home *** CD-ROM | disk | FTP | other *** search
/ Personal Computer World 2009 February / PCWFEB09.iso / Software / Linux / Kubuntu 8.10 / kubuntu-8.10-desktop-i386.iso / casper / filesystem.squashfs / etc / init.d / ufw < prev    next >
Text File  |  2008-10-08  |  8KB  |  228 lines
  1. #!/bin/sh -e
  2.  
  3. ### BEGIN INIT INFO
  4. # Provides:          ufw
  5. # Required-Start:    mountall.sh
  6. # Required-Stop:     
  7. # Default-Start:     S
  8. # Default-Stop:      
  9. # Short-Description: start firewall
  10. ### END INIT INFO
  11.  
  12. PATH="/sbin:/bin:/usr/sbin:/usr/bin"
  13.  
  14. [ -x /usr/sbin/ufw ] || exit 0
  15.  
  16. . /lib/lsb/init-functions
  17.  
  18. if [ -s /etc/default/ufw ]; then
  19.     . /etc/default/ufw
  20. else
  21.     log_failure_msg "Could not find /etc/default/ufw (aborting)"
  22.     exit 1
  23. fi
  24. if [ -s /etc/ufw/ufw.conf ]; then
  25.     . /etc/ufw/ufw.conf
  26. else
  27.     log_failure_msg "Could not find /etc/ufw/ufw.conf (aborting)"
  28.     exit 1
  29. fi
  30.  
  31. RULES_PATH="/etc/ufw"
  32. USER_PATH="/var/lib/ufw"
  33.  
  34. case "$1" in
  35. start)
  36.     if iptables -L ufw-user-input -n >/dev/null 2>&1 ; then
  37.         # if firewall loaded, tell to reload instead
  38.         log_action_msg "Firewall already started, use 'force-reload'"
  39.         exit 0
  40.     fi
  41.     if [ "$ENABLED" = "yes" ] || [ "$ENABLED" = "YES" ]; then
  42.         log_action_begin_msg "Starting firewall:" "ufw"
  43.         for m in $IPT_MODULES
  44.         do
  45.             modprobe $m || true
  46.         done
  47.  
  48.         execs="iptables"
  49.  
  50.         # IPv6 setup
  51.         if [ "$IPV6" = "yes" ] || [ "$IPV6" = "YES" ]; then
  52.             if ip6tables -L INPUT >/dev/null 2>&1; then
  53.                 execs="$execs ip6tables"
  54.             else
  55.                 log_action_cont_msg "Problem loading ipv6 (skipping)"
  56.             fi
  57.         else
  58.             if ip6tables -L INPUT >/dev/null 2>&1; then
  59.                 # IPv6 support disabled but available in the kernel, so
  60.                 # default DROP and accept all on loopback
  61.                 ip6tables -F || error="yes"
  62.                 ip6tables -X || error="yes"
  63.                 ip6tables -P INPUT DROP || error="yes"
  64.                 ip6tables -P OUTPUT DROP || error="yes"
  65.                 ip6tables -P FORWARD DROP || error="yes"
  66.                 ip6tables -A INPUT -i lo -j ACCEPT || error="yes"
  67.                 ip6tables -A OUTPUT -o lo -j ACCEPT || error="yes"
  68.                 if [ "$error" = "yes" ]; then
  69.                     log_action_cont_msg "Problem setting default IPv6 policy"
  70.                 fi
  71.             fi
  72.         fi
  73.  
  74.         for exe in $execs
  75.         do
  76.             type=""
  77.             if [ "$exe" = "ip6tables" ]; then
  78.                 type="6"
  79.             fi
  80.             BEFORE_RULES="$RULES_PATH/before${type}.rules"
  81.             AFTER_RULES="$RULES_PATH/after${type}.rules"
  82.             USER_RULES="$USER_PATH/user${type}.rules"
  83.  
  84.             # flush the chains
  85.             $exe -F || error="yes"
  86.             $exe -X || error="yes"
  87.  
  88.             # setup built-in chains' default policy
  89.             $exe -P INPUT $DEFAULT_INPUT_POLICY || error="yes"
  90.             $exe -P OUTPUT $DEFAULT_OUTPUT_POLICY || error="yes"
  91.             $exe -P FORWARD $DEFAULT_FORWARD_POLICY || error="yes"
  92.  
  93.             # setup some other chains that can be used later
  94.             if [ "$type" != "6" ]; then
  95.                 $exe -N ufw${type}-not-local || error="yes"
  96.             fi
  97.  
  98.             # setup ufw${type}-before-* chains
  99.             $exe -N ufw${type}-before-input || error="yes"
  100.             $exe -N ufw${type}-before-output || error="yes"
  101.             $exe -N ufw${type}-before-forward || error="yes"
  102.             $exe -A INPUT -j ufw${type}-before-input || error="yes"
  103.             $exe -A OUTPUT -j ufw${type}-before-output || error="yes"
  104.             $exe -A FORWARD -j ufw${type}-before-forward || error="yes"
  105.             if [ -s "$RULES_PATH" ]; then
  106.                 if ! $exe-restore -n < $BEFORE_RULES ; then
  107.                     log_action_cont_msg "Problem running '$BEFORE_RULES'"
  108.                     error="yes"
  109.                 fi
  110.             else
  111.                 log_action_cont_msg "Couldn't find '$BEFORE_RULES'"
  112.             fi
  113.  
  114.             # setup ufw${type}-user chain
  115.             if [ -s "$USER_PATH" ]; then
  116.                 $exe -N ufw${type}-user-input || error="yes"
  117.                 $exe -N ufw${type}-user-output || error="yes"
  118.                 $exe -N ufw${type}-user-forward || error="yes"
  119.                 $exe -A ufw${type}-before-input -j ufw${type}-user-input || error="yes"
  120.                 $exe -A ufw${type}-before-output -j ufw${type}-user-output || error="yes"
  121.                 $exe -A ufw${type}-before-forward -j ufw${type}-user-forward || error="yes"
  122.                 if ! $exe-restore -n < $USER_RULES ; then
  123.                     log_action_cont_msg "Problem running '$USER_RULES'"
  124.                     error="yes"
  125.                 fi
  126.                 # don't include the RETURN lines here, as they will
  127.                 # be in the USER_PATH file
  128.             fi
  129.  
  130.             # now return from the chain
  131.             $exe -A ufw${type}-before-input -j RETURN || error="yes"
  132.             $exe -A ufw${type}-before-output -j RETURN || error="yes"
  133.             $exe -A ufw${type}-before-forward -j RETURN || error="yes"
  134.  
  135.             # setup ufw${type}-after-* chains
  136.             $exe -N ufw${type}-after-input || error="yes"
  137.             $exe -N ufw${type}-after-output || error="yes"
  138.             $exe -N ufw${type}-after-forward || error="yes"
  139.             $exe -A INPUT -j ufw${type}-after-input || error="yes"
  140.             $exe -A OUTPUT -j ufw${type}-after-output || error="yes"
  141.             $exe -A FORWARD -j ufw${type}-after-forward || error="yes"
  142.             if [ -s "$AFTER_RULES" ]; then
  143.                 if ! $exe-restore -n < $AFTER_RULES ; then
  144.                     log_action_cont_msg "Problem running '$AFTER_RULES'"
  145.                     error="yes"
  146.                 fi
  147.             else
  148.                 log_action_cont_msg "Couldn't find '$AFTER_RULES'"
  149.             fi
  150.             $exe -A ufw${type}-after-input -j RETURN || error="yes"
  151.             $exe -A ufw${type}-after-output -j RETURN || error="yes"
  152.             $exe -A ufw${type}-after-forward -j RETURN || error="yes"
  153.         done
  154.  
  155.         if [ ! -z "$IPT_SYSCTL" ] && [ -s "$IPT_SYSCTL" ]; then
  156.             sysctl -e -q -p $IPT_SYSCTL || true
  157.         fi
  158.  
  159.         if [ "$error" = "yes" ]; then
  160.             log_action_end_msg 1
  161.             exit 1
  162.         else
  163.             log_action_end_msg 0
  164.         fi
  165.     else
  166.         log_action_begin_msg "Skipping firewall:" "ufw (not enabled)"
  167.         log_action_end_msg 0
  168.     fi
  169.     ;;
  170. stop)
  171.     log_action_begin_msg "Stopping firewall:" "ufw"
  172.     error=""
  173.  
  174.     execs="iptables"
  175.     if ip6tables -L INPUT >/dev/null 2>&1; then
  176.         execs="$execs ip6tables"
  177.     fi
  178.  
  179.     for exe in $execs
  180.     do
  181.         $exe -F || error="yes"
  182.         $exe -X || error="yes"
  183.         $exe -P INPUT ACCEPT || error="yes"
  184.         $exe -P OUTPUT ACCEPT || error="yes"
  185.         $exe -P FORWARD ACCEPT || error="yes"
  186.     done
  187.  
  188.     if [ "$error" = "yes" ]; then
  189.         log_action_end_msg 1
  190.         exit 1
  191.     else
  192.         log_action_end_msg 0
  193.     fi
  194.     ;;
  195. restart|force-reload)
  196.     if [ "$ENABLED" = "yes" ] || [ "$ENABLED" = "YES" ]; then
  197.         $0 stop
  198.         $0 start
  199.     else
  200.         log_warning_msg "Skipping $1 (not enabled)"
  201.     fi
  202.     ;;
  203. status)
  204.     err=""
  205.     iptables -L ufw-user-input -n >/dev/null 2>&1 || {
  206.         log_failure_msg "Firewall is not running"
  207.         exit 3
  208.     }
  209.  
  210.     if [ "$IPV6" = "yes" ] || [ "$IPV6" = "YES" ]; then
  211.         ip6tables -L ufw6-user-input -n >/dev/null 2>&1 || {
  212.             # unknown state: ipv4 ok, but ipv6 isn't
  213.             log_failure_msg "Firewall in inconsistent state (IPv6 enabled but not running)"
  214.             exit 4
  215.         }
  216.     fi
  217.  
  218.     log_success_msg "Firewall is running"
  219.     ;;
  220. *)
  221.     echo "Usage: /etc/init.d/ufw {start|stop|restart|force-reload|status}"
  222.     exit 1
  223.     ;;
  224. esac
  225.  
  226. exit 0
  227.  
  228.