mbse-firewall: comparison sbin/mbse-firewall

-:6b45cf9df8cf
+:92045b0e8e17
 # You should have received a copy of the GNU General Public License
 # along with this program; see the file COPYING.  If not, write to the Free
 # Software Foundation, 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA.
 # ---------------------------------------------------------------------------
-MBSEFW_VERSION="0.0.15"
+MBSEFW_VERSION="0.0.16"
 # Sanity checks
 if [ "$(id -u)" != "0" ]; then
 echo "** You must be root to run this program"
 exit 1
 $IP6TABLES -P FORWARD $1
 echo "Reset ip6tables default policy $1" | $LOGGER
 fi
 # Remove any ipset tables.
-$IPSET flush
+HOST="$(hostname)"
-$IPSET destroy
+SETS="$(${IPSET} list -n | grep ${HOST})"
+for MySET in ${SETS}; do
+$IPSET flush ${MySET}
+$IPSET destroy ${MySET}
+echo "Destroyed IPSET table ${MySET}" | $LOGGER
+done
 }
 is_external_if4() {
 reload_blocklist4() {
 BLOCKLIST="/etc/mbse-firewall/conf.d/blocklist4.conf"
+HOST="$(hostname)"
 if [ -f $BLOCKLIST ]; then
 echo "Reload $BLOCKLIST" | $LOGGER
-$IPSET create new-mbsefw-blk4ip hash:ip counters -exist
+$IPSET create ${HOST}-new-mbsefw-blk4ip hash:ip counters -exist
-$IPSET create new-mbsefw-blk4net hash:net counters -exist
+$IPSET create ${HOST}new-mbsefw-blk4net hash:net counters -exist
 $GREP -Ev '^#|^;|^\s*$' $BLOCKLIST | while read L ; do
 set $L
 if echo $1 | $GREP -q "/" ; then
-$IPSET add new-mbsefw-blk4net $1 -exist
+$IPSET add ${HOST}-new-mbsefw-blk4net $1 -exist
 else
-$IPSET add new-mbsefw-blk4ip $1 -exist
+$IPSET add ${HOST}-new-mbsefw-blk4ip $1 -exist
 fi
 done
-$IPSET swap mbsefw-blk4net new-mbsefw-blk4net
+$IPSET swap ${HOST}-mbsefw-blk4net ${HOST}-new-mbsefw-blk4net
-$IPSET flush new-mbsefw-blk4net
+$IPSET flush ${HOST}-new-mbsefw-blk4net
-$IPSET destroy new-mbsefw-blk4net
+$IPSET destroy ${HOST}-new-mbsefw-blk4net
-$IPSET swap mbsefw-blk4ip new-mbsefw-blk4ip
+$IPSET swap ${HOST}-mbsefw-blk4ip ${HOST}-new-mbsefw-blk4ip
-$IPSET flush new-mbsefw-blk4ip
+$IPSET flush ${HOST}-new-mbsefw-blk4ip
-$IPSET destroy new-mbsefw-blk4ip
+$IPSET destroy ${HOST}-new-mbsefw-blk4ip
 fi
 }
 reload_blocklist6() {
 BLOCKLIST="/etc/mbse-firewall/conf.d/blocklist6.conf"
+HOST="$(hostname)"
 if [ -f $BLOCKLIST ]; then
 echo "Reload $BLOCKLIST" | $LOGGER
-$IPSET create new-mbsefw-blk6 hash:net family inet6 counters -exist
+$IPSET create ${HOST}-new-mbsefw-blk6 hash:net family inet6 counters -exist
 $GREP -Ev '^#|^;|^\s*$' $BLOCKLIST | while read L ; do
-set $L ; $IPSET add new-mbsefw-blk6 $1 -exist
+set $L ; $IPSET add ${HOST}-new-mbsefw-blk6 $1 -exist
 done
-$IPSET swap mbsefw-blk6 new-mbsefw-blk6
+$IPSET swap ${HOST}-mbsefw-blk6 ${HOST}-new-mbsefw-blk6
-$IPSET flush new-mbsefw-blk6
+$IPSET flush ${HOST}-new-mbsefw-blk6
-$IPSET destroy new-mbsefw-blk6
+$IPSET destroy ${HOST}-new-mbsefw-blk6
 fi
 }
 fw_start_init() {
 echo "Init new firewall" | $LOGGER
 BLOCKLIST="/etc/mbse-firewall/conf.d/blocklist4.conf"
+HOST="$(hostname)"
 if [ -f $BLOCKLIST -a -n "$IF_EXT" ]; then
 echo "  Install $BLOCKLIST" | $LOGGER
-$IPSET create mbsefw-blk4ip hash:ip counters -exist
+$IPSET create ${HOST}-mbsefw-blk4ip hash:ip counters -exist
-$IPSET create mbsefw-blk4net hash:net counters -exist
+$IPSET create ${HOST}-mbsefw-blk4net hash:net counters -exist
-$IPTABLES -A INPUT -i $IF_EXT -m state --state NEW -m set --match-set mbsefw-blk4ip src -j DROP
+$IPTABLES -A INPUT -i $IF_EXT -m state --state NEW -m set --match-set ${HOST}-mbsefw-blk4ip src -j DROP
-$IPTABLES -A INPUT -i $IF_EXT -m state --state NEW -m set --match-set mbsefw-blk4net src -j DROP
+$IPTABLES -A INPUT -i $IF_EXT -m state --state NEW -m set --match-set ${HOST}-mbsefw-blk4net src -j DROP
 if [ "$FW_FORWARD" = "1" ]; then
-$IPTABLES -A FORWARD -i $IF_EXT -m state --state NEW -m set --match-set mbsefw-blk4ip src -j DROP
+$IPTABLES -A FORWARD -i $IF_EXT -m state --state NEW -m set --match-set ${HOST}-mbsefw-blk4ip src -j DROP
-$IPTABLES -A FORWARD -i $IF_EXT -m state --state NEW -m set --match-set mbsefw-blk4net src -j DROP
+$IPTABLES -A FORWARD -i $IF_EXT -m state --state NEW -m set --match-set ${HOST}-mbsefw-blk4net src -j DROP
 fi
 $GREP -Ev '^#|^;|^\s*$' $BLOCKLIST | while read L ; do
 set $L
 if echo $1 | $GREP -q "/" ; then
-$IPSET add mbsefw-blk4net $1 -exist
+$IPSET add ${HOST}-mbsefw-blk4net $1 -exist
 else
-	$IPSET add mbsefw-blk4ip $1 -exist
+	$IPSET add ${HOST}-mbsefw-blk4ip $1 -exist
 fi
 done
 echo -n "."
 fi
 BLOCKLIST="/etc/mbse-firewall/conf.d/blocklist6.conf"
 if [ -f $BLOCKLIST ]; then
 echo "  Install $BLOCKLIST" | $LOGGER
-$IPSET create mbsefw-blk6 hash:net family inet6 counters -exist
+$IPSET create ${HOST}-mbsefw-blk6 hash:net family inet6 counters -exist
 if [ -n "$IF_EXT6" ]; then
 IF6=$IF_EXT6
 else
 IF6=$IF_EXT
 fi
-$IP6TABLES -A INPUT -i $IF6 -m state --state NEW -m set --match-set mbsefw-blk6 src -j DROP
+$IP6TABLES -A INPUT -i $IF6 -m state --state NEW -m set --match-set ${HOST}-mbsefw-blk6 src -j DROP
 if [ "$FW_FORWARD" = "1" ]; then
-$IP6TABLES -A FORWARD -i $IF6 -m state --state NEW -m set --match-set mbsefw-blk6 src -j DROP
+$IP6TABLES -A FORWARD -i $IF6 -m state --state NEW -m set --match-set ${HOST}-mbsefw-blk6 src -j DROP
 fi
 $GREP -Ev '^#|^;|^\s*$' $BLOCKLIST | while read L ; do
 set $L
-$IPSET add mbsefw-blk6 $1 -exist
+$IPSET add ${HOST}-mbsefw-blk6 $1 -exist
 done
 echo -n "."
 fi
 fw_init_nfacct
 $IP6TABLES -A FORWARD -p ipv6-icmp -m icmp6 --icmpv6-type echo-reply   -m limit --limit 15/second -j ACCEPT
 fi
 # rules to permit IPv6 Neighbor discovery
 $IP6TABLES -A INPUT   -p ipv6-icmp -m icmp6 --icmpv6-type router-solicitation -m hl --hl-eq 255 -j ACCEPT
+$IP6TABLES -A INPUT   -p ipv6-icmp -m icmp6 --icmpv6-type router-solicitation -j DROP	# Silent drop HOPLIMIT <> 255
 $IP6TABLES -A INPUT   -p ipv6-icmp -m icmp6 --icmpv6-type router-advertisement -m hl --hl-eq 255 -j ACCEPT
 $IP6TABLES -A INPUT   -p ipv6-icmp -m icmp6 --icmpv6-type neighbour-solicitation -m hl --hl-eq 255 -j ACCEPT
+$IP6TABLES -A INPUT   -p ipv6-icmp -m icmp6 --icmpv6-type neighbour-solicitation -j DROP	# Silent drop HOPLIMIT <> 255
 $IP6TABLES -A INPUT   -p ipv6-icmp -m icmp6 --icmpv6-type neighbour-advertisement -m hl --hl-eq 255 -j ACCEPT
 $IP6TABLES -A OUTPUT  -p ipv6-icmp -m icmp6 --icmpv6-type router-solicitation -m hl --hl-eq 255 -j ACCEPT
 $IP6TABLES -A OUTPUT  -p ipv6-icmp -m icmp6 --icmpv6-type router-advertisement -m hl --hl-eq 255 -j ACCEPT
 $IP6TABLES -A OUTPUT  -p ipv6-icmp -m icmp6 --icmpv6-type neighbour-solicitation -m hl --hl-eq 255 -j ACCEPT
 $IP6TABLES -A OUTPUT  -p ipv6-icmp -m icmp6 --icmpv6-type neighbour-advertisement -m hl --hl-eq 255 -j ACCEPT
 CONFFILE="/etc/mbse-firewall/conf.d/${INTF}-${FCHAIN}.conf"
 is_external_if4 $1
 EXTERN4=$?
 is_external_if6 $1
 EXTERN6=$?
+HOST="$(hostname)"
 # TODO: use subchains, but we need to do 2 passes on the config
 # files to make it work.
 # Are there rules for this chain?
 # See the end of this function for the actual test.
 if [ "$NCHAIN" = "INPUT" -o "$NCHAIN" = "FORWARD" ]; then
 if [ "$IF_EXT_AUTO_BLOCK" = "1" ]; then
 if [ "$EXTERN4" = "1" ]; then
 	  echo "  Installing IPv4 auto blacklisting on interface ${INTF}" | $LOGGER
-$IPSET create mbsefw-auto4 hash:ip timeout $IF_EXT_AUTO_TO counters -exist
+$IPSET create ${HOST}-mbsefw-auto4 hash:ip timeout $IF_EXT_AUTO_TO counters -exist
-$IPTABLES -I $NCHAIN -m set --match-set mbsefw-auto4 src -j DROP
+$IPTABLES -I $NCHAIN -m set --match-set ${HOST}-mbsefw-auto4 src -j DROP
 	fi
 	if [ "$EXTERN6" = "1" ]; then
 	  echo "  Installing IPv6 auto blacklisting on interface ${INTF}" | $LOGGER
-$IPSET create mbsefw-auto6 hash:ip family inet6 timeout $IF_EXT_AUTO_TO counters -exist
+$IPSET create ${HOST}-mbsefw-auto6 hash:ip family inet6 timeout $IF_EXT_AUTO_TO counters -exist
-$IP6TABLES -I $NCHAIN -m set --match-set mbsefw-auto6 src -j DROP
+$IP6TABLES -I $NCHAIN -m set --match-set ${HOST}-mbsefw-auto6 src -j DROP
 	fi
 fi
 fi
 # Adjust for the direction of the chain
 	# First, ignore these. Can happen after a temporary network problem.
 	$IPTABLES -A $NCHAIN $iodir ${INTF} -p tcp -m tcp --tcp-flags ALL ACK -j DROP
 	# Now the real rule.
 $IPTABLES -A $NCHAIN $iodir ${INTF} \
 	      -m hashlimit --hashlimit-above ${IF_EXT_AUTO_LIMIT} --hashlimit-burst ${IF_EXT_AUTO_BURST} --hashlimit-mode srcip --hashlimit-name hash-auto4 \
-	      -j SET --add-set mbsefw-auto4 src
+	      -j SET --add-set ${HOST}-mbsefw-auto4 src
 fi
 if [ "${EXTERN6}" = "1" ]; then
 	# First, ignore these. Can happen after a temporary network problem.
 	$IP6TABLES -A $NCHAIN $iodir ${INTF} -p tcp -m tcp --tcp-flags ALL ACK -j DROP
 	# Now the real rule.
 	$IP6TABLES -A $NCHAIN $iodir ${INTF} \
 	      -m hashlimit --hashlimit-above ${IF_EXT_AUTO_LIMIT} --hashlimit-burst ${IF_EXT_AUTO_BURST} --hashlimit-mode srcip --hashlimit-name hash-auto6 \
-	      -j SET --add-set mbsefw-auto6 src
+	      -j SET --add-set ${HOST}-mbsefw-auto6 src
 fi
 fi
 # deny and log the rest
 $IPTABLES  -A $NCHAIN $iodir ${INTF} -m limit --limit 10/minute -j LOG --log-level info --log-prefix "DENY=$NCHAIN "
 [ "$USE_IPV6" == "1" ] && $IP6TABLES -A $NCHAIN $iodir ${INTF} -m limit --limit 10/minute -j LOG --log-level info --log-prefix "DENY=$NCHAIN "
 [ -n "$IP6TABLES_SAVE" ] && $IP6TABLES_SAVE > /etc/mbse-firewall/data/firewall-ipv6.data
 echo -n "."
 rm -f /etc/mbse-firewall/data/firewall-ipset.data
 touch /etc/mbse-firewall/data/firewall-ipset.data
-SETS="$($IPSET list -n)"
+HOST="$(hostname)"
+SETS="$($IPSET list -n | grep ${HOST})"
 for set in $SETS ; do
-if [ "$set" = "mbsefw-auto4" -o "$set" = "mbsefw-auto6" ]; then
+if [ "$set" = "${HOST}-mbsefw-auto4" -o "$set" = "${HOST}-mbsefw-auto6" ]; then
 # Only save structure for auto blocklists
 $IPSET save $set -t >> /etc/mbse-firewall/data/firewall-ipset.data
 else
 $IPSET save $set >> /etc/mbse-firewall/data/firewall-ipset.data
 fi
 echo '                                 SECURITY TABLE IPv6'
 echo
 $IP6TABLES -t security -L -v -n --line-numbers
 fi
-if [ -n "$IPSET" ] && [ ! -z "$($IPSET list)" ]; then
+HOST="$(hostname)"
+if [ -n "$IPSET" ] && [ ! -z "$($IPSET list -n | grep ${HOST})" ]; then
 echo
 echo '                                     IPSET listing'
-echo
+SETS="$(${IPSET} list -n | grep ${HOST})"
-$IPSET list
+for MySET in ${SETS}; do
+echo
+${IPSET} list ${MySET}
+done
 fi
 }

Mercurial > mbse-firewall / file comparison

comparison: sbin/mbse-firewall

sbin/mbse-firewall