||
rc=2
|
||||
fi
|
||||
|
||||
@ -371,9 +336,13 @@ usage() # $1 = exit status
|
||||
echo " enable <interface>"
|
||||
echo " forget [ <file name> ]"
|
||||
echo " help"
|
||||
echo " ipcalc { <address>/<vlsm> | <address> <netmask> }"
|
||||
echo " ipdecimal { <address> | <integer> }"
|
||||
echo " iprange <address>-<address>"
|
||||
|
||||
if [ $g_family -eq 4 ]; then
|
||||
echo " ipcalc { <address>/<vlsm> | <address> <netmask> }"
|
||||
echo " ipdecimal { <address> | <integer> }"
|
||||
echo " iprange <address>-<address>"
|
||||
fi
|
||||
|
||||
echo " logdrop <address> ..."
|
||||
echo " logreject <address> ..."
|
||||
echo " logwatch [<refresh interval>]"
|
||||
@ -390,7 +359,7 @@ usage() # $1 = exit status
|
||||
echo " show filters"
|
||||
echo " show ip"
|
||||
echo " show [ -m ] log [<regex>]"
|
||||
echo " show [ -x ] mangle|nat|raw|routing"
|
||||
echo " show [ -x ] mangle|nat|raw|rawpost|routing"
|
||||
echo " show policies"
|
||||
echo " show tc [ device ]"
|
||||
echo " show vardir"
|
||||
@ -444,8 +413,8 @@ version_command() {
|
||||
echo $SHOREWALL_VERSION
|
||||
|
||||
if [ -n "$all" ]; then
|
||||
for product in shorewall shorewall6 shorewall6-lite shorewall-init; do
|
||||
if [ -f /usr/share/$product/version ]; then
|
||||
for product in shorewall shorewall6 shorewall-lite shorewall6-lite shorewall-init; do
|
||||
if [ $product ~= $g_program] && [ -f /usr/share/$product/version ]; then
|
||||
echo "$product: $(cat /usr/share/$product/version)"
|
||||
fi
|
||||
done
|
||||
@ -476,6 +445,7 @@ g_use_verbosity=
|
||||
g_noroutes=
|
||||
g_timestamp=
|
||||
g_recovering=
|
||||
g_purge=
|
||||
g_logread=
|
||||
|
||||
#
|
||||
@ -569,14 +539,30 @@ fi
|
||||
PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin
|
||||
MUTEX_TIMEOUT=
|
||||
|
||||
SHAREDIR=/usr/share/shorewall-lite
|
||||
CONFDIR=/etc/shorewall-lite
|
||||
g_product="Shorewall Lite"
|
||||
g_program=$(basename $0)
|
||||
|
||||
if [ $g_program = shorewall6-lite ]; then
|
||||
SHAREDIR=/usr/share/shorewall6-lite
|
||||
CONFDIR=/etc/shorewall6-lite
|
||||
g_product="Shorewall6 Lite"
|
||||
g_family=6
|
||||
g_base=shorewall6
|
||||
g_tool=ip6tables
|
||||
else
|
||||
g_program=shorewall-lite
|
||||
SHAREDIR=/usr/share/shorewall-lite
|
||||
CONFDIR=/etc/shorewall-lite
|
||||
g_product="Shorewall Lite"
|
||||
g_family=4
|
||||
g_base=shorewall
|
||||
g_tool=iptables
|
||||
fi
|
||||
|
||||
g_libexec=share
|
||||
|
||||
[ -f ${CONFDIR}/vardir ] && . ${CONFDIR}/vardir ]
|
||||
|
||||
[ -n "${VARDIR:=/var/lib/shorewall-lite}" ]
|
||||
[ -n "${VARDIR:=/var/lib/${g_base}-lite}" ]
|
||||
|
||||
[ -d $VARDIR ] || mkdir -p $VARDIR || fatal_error "Unable to create $VARDIR"
|
||||
|
||||
@ -588,7 +574,7 @@ done
|
||||
|
||||
ensure_config_path
|
||||
|
||||
config=$(find_file shorewall-lite.conf)
|
||||
config=$(find_file ${g_base}-lite.conf)
|
||||
|
||||
if [ -f $config ]; then
|
||||
if [ -r $config ]; then
|
||||
@ -615,12 +601,12 @@ g_firewall=$LITEDIR/firewall
|
||||
if [ -f $version_file ]; then
|
||||
SHOREWALL_VERSION=$(cat $version_file)
|
||||
else
|
||||
echo " ERROR: Shorewall Lite is not properly installed" >&2
|
||||
echo " ERROR: $g_product is not properly installed" >&2
|
||||
echo " The file $version_file does not exist" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
banner="Shorewall Lite $SHOREWALL_VERSION Status at $g_hostname -"
|
||||
banner="$g_product $SHOREWALL_VERSION Status at $g_hostname -"
|
||||
|
||||
case $(echo -e) in
|
||||
-e*)
|
||||
@ -658,7 +644,7 @@ case "$COMMAND" in
|
||||
;;
|
||||
restart)
|
||||
shift
|
||||
restart_command
|
||||
restart_command @
|
||||
;;
|
||||
show|list)
|
||||
shift
|
||||
@ -667,13 +653,13 @@ case "$COMMAND" in
|
||||
status)
|
||||
[ $# -eq 1 ] || usage 1
|
||||
[ "$(id -u)" != 0 ] && fatal_error "The status command may only be run by root"
|
||||
echo "Shorewall Lite $SHOREWALL_VERSION Status at $g_hostname - $(date)"
|
||||
echo "$g_product $SHOREWALL_VERSION Status at $g_hostname - $(date)"
|
||||
echo
|
||||
if shorewall_is_started ; then
|
||||
echo "Shorewall Lite is running"
|
||||
if product_is_started ; then
|
||||
echo "$g_product is running"
|
||||
status=0
|
||||
else
|
||||
echo "Shorewall Lite is stopped"
|
||||
echo "$g_product is stopped"
|
||||
status=4
|
||||
fi
|
||||
|
||||
@ -710,36 +696,36 @@ case "$COMMAND" in
|
||||
drop)
|
||||
[ -n "$debugging" ] && set -x
|
||||
[ $# -eq 1 ] && usage 1
|
||||
if shorewall_is_started ; then
|
||||
if product_is_started ; then
|
||||
[ -n "$nolock" ] || mutex_on
|
||||
block DROP Dropped $*
|
||||
[ -n "$nolock" ] || mutex_off
|
||||
else
|
||||
error_message "ERROR: Shorewall Lite is not started"
|
||||
error_message "ERROR: $g_product is not started"
|
||||
exit 2
|
||||
fi
|
||||
;;
|
||||
logdrop)
|
||||
[ -n "$debugging" ] && set -x
|
||||
[ $# -eq 1 ] && usage 1
|
||||
if shorewall_is_started ; then
|
||||
if product_is_started ; then
|
||||
[ -n "$nolock" ] || mutex_on
|
||||
block logdrop Dropped $*
|
||||
[ -n "$nolock" ] || mutex_off
|
||||
else
|
||||
error_message "ERROR: Shorewall Lite is not started"
|
||||
error_message "ERROR: $g_product is not started"
|
||||
exit 2
|
||||
fi
|
||||
;;
|
||||
reject|logreject)
|
||||
[ -n "$debugging" ] && set -x
|
||||
[ $# -eq 1 ] && usage 1
|
||||
if shorewall_is_started ; then
|
||||
if product_is_started ; then
|
||||
[ -n "$nolock" ] || mutex_on
|
||||
block $COMMAND Rejected $*
|
||||
[ -n "$nolock" ] || mutex_off
|
||||
else
|
||||
error_message "ERROR: Shorewall Lite is not started"
|
||||
error_message "ERROR: $g_product is not started"
|
||||
exit 2
|
||||
fi
|
||||
;;
|
||||
@ -758,7 +744,7 @@ case "$COMMAND" in
|
||||
;;
|
||||
disable|enable)
|
||||
get_config Yes
|
||||
if shorewall_is_started; then
|
||||
if product_is_started; then
|
||||
run_it ${VARDIR}/firewall $g_debugging $@
|
||||
else
|
||||
fatal_error "Shorewall is not running"
|
||||
|
||||
@ -23,16 +23,17 @@
|
||||
# This library contains the code common to all Shorewall components.
|
||||
#
|
||||
# - It is loaded by /sbin/shorewall.
|
||||
# - It is released as part of Shorewall Lite where it is used by /sbin/shorewall-lite
|
||||
# and /usr/share/shorewall-lite/shorecap.
|
||||
# - It is released as part of Shorewall[6] Lite where it is used by /sbin/shorewall[6]-lite
|
||||
# and /usr/share/shorewall[6]-lite/shorecap.
|
||||
#
|
||||
|
||||
SHOREWALL_LIBVERSION=40407
|
||||
SHOREWALL_CAPVERSION=40426
|
||||
|
||||
[ -n "${VARDIR:=/var/lib/shorewall}" ]
|
||||
[ -n "${SHAREDIR:=/usr/share/shorewall}" ]
|
||||
[ -n "${CONFDIR:=/etc/shorewall}" ]
|
||||
[ -n "${g_program:=shorewall}" ]
|
||||
[ -n "${VARDIR:=/var/lib/$g_program}" ]
|
||||
[ -n "${SHAREDIR:=/usr/share/g_program}" ]
|
||||
[ -n "${CONFDIR:=/etc/$g_program}" ]
|
||||
|
||||
#
|
||||
# Conditionally produce message
|
||||
@ -378,9 +379,8 @@ resolve_file() # $1 = file name
|
||||
esac
|
||||
}
|
||||
|
||||
# Function to truncate a string -- It uses 'cut -b -<n>'
|
||||
# rather than ${v:first:last} because light-weight shells like ash and
|
||||
# dash do not support that form of expansion.
|
||||
#
|
||||
# Determine how to do "echo -e"
|
||||
#
|
||||
|
||||
find_echo() {
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@ -24,11 +24,11 @@
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
#
|
||||
# For a list of supported commands, type 'shorewall help'
|
||||
# For a list of supported commands, type 'shorewall help' or 'shorewall6 help'
|
||||
#
|
||||
################################################################################################
|
||||
#
|
||||
# Set the configuration variables from shorewall.conf
|
||||
# Set the configuration variables from the .conf file
|
||||
#
|
||||
# $1 = Yes: read the params file
|
||||
# $2 = Yes: check for STARTUP_ENABLED
|
||||
@ -47,7 +47,7 @@ get_config() {
|
||||
fi
|
||||
fi
|
||||
|
||||
config=$(find_file shorewall.conf)
|
||||
config=$(find_file $g_program.conf)
|
||||
|
||||
if [ -f $config ]; then
|
||||
if [ -r $config ]; then
|
||||
@ -80,17 +80,36 @@ get_config() {
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ -n "$IPTABLES" ]; then
|
||||
if [ ! -x "$IPTABLES" ]; then
|
||||
echo " ERROR: The program specified in IPTABLES does not exist or is not executable" >&2
|
||||
exit 2
|
||||
if [ $g_family -eq 4 ]; then
|
||||
if [ -n "$IPTABLES" ]; then
|
||||
if [ ! -x "$IPTABLES" ]; then
|
||||
echo " ERROR: The program specified in IPTABLES does not exist or is not executable" >&2
|
||||
exit 2
|
||||
fi
|
||||
else
|
||||
IPTABLES=$(mywhich iptables 2> /dev/null)
|
||||
if [ -z "$IPTABLES" ] ; then
|
||||
echo " ERROR: Can't find iptables executable" >&2
|
||||
exit 2
|
||||
fi
|
||||
fi
|
||||
|
||||
g_tool=$IPTABLES
|
||||
else
|
||||
IPTABLES=$(mywhich iptables 2> /dev/null)
|
||||
if [ -z "$IPTABLES" ] ; then
|
||||
echo " ERROR: Can't find iptables executable" >&2
|
||||
exit 2
|
||||
if [ -n "$IP6TABLES" ]; then
|
||||
if [ ! -x "$IP6TABLES" ]; then
|
||||
echo " ERROR: The program specified in IP6TABLES does not exist or is not executable" >&2
|
||||
exit 2
|
||||
fi
|
||||
else
|
||||
IP6TABLES=$(mywhich ip6tables 2> /dev/null)
|
||||
if [ -z "$IP6TABLES" ] ; then
|
||||
echo " ERROR: Can't find ip6tables executable" >&2
|
||||
exit 2
|
||||
fi
|
||||
fi
|
||||
|
||||
g_tool=$IP6TABLES
|
||||
fi
|
||||
|
||||
if [ -n "$IP" ]; then
|
||||
@ -165,7 +184,7 @@ get_config() {
|
||||
if [ "$2" = Yes ]; then
|
||||
case $STARTUP_ENABLED in
|
||||
No|no|NO)
|
||||
echo " ERROR: Shorewall startup is disabled. To enable startup, set STARTUP_ENABLED=Yes in ${CONFDIR}/shorewall.conf" >&2
|
||||
echo " ERROR: $g_product startup is disabled. To enable startup, set STARTUP_ENABLED=Yes in ${CONFDIR}/${g_program}.conf" >&2
|
||||
exit 2
|
||||
;;
|
||||
Yes|yes|YES)
|
||||
@ -358,8 +377,8 @@ compiler() {
|
||||
pc=$g_libexec/shorewall/compiler.pl
|
||||
|
||||
if [ $(id -u) -ne 0 ]; then
|
||||
if [ -z "$SHOREWALL_DIR" -o "$SHOREWALL_DIR" = /etc/shorewall ]; then
|
||||
startup_error "Ordinary users may not compile the /etc/shorewall configuration"
|
||||
if [ -z "$SHOREWALL_DIR" -o "$SHOREWALL_DIR" = /etc/$g_program ]; then
|
||||
startup_error "Ordinary users may not compile the /etc/$g_program configuration"
|
||||
fi
|
||||
fi
|
||||
#
|
||||
@ -369,7 +388,7 @@ compiler() {
|
||||
#
|
||||
# Get the config from $SHOREWALL_DIR
|
||||
#
|
||||
[ -n "$SHOREWALL_DIR" -a "$SHOREWALL_DIR" != /etc/shorewall ] && get_config
|
||||
[ -n "$SHOREWALL_DIR" -a "$SHOREWALL_DIR" != /etc/$g_program ] && get_config
|
||||
|
||||
case $COMMAND in
|
||||
*start|try|refresh)
|
||||
@ -390,7 +409,7 @@ compiler() {
|
||||
[ "$1" = nolock ] && shift;
|
||||
shift
|
||||
|
||||
options="--verbose=$VERBOSITY --config_path=$CONFIG_PATH"
|
||||
options="--verbose=$VERBOSITY --family=$g_family --config_path=$CONFIG_PATH"
|
||||
[ -n "$STARTUP_LOG" ] && options="$options --log=$STARTUP_LOG"
|
||||
[ -n "$LOG_VERBOSITY" ] && options="$options --log_verbosity=$LOG_VERBOSITY";
|
||||
[ -n "$g_export" ] && options="$options --export"
|
||||
@ -423,6 +442,17 @@ compiler() {
|
||||
fi
|
||||
}
|
||||
|
||||
#
|
||||
# Determine if the current product is in the started state
|
||||
#
|
||||
product_is_started() {
|
||||
if [ $g_family -eq 4 ]; then
|
||||
shorewall_is_started
|
||||
else
|
||||
shorewall6_is_started
|
||||
fi
|
||||
}
|
||||
|
||||
#
|
||||
# Start Command Executor
|
||||
#
|
||||
@ -449,14 +479,14 @@ start_command() {
|
||||
[ -n "$nolock" ] || mutex_off
|
||||
else
|
||||
rc=$?
|
||||
logger -p kern.err "ERROR:Shorewall start failed"
|
||||
logger -p kern.err "ERROR:$g_product start failed"
|
||||
fi
|
||||
fi
|
||||
|
||||
exit $rc
|
||||
}
|
||||
|
||||
if shorewall_is_started; then
|
||||
if product_is_started; then
|
||||
error_message "Shorewall is already running"
|
||||
exit 0
|
||||
fi
|
||||
@ -552,7 +582,7 @@ start_command() {
|
||||
run_it $g_restorepath restore
|
||||
rc=$?
|
||||
[ -n "$nolock" ] || mutex_off
|
||||
[ $rc -eq 0 ] && progress_message3 "Shorewall restored from $g_restorepath"
|
||||
[ $rc -eq 0 ] && progress_message3 "$g_product restored from $g_restorepath"
|
||||
exit $rc
|
||||
else
|
||||
do_it
|
||||
@ -916,7 +946,7 @@ restart_command() {
|
||||
[ -n "$nolock" ] || mutex_off
|
||||
else
|
||||
rc=$?
|
||||
logger -p kern.err "ERROR:Shorewall restart failed"
|
||||
logger -p kern.err "ERROR:$g_product restart failed"
|
||||
fi
|
||||
else
|
||||
[ -x ${VARDIR}/firewall ] || fatal_error "No ${VARDIR}/firewall file found"
|
||||
@ -973,7 +1003,7 @@ refresh_command() {
|
||||
g_refreshchains=:refresh:
|
||||
fi
|
||||
|
||||
shorewall_is_started || fatal_error "Shorewall is not running"
|
||||
product_is_started || fatal_error "$g_product is not running"
|
||||
|
||||
[ -n "$STARTUP_ENABLED" ] || fatal_error "Startup is disabled"
|
||||
|
||||
@ -1058,7 +1088,7 @@ safe_commands() {
|
||||
|
||||
[ -n "$STARTUP_ENABLED" ] || fatal_error "Startup is disabled"
|
||||
|
||||
if shorewall_is_started; then
|
||||
if product_is_started; then
|
||||
running=Yes
|
||||
else
|
||||
running=
|
||||
@ -1071,7 +1101,7 @@ safe_commands() {
|
||||
fi
|
||||
|
||||
if [ "$COMMAND" = "safe-start" -o -z "$running" ]; then
|
||||
# the command is safe-start or shorewall is not started yet
|
||||
# the command is safe-start or shorewall[6] is not started yet
|
||||
command="start"
|
||||
else
|
||||
# the command is safe-restart and the firewall is already running
|
||||
@ -1200,14 +1230,14 @@ try_command() {
|
||||
|
||||
[ -n "$STARTUP_ENABLED" ] || fatal_error "Startup is disabled"
|
||||
|
||||
if shorewall_is_started; then
|
||||
if product_is_started; then
|
||||
running=Yes
|
||||
else
|
||||
running=
|
||||
fi
|
||||
|
||||
if [ -z "$running" ]; then
|
||||
# shorewall is not started yet
|
||||
# shorewall[6] is not started yet
|
||||
command="start"
|
||||
else
|
||||
# the firewall is already running
|
||||
@ -1289,7 +1319,7 @@ reload_command() # $* = original arguments less the command.
|
||||
local libexec
|
||||
libexec=/usr/share
|
||||
|
||||
litedir=/var/lib/shorewall-lite
|
||||
litedir=/var/lib/${g_program}-lite
|
||||
|
||||
while [ $finished -eq 0 -a $# -gt 0 ]; do
|
||||
option=$1
|
||||
@ -1344,11 +1374,11 @@ reload_command() # $* = original arguments less the command.
|
||||
;;
|
||||
esac
|
||||
|
||||
temp=$(rsh_command /sbin/shorewall-lite show config 2> /dev/null | grep ^LITEDIR | sed 's/LITEDIR is //')
|
||||
temp=$(rsh_command /sbin/${g_program}-lite show config 2> /dev/null | grep ^LITEDIR | sed 's/LITEDIR is //')
|
||||
|
||||
[ -n "$temp" ] && litedir="$temp"
|
||||
|
||||
temp=$(rsh_command /sbin/shorewall-lite show config 2> /dev/null | grep ^LIBEXEC | sed 's/LIBEXEC is //')
|
||||
temp=$(rsh_command /sbin/${g_program}-lite show config 2> /dev/null | grep ^LIBEXEC | sed 's/LIBEXEC is //')
|
||||
|
||||
if [ -n "$temp" ]; then
|
||||
case $temp in
|
||||
@ -1368,12 +1398,12 @@ reload_command() # $* = original arguments less the command.
|
||||
[ -f $capabilities ] || getcaps=Yes
|
||||
fi
|
||||
|
||||
if [ -f $directory/shorewall.conf ]; then
|
||||
if [ -f $directory/${g_program}.conf ]; then
|
||||
if [ -f $directory/params ]; then
|
||||
. $directory/params
|
||||
fi
|
||||
|
||||
. $directory/shorewall.conf
|
||||
. $directory/$g_program.conf
|
||||
|
||||
ensure_config_path
|
||||
fi
|
||||
@ -1382,7 +1412,11 @@ reload_command() # $* = original arguments less the command.
|
||||
[ -n "$DONT_LOAD" ] && DONT_LOAD="$(echo $DONT_LOAD | tr ',' ' ')"
|
||||
|
||||
progress_message "Getting Capabilities on system $system..."
|
||||
if ! rsh_command "MODULESDIR=$MODULESDIR MODULE_SUFFIX=\"$MODULE_SUFFIX\" IPTABLES=$IPTABLES DONT_LOAD=\"$DONT_LOAD\" $libexec/shorewall-lite/shorecap" > $directory/capabilities; then
|
||||
if [ $g_family -eq 4 ]; then
|
||||
if ! rsh_command "MODULESDIR=$MODULESDIR MODULE_SUFFIX=\"$MODULE_SUFFIX\" IPTABLES=$IPTABLES DONT_LOAD=\"$DONT_LOAD\" $libexec/shorewall-lite/shorecap" > $directory/capabilities; then
|
||||
fatal_error "Capturing capabilities on system $system failed"
|
||||
fi
|
||||
elif ! rsh_command "MODULESDIR=$MODULESDIR MODULE_SUFFIX=\"$MODULE_SUFFIX\" IP6TABLES=$IP6TABLES DONT_LOAD=\"$DONT_LOAD\" $libexec/shorewall6-lite/shorecap" > $directory/capabilities; then
|
||||
fatal_error "Capturing capabilities on system $system failed"
|
||||
fi
|
||||
fi
|
||||
@ -1391,25 +1425,25 @@ reload_command() # $* = original arguments less the command.
|
||||
|
||||
[ -n "$g_timestamp" ] && timestamp='-t' || timestamp=
|
||||
|
||||
if shorewall $g_debugging $verbose $timestamp compile -e $directory $directory/firewall && \
|
||||
if $g_program $g_debugging $verbose $timestamp compile -e $directory $directory/firewall && \
|
||||
progress_message3 "Copying $file and ${file}.conf to ${system}:${litedir}..." && \
|
||||
rcp_command "$directory/firewall $directory/firewall.conf" ${litedir}
|
||||
then
|
||||
save=$(find_file save);
|
||||
|
||||
[ -f $save ] && progress_message3 "Copying $save to ${system}:/etc/shorewall-lite/" && rcp_command $save /etc/shorewall-lite/
|
||||
[ -f $save ] && progress_message3 "Copying $save to ${system}:/etc/${g_program}-lite/" && rcp_command $save /etc/shorewall-lite/
|
||||
|
||||
progress_message3 "Copy complete"
|
||||
if [ $COMMAND = reload ]; then
|
||||
rsh_command "/sbin/shorewall-lite $g_debugging $verbose $timestamp restart" && \
|
||||
rsh_command "/sbin/${g_program}-lite $g_debugging $verbose $timestamp restart" && \
|
||||
progress_message3 "System $system reloaded" || saveit=
|
||||
else
|
||||
rsh_command "/sbin/shorewall-lite $g_debugging $verbose $timestamp start" && \
|
||||
rsh_command "/sbin/${g_program}-lite $g_debugging $verbose $timestamp start" && \
|
||||
progress_message3 "System $system loaded" || saveit=
|
||||
fi
|
||||
|
||||
if [ -n "$saveit" ]; then
|
||||
rsh_command "/sbin/shorewall-lite $g_debugging $verbose $timestamp save" && \
|
||||
rsh_command "/sbin/${g_program}-lite $g_debugging $verbose $timestamp save" && \
|
||||
progress_message3 "Configuration on system $system saved"
|
||||
fi
|
||||
fi
|
||||
@ -1464,7 +1498,7 @@ export_command() # $* = original arguments less the command.
|
||||
target=$2
|
||||
;;
|
||||
*)
|
||||
fatal_error "Invalid command syntax (\"man shorewall\" for help)"
|
||||
fatal_error "Invalid command syntax (\"man $g_program\" for help)"
|
||||
;;
|
||||
esac
|
||||
|
||||
@ -1478,7 +1512,7 @@ export_command() # $* = original arguments less the command.
|
||||
|
||||
file=$(resolve_file $directory/firewall)
|
||||
|
||||
if shorewall $g_debugging $verbose compile -e $directory $directory/firewall && \
|
||||
if $g_program $g_debugging $verbose compile -e $directory $directory/firewall && \
|
||||
echo "Copying $file and ${file}.conf to ${target#*@}..." && \
|
||||
scp $directory/firewall $directory/firewall.conf $target
|
||||
then
|
||||
@ -1510,16 +1544,26 @@ usage() # $1 = exit status
|
||||
echo " export [ <directory1> ] [<user>@]<system>[:<directory2>]"
|
||||
echo " forget [ <file name> ]"
|
||||
echo " help"
|
||||
echo " hits [ -t ]"
|
||||
echo " ipcalc { <address>/<vlsm> | <address> <netmask> }"
|
||||
echo " ipdecimal { <address> | <integer> }"
|
||||
echo " iprange <address>-<address>"
|
||||
|
||||
if [ $g_family -eq 4 ]; then
|
||||
echo " hits [ -t ]"
|
||||
echo " ipcalc { <address>/<vlsm> | <address> <netmask> }"
|
||||
echo " ipdecimal { <address> | <integer> }"
|
||||
echo " iprange <address>-<address>"
|
||||
fi
|
||||
|
||||
echo " iptrace <iptables match expression>"
|
||||
echo " load [ -s ] [ -c ] [ -r <root user> ] [ <directory> ] <system>"
|
||||
echo " logdrop <address> ..."
|
||||
echo " logreject <address> ..."
|
||||
echo " logwatch [<refresh interval>]"
|
||||
echo " noiptrace <iptables match expression>"
|
||||
|
||||
if [ $g_family -eq 4 ]; then
|
||||
echo " noiptrace <iptables match expression>"
|
||||
else
|
||||
echo " noiptrace <ip6tables match expression>"
|
||||
fi
|
||||
|
||||
echo " refresh [ <chain>... ]"
|
||||
echo " reject <address> ..."
|
||||
echo " reload [ -s ] [ -c ] [ -r <root user> ] [ <directory> ] <system>"
|
||||
@ -1538,7 +1582,7 @@ usage() # $1 = exit status
|
||||
echo " show dynamic <zone>"
|
||||
echo " show filters"
|
||||
echo " show ip"
|
||||
echo " show ipa"
|
||||
[ $g_family -eq 4 ] && echo " show ipa"
|
||||
echo " show [ -m ] log [<regex>]"
|
||||
echo " show macro <macro>"
|
||||
echo " show macros"
|
||||
@ -1599,8 +1643,8 @@ version_command() {
|
||||
echo $SHOREWALL_VERSION
|
||||
|
||||
if [ -n "$all" ]; then
|
||||
for product in shorewall6 shorewall-lite shorewall6-lite shorewall-init; do
|
||||
if [ -f /usr/share/$product/version ]; then
|
||||
for product in shorewall shorewall6 shorewall-lite shorewall6-lite shorewall-init; do
|
||||
if [ $product != $g_program -a -f /usr/share/$product/version ]; then
|
||||
echo "$product: $(cat /usr/share/$product/version)"
|
||||
fi
|
||||
done
|
||||
@ -1748,9 +1792,22 @@ fi
|
||||
PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin
|
||||
MUTEX_TIMEOUT=
|
||||
|
||||
SHAREDIR=/usr/share/shorewall
|
||||
CONFDIR=/etc/shorewall
|
||||
g_product="Shorewall"
|
||||
g_program=$(basename $0)
|
||||
|
||||
if [ $g_program = shorewall6 ]; then
|
||||
SHAREDIR=/usr/share/shorewall6
|
||||
CONFDIR=/etc/shorewall6
|
||||
g_product="Shorewall6"
|
||||
g_family=6
|
||||
g_tool=
|
||||
else
|
||||
g_program=shorewall
|
||||
SHAREDIR=/usr/share/shorewall
|
||||
CONFDIR=/etc/shorewall
|
||||
g_product="Shorewall"
|
||||
g_family=4
|
||||
fi
|
||||
|
||||
g_recovering=
|
||||
g_timestamp=
|
||||
g_libexec=/usr/share
|
||||
@ -1758,7 +1815,7 @@ g_perllib=/usr/share/shorewall
|
||||
|
||||
[ -f ${CONFDIR}/vardir ] && . ${CONFDIR}/vardir
|
||||
|
||||
[ -n "${VARDIR:=/var/lib/shorewall}" ]
|
||||
[ -n "${VARDIR:=/var/lib/$g_program}" ]
|
||||
|
||||
if [ ! -f ${VARDIR}/firewall ]; then
|
||||
[ -f ${VARDIR}/.restore ] && cp -f ${VARDIR}/.restore ${VARDIR}/firewall
|
||||
@ -1774,12 +1831,12 @@ version_file=$SHAREDIR/version
|
||||
if [ -f $version_file ]; then
|
||||
SHOREWALL_VERSION=$(cat $version_file)
|
||||
else
|
||||
echo " ERROR: Shorewall is not properly installed" >&2
|
||||
echo " ERROR: $g_product is not properly installed" >&2
|
||||
echo " The file $version_file does not exist" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
banner="Shorewall-$SHOREWALL_VERSION Status at $g_hostname -"
|
||||
banner="${g_product}-${SHOREWALL_VERSION} Status at $g_hostname -"
|
||||
|
||||
case $(echo -e) in
|
||||
-e*)
|
||||
@ -1812,7 +1869,7 @@ case "$COMMAND" in
|
||||
stop|clear)
|
||||
[ $# -ne 1 ] && usage 1
|
||||
get_config
|
||||
[ -x $g_firewall ] || fatal_error "Shorewall has never been started"
|
||||
[ -x $g_firewall ] || fatal_error "$g_product has never been started"
|
||||
[ -n "$nolock" ] || mutex_on
|
||||
run_it $g_firewall $g_debugging $COMMAND
|
||||
[ -n "$nolock" ] || mutex_off
|
||||
@ -1821,7 +1878,7 @@ case "$COMMAND" in
|
||||
get_config
|
||||
shift
|
||||
[ -n "$nolock" ] || mutex_on
|
||||
[ -x $g_firewall ] || fatal_error "Shorewall has never been started"
|
||||
[ -x $g_firewall ] || fatal_error "$g_product has never been started"
|
||||
run_it $g_firewall $g_debugging reset $@
|
||||
[ -n "$nolock" ] || mutex_off
|
||||
;;
|
||||
@ -1852,7 +1909,7 @@ case "$COMMAND" in
|
||||
;;
|
||||
disable|enable)
|
||||
get_config Yes
|
||||
if shorewall_is_started; then
|
||||
if product_is_started; then
|
||||
run_it ${VARDIR}/firewall $g_debugging $@
|
||||
else
|
||||
fatal_error "Shorewall is not running"
|
||||
@ -1877,13 +1934,13 @@ case "$COMMAND" in
|
||||
[ $# -eq 1 ] || usage 1
|
||||
[ "$(id -u)" != 0 ] && fatal_error "The status command may only be run by root"
|
||||
get_config
|
||||
echo "Shorewall-$SHOREWALL_VERSION Status at $g_hostname - $(date)"
|
||||
echo "${g_product}-$SHOREWALL_VERSION Status at $g_hostname - $(date)"
|
||||
echo
|
||||
if shorewall_is_started ; then
|
||||
echo "Shorewall is running"
|
||||
if product_is_started ; then
|
||||
echo "$g_product is running"
|
||||
status=0
|
||||
else
|
||||
echo "Shorewall is stopped"
|
||||
echo "$g_product is stopped"
|
||||
status=4
|
||||
fi
|
||||
|
||||
@ -1907,6 +1964,7 @@ case "$COMMAND" in
|
||||
dump_command $@
|
||||
;;
|
||||
hits)
|
||||
[ $g_family -eq 6 ] && usage 1
|
||||
get_config Yes No Yes
|
||||
[ -n "$g_debugging" ] && set -x
|
||||
shift
|
||||
@ -1923,14 +1981,14 @@ case "$COMMAND" in
|
||||
;;
|
||||
logwatch)
|
||||
get_config Yes Yes Yes
|
||||
banner="Shorewall-$SHOREWALL_VERSION Logwatch at $g_hostname -"
|
||||
banner="${g_product}-$SHOREWALL_VERSION Logwatch at $g_hostname -"
|
||||
logwatch_command $@
|
||||
;;
|
||||
drop)
|
||||
get_config
|
||||
[ -n "$g_debugging" ] && set -x
|
||||
[ $# -eq 1 ] && usage 1
|
||||
if shorewall_is_started ; then
|
||||
if product_is_started ; then
|
||||
if ! chain_exists dynamic; then
|
||||
echo "Dynamic blacklisting is not supported in the current $g_product configuration"
|
||||
exit 2
|
||||
@ -1940,14 +1998,14 @@ case "$COMMAND" in
|
||||
block DROP Dropped $*
|
||||
[ -n "$nolock" ] || mutex_off
|
||||
else
|
||||
fatal_error "Shorewall is not started"
|
||||
fatal_error "$g_product is not started"
|
||||
fi
|
||||
;;
|
||||
logdrop)
|
||||
get_config
|
||||
[ -n "$g_debugging" ] && set -x
|
||||
[ $# -eq 1 ] && usage 1
|
||||
if shorewall_is_started ; then
|
||||
if product_is_started ; then
|
||||
if ! chain_exists dynamic; then
|
||||
echo "Dynamic blacklisting is not supported in the current $g_product configuration"
|
||||
exit 2
|
||||
@ -1957,19 +2015,19 @@ case "$COMMAND" in
|
||||
block logdrop Dropped $*
|
||||
[ -n "$nolock" ] || mutex_off
|
||||
else
|
||||
fatal_error "Shorewall is not started"
|
||||
fatal_error "$g_product is not started"
|
||||
fi
|
||||
;;
|
||||
reject|logreject)
|
||||
get_config
|
||||
[ -n "$g_debugging" ] && set -x
|
||||
[ $# -eq 1 ] && usage 1
|
||||
if shorewall_is_started ; then
|
||||
if product_is_started ; then
|
||||
[ -n "$nolock" ] || mutex_on
|
||||
block $COMMAND Rejected $*
|
||||
[ -n "$nolock" ] || mutex_off
|
||||
else
|
||||
fatal_error "Shorewall is not started"
|
||||
fatal_error "$g_product is not started"
|
||||
fi
|
||||
;;
|
||||
allow)
|
||||
@ -2036,11 +2094,12 @@ case "$COMMAND" in
|
||||
rm -f ${g_restorepath}-ipsets
|
||||
echo " $g_restorepath removed"
|
||||
elif [ -f $g_restorepath ]; then
|
||||
echo " $g_restorepath exists and is not a saved Shorewall configuration"
|
||||
echo " $g_restorepath exists and is not a saved $g_product configuration"
|
||||
fi
|
||||
rm -f ${VARDIR}/save
|
||||
;;
|
||||
ipcalc)
|
||||
[ $g_family -eq 6 ] && usage 1
|
||||
[ -n "$g_debugging" ] && set -x
|
||||
if [ $# -eq 2 ]; then
|
||||
address=${2%/*}
|
||||
@ -2120,20 +2179,20 @@ case "$COMMAND" in
|
||||
get_config
|
||||
shift
|
||||
if shorewall_is_started ; then
|
||||
$IPTABLES -t raw -A PREROUTING $@ -j TRACE
|
||||
$IPTABLES -t raw -A OUTPUT $@ -j TRACE
|
||||
$g_tool -t raw -A PREROUTING $@ -j TRACE
|
||||
$g_tool -t raw -A OUTPUT $@ -j TRACE
|
||||
else
|
||||
fatal_error "Shorewall is not started"
|
||||
fatal_error "$g_product is not started"
|
||||
fi
|
||||
;;
|
||||
noiptrace)
|
||||
get_config
|
||||
shift
|
||||
if shorewall_is_started ; then
|
||||
$IPTABLES -t raw -D PREROUTING $@ -j TRACE
|
||||
$IPTABLES -t raw -D OUTPUT $@ -j TRACE
|
||||
$g_tool -t raw -D PREROUTING $@ -j TRACE
|
||||
$g_tool -t raw -D OUTPUT $@ -j TRACE
|
||||
else
|
||||
fatal_error "Shorewall is not started"
|
||||
fatal_error "$g_product is not started"
|
||||
fi
|
||||
;;
|
||||
*)
|
||||
|
||||
Loading…
Reference in New Issue
Block a user