forked from extern/shorewall_code
f127babe5d
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@4064 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
94 lines
3.1 KiB
Bash
Executable File
94 lines
3.1 KiB
Bash
Executable File
#!/bin/sh
|
|
#
|
|
# Shorewall Lite Packet Filtering Firewall Capabilities Detector
|
|
#
|
|
# This program is under GPL [http://www.gnu.org/copyleft/gpl.htm]
|
|
#
|
|
# (c) 2006 - Tom Eastep (teastep@shorewall.net)
|
|
#
|
|
# This file should be placed in /sbin/shorewall.
|
|
#
|
|
# Shorewall documentation is available at http://shorewall.sourceforge.net
|
|
#
|
|
# This program is free software; you can redistribute it and/or modify
|
|
# it under the terms of Version 2 of the GNU General Public License
|
|
# as published by the Free Software Foundation.
|
|
#
|
|
# This program is distributed in the hope that it will be useful,
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
# GNU General Public License for more details.
|
|
#
|
|
# You should have received a copy of the GNU General Public License
|
|
# along with this program; if not, write to the Free Software
|
|
# Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA
|
|
#
|
|
#
|
|
# This program may be used to create a /etc/shorewall/capabilities file for
|
|
# use in compiling Shorewall firewalls on another system.
|
|
#
|
|
# On the target system (the system where the firewall program is to run):
|
|
#
|
|
# [ IPTABLES=<iptables binary> ] [ MODULESDIR=<kernel modules directory> ] shorecap > capabilities
|
|
#
|
|
# Now move the capabilities file to the compilation system. The file must
|
|
# be placed in a directory on the CONFIG_PATH to be used when compiling firewalls
|
|
# for the target system.
|
|
#
|
|
# Default values for the two variables are:
|
|
#
|
|
# IPTABLES - iptables
|
|
# MODULESDIR - /lib/modules/$(uname -r)/kernel/net/ipv4/netfilter
|
|
#
|
|
# Shorewall need not be installed on the target system to run shorecap. If the '-e' flag is
|
|
# used during firewall compilation, then the generated firewall program will likewise not
|
|
# require Shorewall to be installed.
|
|
|
|
. /usr/share/shorewall-lite/functions
|
|
. /usr/share/shorewall-lite/configpath
|
|
. /etc/shorewall-lite/shorewall.conf
|
|
|
|
VERSION=$(cat /usr/share/shorewall-lite/version)
|
|
|
|
report_capability() # $1 = Capability
|
|
{
|
|
eval echo $1=\$$1
|
|
}
|
|
|
|
report_capabilities() {
|
|
echo "#"
|
|
echo "# Shorewall $VERSION detected the following iptables/netfilter capabilities - $(date)"
|
|
echo "#"
|
|
report_capability NAT_ENABLED
|
|
report_capability MANGLE_ENABLED
|
|
report_capability MULTIPORT
|
|
report_capability XMULTIPORT
|
|
report_capability CONNTRACK_MATCH
|
|
report_capability USEPKTTYPE
|
|
report_capability POLICY_MATCH
|
|
report_capability PHYSDEV_MATCH
|
|
report_capability LENGTH_MATCH
|
|
report_capability IPRANGE_MATCH
|
|
report_capability RECENT_MATCH
|
|
report_capability OWNER_MATCH
|
|
report_capability IPSET_MATCH
|
|
report_capability CONNMARK
|
|
report_capability XCONNMARK
|
|
report_capability CONNMARK_MATCH
|
|
report_capability XCONNMARK_MATCH
|
|
report_capability RAW_TABLE
|
|
report_capability IPP2P_MATCH
|
|
report_capability CLASSIFY_TARGET
|
|
report_capability ENHANCED_REJECT
|
|
report_capability KLUDGEFREE
|
|
report_capability MARK
|
|
report_capability XMARK
|
|
report_capability MANGLE_FORWARD
|
|
}
|
|
|
|
[ -n "$IPTABLES" ] || IPTABLES=$(mywhich iptables)
|
|
VERBOSE=0
|
|
load_kernel_modules
|
|
determine_capabilities
|
|
report_capabilities
|