Skip to content
Snippets Groups Projects
Commit dbce6a1a authored by Bob Mottram's avatar Bob Mottram
Browse files

Check before adding firewall rules to avoid duplicates

parent d742ea58
No related branches found
No related tags found
No related merge requests found
Hide whitespace changes
Inline Side-by-side
src/freedombone-utils-firewall
+ 48
− 16
View file @ dbce6a1a
...@@ -354,14 +354,27 @@ function firewall_add { ...@@ -354,14 +354,27 @@ function firewall_add {
if ! grep -q "${firewall_name}=${firewall_port}" $FIREWALL_CONFIG; then if ! grep -q "${firewall_name}=${firewall_port}" $FIREWALL_CONFIG; then
echo "${firewall_name}=${firewall_port}" >> $FIREWALL_CONFIG echo "${firewall_name}=${firewall_port}" >> $FIREWALL_CONFIG
if [ ! ${firewall_protocol} ]; then if [ ! ${firewall_protocol} ]; then
iptables -A INPUT -p udp --dport ${firewall_port} -j ACCEPT iptables -C INPUT -p udp --dport ${firewall_port} -j ACCEPT
iptables -A INPUT -p tcp --dport ${firewall_port} -j ACCEPT if [ ! "$?" = "0" ]; then
iptables -A INPUT -p udp --dport ${firewall_port} -j ACCEPT
fi
iptables -C INPUT -p tcp --dport ${firewall_port} -j ACCEPT
if [ ! "$?" = "0" ]; then
iptables -A INPUT -p tcp --dport ${firewall_port} -j ACCEPT
fi
else else
if [[ "${firewall_protocol}" == *"udp"* ]]; then if [[ "${firewall_protocol}" == *"udp"* ]]; then
iptables -A INPUT -p udp --dport ${firewall_port} -j ACCEPT iptables -C INPUT -p udp --dport ${firewall_port} -j ACCEPT
if [ ! "$?" = "0" ]; then
iptables -A INPUT -p udp --dport ${firewall_port} -j ACCEPT
fi
fi fi
if [[ "${firewall_protocol}" == *"tcp"* ]]; then if [[ "${firewall_protocol}" == *"tcp"* ]]; then
iptables -A INPUT -p tcp --dport ${firewall_port} -j ACCEPT iptables -C INPUT -p tcp --dport ${firewall_port} -j ACCEPT
if [ ! "$?" = "0" ]; then
iptables -A INPUT -p tcp --dport ${firewall_port} -j ACCEPT
fi
fi fi
fi fi
save_firewall_settings save_firewall_settings
...@@ -377,14 +390,26 @@ function firewall_add_range { ...@@ -377,14 +390,26 @@ function firewall_add_range {
if ! grep -q "${firewall_name}=${firewall_port_start}:${firewall_port_end}" $FIREWALL_CONFIG; then if ! grep -q "${firewall_name}=${firewall_port_start}:${firewall_port_end}" $FIREWALL_CONFIG; then
echo "${firewall_name}=${firewall_port_start}:${firewall_port_end}" >> $FIREWALL_CONFIG echo "${firewall_name}=${firewall_port_start}:${firewall_port_end}" >> $FIREWALL_CONFIG
if [ ! ${firewall_protocol} ]; then if [ ! ${firewall_protocol} ]; then
iptables -A INPUT -p udp --dport ${firewall_port_start}:${firewall_port_end} -j ACCEPT iptables -C INPUT -p udp --dport ${firewall_port_start}:${firewall_port_end} -j ACCEPT
iptables -A INPUT -p tcp --dport ${firewall_port_start}:${firewall_port_end} -j ACCEPT if [ ! "$?" = "0" ]; then
iptables -A INPUT -p udp --dport ${firewall_port_start}:${firewall_port_end} -j ACCEPT
fi
iptables -C INPUT -p tcp --dport ${firewall_port_start}:${firewall_port_end} -j ACCEPT
if [ ! "$?" = "0" ]; then
iptables -A INPUT -p tcp --dport ${firewall_port_start}:${firewall_port_end} -j ACCEPT
fi
else else
if [[ "${firewall_protocol}" == *"udp"* ]]; then if [[ "${firewall_protocol}" == *"udp"* ]]; then
iptables -A INPUT -p udp --dport ${firewall_port_start}:${firewall_port_end} -j ACCEPT iptables -C INPUT -p udp --dport ${firewall_port_start}:${firewall_port_end} -j ACCEPT
if [ ! "$?" = "0" ]; then
iptables -A INPUT -p udp --dport ${firewall_port_start}:${firewall_port_end} -j ACCEPT
fi
fi fi
if [[ "${firewall_protocol}" == *"tcp"* ]]; then if [[ "${firewall_protocol}" == *"tcp"* ]]; then
iptables -A INPUT -p tcp --dport ${firewall_port_start}:${firewall_port_end} -j ACCEPT iptables -C INPUT -p tcp --dport ${firewall_port_start}:${firewall_port_end} -j ACCEPT
if [ ! "$?" = "0" ]; then
iptables -A INPUT -p tcp --dport ${firewall_port_start}:${firewall_port_end} -j ACCEPT
fi
fi fi
fi fi
save_firewall_settings save_firewall_settings
...@@ -438,16 +463,23 @@ function domain_to_hex_string { ...@@ -438,16 +463,23 @@ function domain_to_hex_string {
function firewall_block_domain { function firewall_block_domain {
blocked_domain="$1" blocked_domain="$1"
if [[ "$blocked_domain" == *'@'* ]]; then
# Don't try to block email/microblog addresses
return
fi
if ! grep "$blocked_domain" $FIREWALL_DOMAINS; then if ! grep "$blocked_domain" $FIREWALL_DOMAINS; then
hexstr=$(domain_to_hex_string $blocked_domain) hexstr=$(domain_to_hex_string $blocked_domain)
iptables -A INPUT -p udp --dport 53 -m string --hex-string "$hexstr" --algo bm -j DROP iptables -C INPUT -p udp --dport 53 -m string --hex-string "$hexstr" --algo bm -j DROP
iptables -A INPUT -p tcp --dport 53 -m string --hex-string "$hexstr" --algo bm -j DROP if [ ! "$?" = "0" ]; then
iptables -A OUTPUT -p udp --dport 53 -m string --hex-string "$hexstr" --algo bm -j DROP iptables -A INPUT -p udp --dport 53 -m string --hex-string "$hexstr" --algo bm -j DROP
iptables -A OUTPUT -p tcp --dport 53 -m string --hex-string "$hexstr" --algo bm -j DROP iptables -A INPUT -p tcp --dport 53 -m string --hex-string "$hexstr" --algo bm -j DROP
iptables -I FORWARD -p udp --dport 53 -m string --hex-string "$hexstr" --algo bm -j DROP iptables -A OUTPUT -p udp --dport 53 -m string --hex-string "$hexstr" --algo bm -j DROP
iptables -I FORWARD -p tcp --dport 53 -m string --hex-string "$hexstr" --algo bm -j DROP iptables -A OUTPUT -p tcp --dport 53 -m string --hex-string "$hexstr" --algo bm -j DROP
echo "${blocked_domain}" >> $FIREWALL_DOMAINS iptables -I FORWARD -p udp --dport 53 -m string --hex-string "$hexstr" --algo bm -j DROP
save_firewall_settings iptables -I FORWARD -p tcp --dport 53 -m string --hex-string "$hexstr" --algo bm -j DROP
echo "${blocked_domain}" >> $FIREWALL_DOMAINS
save_firewall_settings
fi
# run the blocking rules now # run the blocking rules now
if [ -f /usr/bin/gnusocial-firewall ]; then if [ -f /usr/bin/gnusocial-firewall ]; then
......
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment