From: <abe...@us...> - 2011-12-18 23:07:09
|
Revision: 5316 http://astlinux.svn.sourceforge.net/astlinux/?rev=5316&view=rev Author: abelbeck Date: 2011-12-18 23:07:03 +0000 (Sun, 18 Dec 2011) Log Message: ----------- AIF, version bump to 2.0.1, also implement new AIF 'parse_rule' function in the dyndns-host-open plugin Modified Paths: -------------- branches/1.0/package/arnofw/arnofw.mk branches/1.0/package/arnofw/arnofw.serial branches/1.0/package/arnofw/dyndns-host-open/50dyndns-host-open.plugin.sh Modified: branches/1.0/package/arnofw/arnofw.mk =================================================================== --- branches/1.0/package/arnofw/arnofw.mk 2011-12-17 19:33:12 UTC (rev 5315) +++ branches/1.0/package/arnofw/arnofw.mk 2011-12-18 23:07:03 UTC (rev 5316) @@ -3,7 +3,7 @@ # Arno's IPtables Firewall Script # ############################################################# -ARNOFW_VER:=2.0.0c +ARNOFW_VER:=2.0.1 ARNOFW_ROOT:=arno-iptables-firewall ARNOFW_SOURCE:=$(ARNOFW_ROOT)_$(ARNOFW_VER).tar.gz ARNOFW_SITE:=http://rocky.eld.leidenuniv.nl/arno-iptables-firewall Modified: branches/1.0/package/arnofw/arnofw.serial =================================================================== --- branches/1.0/package/arnofw/arnofw.serial 2011-12-17 19:33:12 UTC (rev 5315) +++ branches/1.0/package/arnofw/arnofw.serial 2011-12-18 23:07:03 UTC (rev 5316) @@ -1 +1 @@ -0002~0012~0000~0000~0000~ +0002~0013~0000~0000~0000~ Modified: branches/1.0/package/arnofw/dyndns-host-open/50dyndns-host-open.plugin.sh =================================================================== --- branches/1.0/package/arnofw/dyndns-host-open/50dyndns-host-open.plugin.sh 2011-12-17 19:33:12 UTC (rev 5315) +++ branches/1.0/package/arnofw/dyndns-host-open/50dyndns-host-open.plugin.sh 2011-12-18 23:07:03 UTC (rev 5316) @@ -2,14 +2,14 @@ # -= Arno's iptables firewall - DynDNS Host Open plugin =- # PLUGIN_NAME="DynDNS Host Open plugin" -PLUGIN_VERSION="1.00-astlinux BETA" +PLUGIN_VERSION="1.01-astlinux BETA" PLUGIN_CONF_FILE="dyndns-host-open.conf" # -# Last changed : April 4, 2011 -# Requirements : kernel 2.6 + AIF 2.0.0 or better +# Last changed : December 18, 2011 +# Requirements : kernel 2.6 + AIF 2.0.1 or better # Comments : This implements support to open ports for DynDNS IPv4 hosts # -# Author : (C) Copyright 2008-2011 by Arno van Amersfoort & Lonnie Abelbeck +# Author : (C) Copyright 2008-2012 by Arno van Amersfoort & Lonnie Abelbeck # Homepage : http://rocky.eld.leidenuniv.nl/ # Freshmeat homepage : http://freshmeat.net/projects/iptables-firewall/?topic_id=151 # Email : a r n o v a AT r o c k y DOT e l d DOT l e i d e n u n i v DOT n l @@ -42,23 +42,21 @@ ########################################## unset IFS for rule in $DYNDNS_HOST_OPEN_TCP; do - interfaces=$(get_ifs "$rule") - destips=$(get_ips "$rule") - hosts=$(get_hosts_ihp "$rule") - ports=$(get_ports_ihp "$rule") + if parse_rule "$rule" DYNDNS_HOST_OPEN_TCP "interfaces-destips-hosts-ports"; then - echo "${INDENT}$(show_if_ip "$interfaces" "$destips")Allowing $hosts for TCP port(s): $ports" - - IFS=',' - for host in $hosts; do - for port in $ports; do - for destip in $destips; do - for interface in $interfaces; do - echo "-A DYNDNS_CHAIN -i $interface -s $host -d $destip -p tcp --dport $port -j ACCEPT" >> "$rules_file" + echo "${INDENT}$(show_if_ip "$interfaces" "$destips")Allowing $hosts for TCP port(s): $ports" + + IFS=',' + for host in $hosts; do + for port in $ports; do + for destip in $destips; do + for interface in $interfaces; do + echo "-A DYNDNS_CHAIN -i $interface -s $host -d $destip -p tcp --dport $port -j ACCEPT" >> "$rules_file" + done done done done - done + fi done @@ -66,23 +64,21 @@ ########################################## unset IFS for rule in $DYNDNS_HOST_OPEN_UDP; do - interfaces=$(get_ifs "$rule") - destips=$(get_ips "$rule") - hosts=$(get_hosts_ihp "$rule") - ports=$(get_ports_ihp "$rule") + if parse_rule "$rule" DYNDNS_HOST_OPEN_UDP "interfaces-destips-hosts-ports"; then - echo "${INDENT}$(show_if_ip "$interfaces" "$destips")Allowing $hosts for UDP port(s): $ports" - - IFS=',' - for host in $hosts; do - for port in $ports; do - for destip in $destips; do - for interface in $interfaces; do - echo "-A DYNDNS_CHAIN -i $interface -s $host -d $destip -p udp --dport $port -j ACCEPT" >> "$rules_file" + echo "${INDENT}$(show_if_ip "$interfaces" "$destips")Allowing $hosts for UDP port(s): $ports" + + IFS=',' + for host in $hosts; do + for port in $ports; do + for destip in $destips; do + for interface in $interfaces; do + echo "-A DYNDNS_CHAIN -i $interface -s $host -d $destip -p udp --dport $port -j ACCEPT" >> "$rules_file" + done done done done - done + fi done @@ -90,23 +86,21 @@ ############################################# unset IFS for rule in $DYNDNS_HOST_OPEN_IP; do - interfaces=$(get_ifs "$rule") - destips=$(get_ips "$rule") - hosts=$(get_hosts_ihp "$rule") - protos=$(get_ports_ihp "$rule") + if parse_rule "$rule" DYNDNS_HOST_OPEN_IP "interfaces-destips-hosts-protos"; then - echo "${INDENT}$(show_if_ip "$interfaces" "$destips")Allowing $hosts for IP protocol(s): $protos" - - IFS=',' - for host in $hosts; do - for proto in $protos; do - for destip in $destips; do - for interface in $interfaces; do - echo "-A DYNDNS_CHAIN -i $interface -s $host -d $destip -p $proto -j ACCEPT" >> "$rules_file" + echo "${INDENT}$(show_if_ip "$interfaces" "$destips")Allowing $hosts for IP protocol(s): $protos" + + IFS=',' + for host in $hosts; do + for proto in $protos; do + for destip in $destips; do + for interface in $interfaces; do + echo "-A DYNDNS_CHAIN -i $interface -s $host -d $destip -p $proto -j ACCEPT" >> "$rules_file" + done done done done - done + fi done @@ -114,20 +108,19 @@ ##################################### unset IFS for rule in $DYNDNS_HOST_OPEN_ICMP; do - interfaces=$(get_ifs "$rule") - destips=$(get_ips "$rule") - hosts=$(get_hosts_ih "$rule") + if parse_rule "$rule" DYNDNS_HOST_OPEN_ICMP "interfaces-destips-hosts"; then - echo "${INDENT}$(show_if_ip "$interfaces" "$destips")Allowing $hosts for ICMP-requests(ping)" - - IFS=',' - for host in $hosts; do - for destip in $destips; do - for interface in $interfaces; do - echo "-A DYNDNS_CHAIN -i $interface -s $host -d $destip -p icmp --icmp-type echo-request -j ACCEPT" >> "$rules_file" + echo "${INDENT}$(show_if_ip "$interfaces" "$destips")Allowing $hosts for ICMP-requests(ping)" + + IFS=',' + for host in $hosts; do + for destip in $destips; do + for interface in $interfaces; do + echo "-A DYNDNS_CHAIN -i $interface -s $host -d $destip -p icmp --icmp-type echo-request -j ACCEPT" >> "$rules_file" + done done done - done + fi done unset IFS This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. |
From: <abe...@us...> - 2012-03-18 00:27:14
|
Revision: 5487 http://astlinux.svn.sourceforge.net/astlinux/?rev=5487&view=rev Author: abelbeck Date: 2012-03-18 00:27:07 +0000 (Sun, 18 Mar 2012) Log Message: ----------- AIF, version bump to 2.0.1b Modified Paths: -------------- branches/1.0/package/arnofw/arnofw.mk branches/1.0/package/arnofw/arnofw.serial Modified: branches/1.0/package/arnofw/arnofw.mk =================================================================== --- branches/1.0/package/arnofw/arnofw.mk 2012-03-17 19:01:37 UTC (rev 5486) +++ branches/1.0/package/arnofw/arnofw.mk 2012-03-18 00:27:07 UTC (rev 5487) @@ -3,7 +3,7 @@ # Arno's IPtables Firewall Script # ############################################################# -ARNOFW_VER:=2.0.1 +ARNOFW_VER:=2.0.1b ARNOFW_ROOT:=arno-iptables-firewall ARNOFW_SOURCE:=$(ARNOFW_ROOT)_$(ARNOFW_VER).tar.gz ARNOFW_SITE:=http://rocky.eld.leidenuniv.nl/arno-iptables-firewall @@ -75,6 +75,8 @@ rm -f $(TARGET_DIR)$(ARNOFW_PLUGIN_SCRIPT_DIR)/??traffic-accounting.plugin \ $(TARGET_DIR)$(ARNOFW_PLUGIN_SCRIPT_DIR)/traffic-accounting-* \ $(TARGET_DIR)/stat$(ARNOFW_PLUGIN_CONFIG_DIR)/traffic-accounting.conf + rm -f $(TARGET_DIR)$(ARNOFW_PLUGIN_SCRIPT_DIR)/??rpc.plugin \ + $(TARGET_DIR)/stat$(ARNOFW_PLUGIN_CONFIG_DIR)/rpc.conf @echo @echo "Clobber the config files from the tarball with our shim-friendly versions." @echo Modified: branches/1.0/package/arnofw/arnofw.serial =================================================================== --- branches/1.0/package/arnofw/arnofw.serial 2012-03-17 19:01:37 UTC (rev 5486) +++ branches/1.0/package/arnofw/arnofw.serial 2012-03-18 00:27:07 UTC (rev 5487) @@ -1 +1 @@ -0002~0013~0000~0000~0000~ +0002~0014~0000~0000~0000~ This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. |
From: <abe...@us...> - 2012-06-29 20:15:58
|
Revision: 5582 http://astlinux.svn.sourceforge.net/astlinux/?rev=5582&view=rev Author: abelbeck Date: 2012-06-29 20:15:51 +0000 (Fri, 29 Jun 2012) Log Message: ----------- AIF, version bump to 2.0.1c Modified Paths: -------------- branches/1.0/package/arnofw/arnofw.mk Removed Paths: ------------- branches/1.0/package/arnofw/arnofw-revision-639.patch Deleted: branches/1.0/package/arnofw/arnofw-revision-639.patch =================================================================== --- branches/1.0/package/arnofw/arnofw-revision-639.patch 2012-06-29 16:36:35 UTC (rev 5581) +++ branches/1.0/package/arnofw/arnofw-revision-639.patch 2012-06-29 20:15:51 UTC (rev 5582) @@ -1,16 +0,0 @@ ---- arno-iptables-firewall_2.0.1b/bin/arno-iptables-firewall.orig (revision 638) -+++ arno-iptables-firewall_2.0.1b/bin/arno-iptables-firewall (revision 639) -@@ -1307,12 +1307,13 @@ - # Allow to send ICMP packets? - ############################# - if [ "$DMZ_OPEN_ICMP" != "0" ]; then - echo " Allowing ICMP-requests(ping)" - iptables -A DMZ_INPUT_CHAIN -p icmp --icmp-type echo-request -m limit --limit 20/second --limit-burst 100 -j ACCEPT - if [ "$IPV6_SUPPORT" = "1" ]; then -+ unset IFS - for icmpv6_type in $ICMPV6_SPECIAL_TYPES; do - ip6tables -A DMZ_INPUT_CHAIN -p icmpv6 --icmpv6-type $icmpv6_type -m hl --hl-eq 255 -j ACCEPT - done - fi - fi - Modified: branches/1.0/package/arnofw/arnofw.mk =================================================================== --- branches/1.0/package/arnofw/arnofw.mk 2012-06-29 16:36:35 UTC (rev 5581) +++ branches/1.0/package/arnofw/arnofw.mk 2012-06-29 20:15:51 UTC (rev 5582) @@ -3,7 +3,7 @@ # Arno's IPtables Firewall Script # ############################################################# -ARNOFW_VER:=2.0.1b +ARNOFW_VER:=2.0.1c ARNOFW_ROOT:=arno-iptables-firewall ARNOFW_SOURCE:=$(ARNOFW_ROOT)_$(ARNOFW_VER).tar.gz ARNOFW_SITE:=http://rocky.eld.leidenuniv.nl/arno-iptables-firewall This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. |
From: <abe...@us...> - 2012-07-06 13:39:43
|
Revision: 5593 http://astlinux.svn.sourceforge.net/astlinux/?rev=5593&view=rev Author: abelbeck Date: 2012-07-06 13:39:37 +0000 (Fri, 06 Jul 2012) Log Message: ----------- AIF, add upstream patch r647 and adjust miniupnpd.plugin to not flush MINIUPNPD iptables nat table rules when AIF is restarted Revision Links: -------------- http://astlinux.svn.sourceforge.net/astlinux/?rev=647&view=rev Modified Paths: -------------- branches/1.0/package/arnofw/miniupnpd/50miniupnpd.plugin.sh Added Paths: ----------- branches/1.0/package/arnofw/arnofw-revision-647.patch Added: branches/1.0/package/arnofw/arnofw-revision-647.patch =================================================================== --- branches/1.0/package/arnofw/arnofw-revision-647.patch (rev 0) +++ branches/1.0/package/arnofw/arnofw-revision-647.patch 2012-07-06 13:39:37 UTC (rev 5593) @@ -0,0 +1,18 @@ +--- arno-iptables-firewall_2.0.1c/bin/arno-iptables-firewall.orig ++++ arno-iptables-firewall_2.0.1c/bin/arno-iptables-firewall +@@ -5128,9 +5128,13 @@ + ip4tables -F OUTPUT + ip4tables -F FORWARD + +- # Flush rules in the nat/mangle tables ++ # Flush builtin IPv4 nat chains ++ ip4tables -t nat -F PREROUTING ++ ip4tables -t nat -F OUTPUT ++ ip4tables -t nat -F POSTROUTING ++ ++ # Flush rules in the mangle table + ip4tables -t mangle -F +- ip4tables -t nat -F + + if [ "$IPV6_DETECTED" = "1" ]; then + # Flush builtin IPv6 chains Modified: branches/1.0/package/arnofw/miniupnpd/50miniupnpd.plugin.sh =================================================================== --- branches/1.0/package/arnofw/miniupnpd/50miniupnpd.plugin.sh 2012-07-05 21:53:14 UTC (rev 5592) +++ branches/1.0/package/arnofw/miniupnpd/50miniupnpd.plugin.sh 2012-07-06 13:39:37 UTC (rev 5593) @@ -5,7 +5,7 @@ PLUGIN_VERSION="1.0" PLUGIN_CONF_FILE="miniupnpd.conf" # -# Last changed : July 4, 2012 +# Last changed : July 6, 2012 # Requirements : AIF 2.0.0+ with miniupnpd daemon # Comments : Setup of the iptables chains that the miniupnpd daemon manages # @@ -33,21 +33,15 @@ # Plugin start function plugin_start() { - local IFS - ip4tables -t nat -N MINIUPNPD 2>/dev/null ip4tables -t nat -F MINIUPNPD ip4tables -N MINIUPNPD 2>/dev/null ip4tables -F MINIUPNPD - IFS=' ,' - for eif in $EXT_IF; do - ip4tables -t nat -A POST_NAT_PREROUTING_CHAIN -i $eif -j MINIUPNPD + # Connect both MINIUPNPD chains + plugin_restart - ip4tables -A POST_FORWARD_CHAIN -i $eif ! -o $eif -j MINIUPNPD - done - return 0 } @@ -55,10 +49,18 @@ # Plugin restart function plugin_restart() { + local eif IFS # Skip plugin_stop on a restart - plugin_start + # Reconnect both MINIUPNPD chains, flushed on a restart + IFS=' ,' + for eif in $EXT_IF; do + ip4tables -t nat -A POST_NAT_PREROUTING_CHAIN -i $eif -j MINIUPNPD + + ip4tables -A POST_FORWARD_CHAIN -i $eif ! -o $eif -j MINIUPNPD + done + return 0 } @@ -66,7 +68,7 @@ # Plugin stop function plugin_stop() { - local IFS + local eif IFS IFS=' ,' for eif in $EXT_IF; do This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. |
From: <abe...@us...> - 2012-07-18 16:23:54
|
Revision: 5617 http://astlinux.svn.sourceforge.net/astlinux/?rev=5617&view=rev Author: abelbeck Date: 2012-07-18 16:23:48 +0000 (Wed, 18 Jul 2012) Log Message: ----------- AIF, include upstream rev. 650 patch, adding non-automatic default policy support https://rocky.eld.leidenuniv.nl/trac/aif/changeset/650/ Modified Paths: -------------- branches/1.0/package/arnofw/arnofw.serial Added Paths: ----------- branches/1.0/package/arnofw/arnofw-revision-650.patch Added: branches/1.0/package/arnofw/arnofw-revision-650.patch =================================================================== --- branches/1.0/package/arnofw/arnofw-revision-650.patch (rev 0) +++ branches/1.0/package/arnofw/arnofw-revision-650.patch 2012-07-18 16:23:48 UTC (rev 5617) @@ -0,0 +1,110 @@ +--- arno-iptables-firewall_2.0.1c/bin/arno-iptables-firewall.orig ++++ arno-iptables-firewall_2.0.1c/bin/arno-iptables-firewall +@@ -2005,13 +2005,14 @@ + iptables -A DMZ_INET_FORWARD_CHAIN -p icmp --icmp-type echo-request -j DROP + + # Set the default policy (switch to DROP for a protocol when xxx_OPEN_xxx variable is used) + ########################################################################################### + if [ -z "$DMZ_INET_OPEN_TCP" -a -z "$DMZ_INET_HOST_OPEN_TCP" -a \ + -z "$DMZ_INET_OPEN_UDP" -a -z "$DMZ_INET_HOST_OPEN_UDP" -a \ +- -z "$DMZ_INET_OPEN_IP" -a -z "$DMZ_INET_HOST_OPEN_IP" ]; then ++ -z "$DMZ_INET_OPEN_IP" -a -z "$DMZ_INET_HOST_OPEN_IP" -a -z "$DMZ_INET_DEFAULT_POLICY_DROP" ] \ ++ || [ "$DMZ_INET_DEFAULT_POLICY_DROP" = "0" ]; then + echo " Allowing all (other) ports/protocols" + iptables -A DMZ_INET_FORWARD_CHAIN -j ACCEPT + else + if [ "$DMZ_OUTPUT_DENY_LOG" != "0" ]; then + iptables -A DMZ_INET_FORWARD_CHAIN -p tcp -m limit \ + --limit 1/s --limit-burst 1 -j LOG --log-level $LOGLEVEL --log-prefix "AIF:DMZ->INET denied: " +@@ -2231,13 +2232,14 @@ + iptables -A INT_INPUT_CHAIN -p icmp --icmp-type echo-request -j DROP + + # Set the default policy + ######################## + if [ -z "$LAN_OPEN_TCP" -a -z "$LAN_HOST_OPEN_TCP" -a \ + -z "$LAN_OPEN_UDP" -a -z "$LAN_HOST_OPEN_UDP" -a \ +- -z "$LAN_OPEN_IP" -a -z "$LAN_HOST_OPEN_IP" ]; then ++ -z "$LAN_OPEN_IP" -a -z "$LAN_HOST_OPEN_IP" -a -z "$LAN_DEFAULT_POLICY_DROP" ] \ ++ || [ "$LAN_DEFAULT_POLICY_DROP" = "0" ]; then + echo " Allowing all (other) ports/protocols" + iptables -A INT_INPUT_CHAIN -j ACCEPT + else + echo " Denying all (other) ports/protocols" + if [ "$LAN_INPUT_DENY_LOG" != "0" ]; then + iptables -A INT_INPUT_CHAIN -m limit \ +@@ -2526,13 +2528,14 @@ + iptables -A LAN_INET_FORWARD_CHAIN -p icmp --icmp-type echo-request -j DROP + + # Set the default policy (switch to DROP for a protocol when xxx_OPEN_xxx variable is used) + ########################################################################################### + if [ -z "$LAN_INET_OPEN_TCP" -a -z "$LAN_INET_HOST_OPEN_TCP" -a \ + -z "$LAN_INET_OPEN_UDP" -a -z "$LAN_INET_HOST_OPEN_UDP" -a \ +- -z "$LAN_INET_OPEN_IP" -a -z "$LAN_INET_HOST_OPEN_IP" ]; then ++ -z "$LAN_INET_OPEN_IP" -a -z "$LAN_INET_HOST_OPEN_IP" -a -z "$LAN_INET_DEFAULT_POLICY_DROP" ] \ ++ || [ "$LAN_INET_DEFAULT_POLICY_DROP" = "0" ]; then + echo " Allowing all (other) ports/protocols" + iptables -A LAN_INET_FORWARD_CHAIN -j ACCEPT + else + if [ "$LAN_OUTPUT_DENY_LOG" != "0" ]; then + iptables -A LAN_INET_FORWARD_CHAIN -p tcp -m limit \ + --limit 1/s --limit-burst 1 -j LOG --log-level $LOGLEVEL --log-prefix "AIF:LAN->INET denied: " +--- arno-iptables-firewall_2.0.1c/etc/arno-iptables-firewall/firewall.conf.orig ++++ arno-iptables-firewall_2.0.1c/etc/arno-iptables-firewall/firewall.conf +@@ -638,12 +638,18 @@ + # # + # Note that when both LAN_OPEN_xxx & LAN_HOST_OPEN_xxx are NOT used, the # + # default policy for this chain is accept (unless denied through # + # LAN_DENY_xxx and/or LAN_HOST_DENY_xxx)! # + ############################################################################### + ++# Disable this (set to "") to automatically set default policy as above. ++# When set to "1" the LAN->localhost default policy will always be DROP ++# When set to "0" the LAN->localhost default policy will always be ACCEPT ++# ----------------------------------------------------------------------------- ++LAN_DEFAULT_POLICY_DROP="" ++ + # Enable this to allow for ICMP-requests(ping) from your LAN + # ----------------------------------------------------------------------------- + LAN_OPEN_ICMP=1 + + # Put in the following variables the TCP/UDP ports or IP protocols TO + # (remote end-point) which the LAN hosts are permitted to connect to. +@@ -691,12 +697,18 @@ + # LAN_INET_xxx = LAN->internet access rules (forward) # + # # + # Note that when the LAN_INET_OPEN_xxx & LAN_INET_HOST_OPEN_xxx variables are # + # NOT used, the default policy will be accept for LAN->INET (unless denied # + # through LAN_INET_DENY_xxx and/or LAN_INET_HOST_DENY_xxx)! # + ############################################################################### ++ ++# Disable this (set to "") to automatically set default policy as above. ++# When set to "1" the LAN->INET default policy will always be DROP ++# When set to "0" the LAN->INET default policy will always be ACCEPT ++# ----------------------------------------------------------------------------- ++LAN_INET_DEFAULT_POLICY_DROP="" + + # Enable this to allow for ICMP-requests(ping) for LAN->INET + # ----------------------------------------------------------------------------- + LAN_INET_OPEN_ICMP=1 + + # Put in the following variables the TCP/UDP ports or IP +@@ -899,12 +911,18 @@ + # # + # Note that when the DMZ_INET_OPEN_xxx & DMZ_INET_HOST_OPEN_xxx variables are # + # NOT used, the default policy will be accept for DMZ->INET (unless denied # + # through DMZ_INET_DENY_xxx and/or DMZ_INET_HOST_DENY_xxx)! # + ############################################################################### + ++# Disable this (set to "") to automatically set default policy as above. ++# When set to "1" the DMZ->INET default policy will always be DROP ++# When set to "0" the DMZ->INET default policy will always be ACCEPT ++# ----------------------------------------------------------------------------- ++DMZ_INET_DEFAULT_POLICY_DROP="" ++ + # Enable this to make the default policy allow for ICMP(ping) for DMZ->INET + # ----------------------------------------------------------------------------- + DMZ_INET_OPEN_ICMP=1 + + # Put in the following variables the TCP/UDP ports or IP + # protocols TO (remote end-point) which the DMZ hosts are + Modified: branches/1.0/package/arnofw/arnofw.serial =================================================================== --- branches/1.0/package/arnofw/arnofw.serial 2012-07-17 23:04:18 UTC (rev 5616) +++ branches/1.0/package/arnofw/arnofw.serial 2012-07-18 16:23:48 UTC (rev 5617) @@ -1 +1 @@ -0002~0015~0000~0000~0000~ +0002~0016~0000~0000~0000~ This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. |
From: <abe...@us...> - 2012-10-28 21:00:35
|
Revision: 5725 http://astlinux.svn.sourceforge.net/astlinux/?rev=5725&view=rev Author: abelbeck Date: 2012-10-28 21:00:24 +0000 (Sun, 28 Oct 2012) Log Message: ----------- arnofw, add openvpn-server plugin Modified Paths: -------------- branches/1.0/package/arnofw/arnofw.mk branches/1.0/package/arnofw/arnofw.serial Added Paths: ----------- branches/1.0/package/arnofw/openvpn-server/ branches/1.0/package/arnofw/openvpn-server/50openvpn-server.plugin.sh branches/1.0/package/arnofw/openvpn-server/openvpn-server-astlinux.conf Modified: branches/1.0/package/arnofw/arnofw.mk =================================================================== --- branches/1.0/package/arnofw/arnofw.mk 2012-10-28 19:49:31 UTC (rev 5724) +++ branches/1.0/package/arnofw/arnofw.mk 2012-10-28 21:00:24 UTC (rev 5725) @@ -112,6 +112,13 @@ $(INSTALL) -m 0644 package/arnofw/traffic-shaper/traffic-shaper-astlinux.conf \ $(TARGET_DIR)/stat$(ARNOFW_PLUGIN_CONFIG_DIR)/traffic-shaper.conf @echo + @echo "Install local version of OpenVPN Server plugin." + @echo + $(INSTALL) -m 0644 package/arnofw/openvpn-server/50openvpn-server.plugin.sh \ + $(TARGET_DIR)$(ARNOFW_PLUGIN_SCRIPT_DIR)/50openvpn-server.plugin + $(INSTALL) -m 0644 package/arnofw/openvpn-server/openvpn-server-astlinux.conf \ + $(TARGET_DIR)/stat$(ARNOFW_PLUGIN_CONFIG_DIR)/openvpn-server.conf + @echo @echo "Install local version of PPTP VPN plugin." @echo $(INSTALL) -m 0644 package/arnofw/pptp-vpn/50pptp-vpn.plugin.sh \ Modified: branches/1.0/package/arnofw/arnofw.serial =================================================================== --- branches/1.0/package/arnofw/arnofw.serial 2012-10-28 19:49:31 UTC (rev 5724) +++ branches/1.0/package/arnofw/arnofw.serial 2012-10-28 21:00:24 UTC (rev 5725) @@ -1 +1 @@ -0002~0016~0000~0000~0000~ +0002~0017~0000~0000~0000~ Added: branches/1.0/package/arnofw/openvpn-server/50openvpn-server.plugin.sh =================================================================== --- branches/1.0/package/arnofw/openvpn-server/50openvpn-server.plugin.sh (rev 0) +++ branches/1.0/package/arnofw/openvpn-server/50openvpn-server.plugin.sh 2012-10-28 21:00:24 UTC (rev 5725) @@ -0,0 +1,137 @@ +# ------------------------------------------------------------------------------ +# -= Arno's iptables firewall - OpenVPN Server plugin =- +# +PLUGIN_NAME="OpenVPN Server plugin" +PLUGIN_VERSION="1.00 BETA" +PLUGIN_CONF_FILE="openvpn-server.conf" +# +# Last changed : October 28, 2012 +# Requirements : AIF 2.0.0+ +# Comments : This plugin allows access to an OpenVPN Server. +# +# Author : (C) Copyright 2012 by Lonnie Abelbeck & Arno van Amersfoort +# Homepage : http://rocky.eld.leidenuniv.nl/ +# Freshmeat homepage : http://freshmeat.net/projects/iptables-firewall/?topic_id=151 +# Email : a r n o v a AT r o c k y DOT e l d DOT l e i d e n u n i v DOT n l +# (note: you must remove all spaces and substitute the @ and the . +# at the proper locations!) +# ------------------------------------------------------------------------------ +# This program is free software; you can redistribute it and/or +# modify it under the terms of the GNU General Public License +# version 2 as published by the Free Software Foundation. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. +# ------------------------------------------------------------------------------ + +# Plugin start function +plugin_start() +{ + local host proto port IFS + + if [ -z "$OPENVPN_SERVER_TUNNEL_HOSTS" ]; then + OPENVPN_SERVER_TUNNEL_HOSTS="0/0" + fi + + echo "${INDENT}Allowing internet hosts $OPENVPN_SERVER_TUNNEL_HOSTS to access the OpenVPN Server service" + port="$OPENVPN_SERVER_PORT" + case $OPENVPN_SERVER_PROTOCOL in + udp|UDP) proto="udp" ;; + tcp*|TCP*) proto="tcp" ;; + esac + IFS=' ,' + for host in $(ip_range "$OPENVPN_SERVER_TUNNEL_HOSTS"); do + iptables -A EXT_INPUT_CHAIN -p $proto --dport $port -s $host -j ACCEPT + done + + return 0 +} + + +# Plugin restart function +plugin_restart() +{ + + # Skip plugin_stop on a restart + plugin_start + + return 0 +} + + +# Plugin stop function +plugin_stop() +{ + + return 0 +} + + +# Plugin status function +plugin_status() +{ + return 0 +} + + +# Check sanity of eg. environment +plugin_sanity_check() +{ + # Sanity check + if [ -z "$OPENVPN_SERVER_PORT" -o -z "$OPENVPN_SERVER_PROTOCOL" ]; then + printf "\033[40m\033[1;31m${INDENT}ERROR: The plugin config file is not properly set!\033[0m\n" >&2 + return 1 + fi + + return 0 +} + + +############ +# Mainline # +############ + +# Check where to find the config file +CONF_FILE="" +if [ -n "$PLUGIN_CONF_PATH" ]; then + CONF_FILE="$PLUGIN_CONF_PATH/$PLUGIN_CONF_FILE" +fi + +# Check if the config file exists +if [ ! -e "$CONF_FILE" ]; then + printf "NOTE: Config file \"$CONF_FILE\" not found!\n Plugin \"$PLUGIN_NAME v$PLUGIN_VERSION\" ignored!\n" >&2 + PLUGIN_RET_VAL=0 +else + # Source the plugin config file + . "$CONF_FILE" + + if [ "$ENABLED" = "1" -a "$PLUGIN_CMD" != "stop-restart" ] || + [ "$ENABLED" = "0" -a "$PLUGIN_CMD" = "stop-restart" ] || + [ -n "$PLUGIN_LOAD_FILE" -a "$PLUGIN_CMD" = "stop" ] || + [ -n "$PLUGIN_LOAD_FILE" -a "$PLUGIN_CMD" = "status" ]; then + # Show who we are: + echo "${INDENT}$PLUGIN_NAME v$PLUGIN_VERSION" + + # Increment indention + INDENT="$INDENT " + + # Only proceed if environment ok + if plugin_sanity_check; then + case $PLUGIN_CMD in + start|'') plugin_start; PLUGIN_RET_VAL=$?;; + restart ) plugin_restart; PLUGIN_RET_VAL=$?;; + stop|stop-restart) plugin_stop; PLUGIN_RET_VAL=$?;; + status ) plugin_status; PLUGIN_RET_VAL=$?;; + * ) PLUGIN_RET_VAL=1; printf "\033[40m\033[1;31m ERROR: Invalid plugin option \"$PLUGIN_CMD\"!\033[0m\n" >&2;; + esac + fi + else + PLUGIN_RET_VAL=0 + fi +fi Added: branches/1.0/package/arnofw/openvpn-server/openvpn-server-astlinux.conf =================================================================== --- branches/1.0/package/arnofw/openvpn-server/openvpn-server-astlinux.conf (rev 0) +++ branches/1.0/package/arnofw/openvpn-server/openvpn-server-astlinux.conf 2012-10-28 21:00:24 UTC (rev 5725) @@ -0,0 +1,34 @@ +# ------------------------------------------------------------------------------ +# -= Arno's iptables firewall - OpenVPN Server plugin =- +# ------------------------------------------------------------------------------ + +# To actually enable this plugin make ENABLED=1: +# ------------------------------------------------------------------------------ +# Automatically enabled when AstLinux OpenVPN Server is enabled. +ENABLED=0 + +# ------------------------------------------------------------------------------ +# *** Do Not Edit Below Here *** +# AstLinux specific mappings, either edit your /mnt/kd/rc.conf file +# or, use Network tab -> OpenVPN Server - [OpenVPN Configuration] +# from the web interface. +# ------------------------------------------------------------------------------ +# Indent script section so script variables won't be merged + + ENABLED=0 + OPENVPN_SERVER_PORT="$OVPN_PORT" + OPENVPN_SERVER_PROTOCOL="$OVPN_PROTOCOL" + OPENVPN_SERVER_TUNNEL_HOSTS="$OVPN_TUNNEL_HOSTS" + vpntype_openvpn=0 + + unset IFS + for vpntype in $VPN; do + case $vpntype in + openvpn) vpntype_openvpn=1 ;; + esac + done + + if [ $vpntype_openvpn -eq 1 ]; then + ENABLED=1 + fi + This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. |
From: <abe...@us...> - 2012-11-18 23:57:20
|
Revision: 5767 http://astlinux.svn.sourceforge.net/astlinux/?rev=5767&view=rev Author: abelbeck Date: 2012-11-18 23:57:13 +0000 (Sun, 18 Nov 2012) Log Message: ----------- arnofw, version bump to 2.0.1d. Note: 2.0.1d has been officially tagged, but Arno has not yet built the official image, so files.astlinux.org hosts it for now Modified Paths: -------------- branches/1.0/package/arnofw/arnofw.mk branches/1.0/package/arnofw/arnofw.serial Removed Paths: ------------- branches/1.0/package/arnofw/arnofw-revision-647.patch branches/1.0/package/arnofw/arnofw-revision-650.patch branches/1.0/package/arnofw/arnofw-revision-676.patch Deleted: branches/1.0/package/arnofw/arnofw-revision-647.patch =================================================================== --- branches/1.0/package/arnofw/arnofw-revision-647.patch 2012-11-15 00:13:50 UTC (rev 5766) +++ branches/1.0/package/arnofw/arnofw-revision-647.patch 2012-11-18 23:57:13 UTC (rev 5767) @@ -1,18 +0,0 @@ ---- arno-iptables-firewall_2.0.1c/bin/arno-iptables-firewall.orig -+++ arno-iptables-firewall_2.0.1c/bin/arno-iptables-firewall -@@ -5128,9 +5128,13 @@ - ip4tables -F OUTPUT - ip4tables -F FORWARD - -- # Flush rules in the nat/mangle tables -+ # Flush builtin IPv4 nat chains -+ ip4tables -t nat -F PREROUTING -+ ip4tables -t nat -F OUTPUT -+ ip4tables -t nat -F POSTROUTING -+ -+ # Flush rules in the mangle table - ip4tables -t mangle -F -- ip4tables -t nat -F - - if [ "$IPV6_DETECTED" = "1" ]; then - # Flush builtin IPv6 chains Deleted: branches/1.0/package/arnofw/arnofw-revision-650.patch =================================================================== --- branches/1.0/package/arnofw/arnofw-revision-650.patch 2012-11-15 00:13:50 UTC (rev 5766) +++ branches/1.0/package/arnofw/arnofw-revision-650.patch 2012-11-18 23:57:13 UTC (rev 5767) @@ -1,110 +0,0 @@ ---- arno-iptables-firewall_2.0.1c/bin/arno-iptables-firewall.orig -+++ arno-iptables-firewall_2.0.1c/bin/arno-iptables-firewall -@@ -2005,13 +2005,14 @@ - iptables -A DMZ_INET_FORWARD_CHAIN -p icmp --icmp-type echo-request -j DROP - - # Set the default policy (switch to DROP for a protocol when xxx_OPEN_xxx variable is used) - ########################################################################################### - if [ -z "$DMZ_INET_OPEN_TCP" -a -z "$DMZ_INET_HOST_OPEN_TCP" -a \ - -z "$DMZ_INET_OPEN_UDP" -a -z "$DMZ_INET_HOST_OPEN_UDP" -a \ -- -z "$DMZ_INET_OPEN_IP" -a -z "$DMZ_INET_HOST_OPEN_IP" ]; then -+ -z "$DMZ_INET_OPEN_IP" -a -z "$DMZ_INET_HOST_OPEN_IP" -a -z "$DMZ_INET_DEFAULT_POLICY_DROP" ] \ -+ || [ "$DMZ_INET_DEFAULT_POLICY_DROP" = "0" ]; then - echo " Allowing all (other) ports/protocols" - iptables -A DMZ_INET_FORWARD_CHAIN -j ACCEPT - else - if [ "$DMZ_OUTPUT_DENY_LOG" != "0" ]; then - iptables -A DMZ_INET_FORWARD_CHAIN -p tcp -m limit \ - --limit 1/s --limit-burst 1 -j LOG --log-level $LOGLEVEL --log-prefix "AIF:DMZ->INET denied: " -@@ -2231,13 +2232,14 @@ - iptables -A INT_INPUT_CHAIN -p icmp --icmp-type echo-request -j DROP - - # Set the default policy - ######################## - if [ -z "$LAN_OPEN_TCP" -a -z "$LAN_HOST_OPEN_TCP" -a \ - -z "$LAN_OPEN_UDP" -a -z "$LAN_HOST_OPEN_UDP" -a \ -- -z "$LAN_OPEN_IP" -a -z "$LAN_HOST_OPEN_IP" ]; then -+ -z "$LAN_OPEN_IP" -a -z "$LAN_HOST_OPEN_IP" -a -z "$LAN_DEFAULT_POLICY_DROP" ] \ -+ || [ "$LAN_DEFAULT_POLICY_DROP" = "0" ]; then - echo " Allowing all (other) ports/protocols" - iptables -A INT_INPUT_CHAIN -j ACCEPT - else - echo " Denying all (other) ports/protocols" - if [ "$LAN_INPUT_DENY_LOG" != "0" ]; then - iptables -A INT_INPUT_CHAIN -m limit \ -@@ -2526,13 +2528,14 @@ - iptables -A LAN_INET_FORWARD_CHAIN -p icmp --icmp-type echo-request -j DROP - - # Set the default policy (switch to DROP for a protocol when xxx_OPEN_xxx variable is used) - ########################################################################################### - if [ -z "$LAN_INET_OPEN_TCP" -a -z "$LAN_INET_HOST_OPEN_TCP" -a \ - -z "$LAN_INET_OPEN_UDP" -a -z "$LAN_INET_HOST_OPEN_UDP" -a \ -- -z "$LAN_INET_OPEN_IP" -a -z "$LAN_INET_HOST_OPEN_IP" ]; then -+ -z "$LAN_INET_OPEN_IP" -a -z "$LAN_INET_HOST_OPEN_IP" -a -z "$LAN_INET_DEFAULT_POLICY_DROP" ] \ -+ || [ "$LAN_INET_DEFAULT_POLICY_DROP" = "0" ]; then - echo " Allowing all (other) ports/protocols" - iptables -A LAN_INET_FORWARD_CHAIN -j ACCEPT - else - if [ "$LAN_OUTPUT_DENY_LOG" != "0" ]; then - iptables -A LAN_INET_FORWARD_CHAIN -p tcp -m limit \ - --limit 1/s --limit-burst 1 -j LOG --log-level $LOGLEVEL --log-prefix "AIF:LAN->INET denied: " ---- arno-iptables-firewall_2.0.1c/etc/arno-iptables-firewall/firewall.conf.orig -+++ arno-iptables-firewall_2.0.1c/etc/arno-iptables-firewall/firewall.conf -@@ -638,12 +638,18 @@ - # # - # Note that when both LAN_OPEN_xxx & LAN_HOST_OPEN_xxx are NOT used, the # - # default policy for this chain is accept (unless denied through # - # LAN_DENY_xxx and/or LAN_HOST_DENY_xxx)! # - ############################################################################### - -+# Disable this (set to "") to automatically set default policy as above. -+# When set to "1" the LAN->localhost default policy will always be DROP -+# When set to "0" the LAN->localhost default policy will always be ACCEPT -+# ----------------------------------------------------------------------------- -+LAN_DEFAULT_POLICY_DROP="" -+ - # Enable this to allow for ICMP-requests(ping) from your LAN - # ----------------------------------------------------------------------------- - LAN_OPEN_ICMP=1 - - # Put in the following variables the TCP/UDP ports or IP protocols TO - # (remote end-point) which the LAN hosts are permitted to connect to. -@@ -691,12 +697,18 @@ - # LAN_INET_xxx = LAN->internet access rules (forward) # - # # - # Note that when the LAN_INET_OPEN_xxx & LAN_INET_HOST_OPEN_xxx variables are # - # NOT used, the default policy will be accept for LAN->INET (unless denied # - # through LAN_INET_DENY_xxx and/or LAN_INET_HOST_DENY_xxx)! # - ############################################################################### -+ -+# Disable this (set to "") to automatically set default policy as above. -+# When set to "1" the LAN->INET default policy will always be DROP -+# When set to "0" the LAN->INET default policy will always be ACCEPT -+# ----------------------------------------------------------------------------- -+LAN_INET_DEFAULT_POLICY_DROP="" - - # Enable this to allow for ICMP-requests(ping) for LAN->INET - # ----------------------------------------------------------------------------- - LAN_INET_OPEN_ICMP=1 - - # Put in the following variables the TCP/UDP ports or IP -@@ -899,12 +911,18 @@ - # # - # Note that when the DMZ_INET_OPEN_xxx & DMZ_INET_HOST_OPEN_xxx variables are # - # NOT used, the default policy will be accept for DMZ->INET (unless denied # - # through DMZ_INET_DENY_xxx and/or DMZ_INET_HOST_DENY_xxx)! # - ############################################################################### - -+# Disable this (set to "") to automatically set default policy as above. -+# When set to "1" the DMZ->INET default policy will always be DROP -+# When set to "0" the DMZ->INET default policy will always be ACCEPT -+# ----------------------------------------------------------------------------- -+DMZ_INET_DEFAULT_POLICY_DROP="" -+ - # Enable this to make the default policy allow for ICMP(ping) for DMZ->INET - # ----------------------------------------------------------------------------- - DMZ_INET_OPEN_ICMP=1 - - # Put in the following variables the TCP/UDP ports or IP - # protocols TO (remote end-point) which the DMZ hosts are - Deleted: branches/1.0/package/arnofw/arnofw-revision-676.patch =================================================================== --- branches/1.0/package/arnofw/arnofw-revision-676.patch 2012-11-15 00:13:50 UTC (rev 5766) +++ branches/1.0/package/arnofw/arnofw-revision-676.patch 2012-11-18 23:57:13 UTC (rev 5767) @@ -1,43 +0,0 @@ ---- arno-iptables-firewall_2.0.1c/share/arno-iptables-firewall/environment.orig -+++ arno-iptables-firewall_2.0.1c/share/arno-iptables-firewall/environment -@@ -307,13 +307,19 @@ - # Show any (error) messages in red - printf "\033[40m\033[1;31m${IP4TABLES} $*\nERROR ($retval): ${result}\033[0m\n" >&2 - if note_iptables_error "$@"; then - RULE_WARNING=1 - fi - elif [ -n "$result" ]; then -- echo "${INDENT}$result" -+ # Filter successful, informational results -+ case "$result" in -+ 'WARNING: '*' match is obsolete'*) -+ ;; -+ *) echo "${INDENT}$result" -+ ;; -+ esac - fi - - return $retval - } - - -@@ -328,13 +334,19 @@ - # Show any (error) messages in red - printf "\033[40m\033[1;31m${IP6TABLES} $*\nERROR ($retval): ${result}\033[0m\n" >&2 - if note_iptables_error "$@"; then - RULE_WARNING=1 - fi - elif [ -n "$result" ]; then -- echo "${INDENT}$result" -+ # Filter successful, informational results -+ case "$result" in -+ 'WARNING: '*' match is obsolete'*) -+ ;; -+ *) echo "${INDENT}$result" -+ ;; -+ esac - fi - - return $retval - } - Modified: branches/1.0/package/arnofw/arnofw.mk =================================================================== --- branches/1.0/package/arnofw/arnofw.mk 2012-11-15 00:13:50 UTC (rev 5766) +++ branches/1.0/package/arnofw/arnofw.mk 2012-11-18 23:57:13 UTC (rev 5767) @@ -3,11 +3,11 @@ # Arno's IPtables Firewall Script # ############################################################# -ARNOFW_VER:=2.0.1c +ARNOFW_VER:=2.0.1d ARNOFW_ROOT:=arno-iptables-firewall ARNOFW_SOURCE:=$(ARNOFW_ROOT)_$(ARNOFW_VER).tar.gz -ARNOFW_SITE:=http://rocky.eld.leidenuniv.nl/arno-iptables-firewall -#ARNOFW_SITE:=http://lonnie.abelbeck.com/astlinux/aif +#ARNOFW_SITE:=http://rocky.eld.leidenuniv.nl/arno-iptables-firewall +ARNOFW_SITE:=http://files.astlinux.org ARNOFW_DIR:=$(BUILD_DIR)/$(ARNOFW_ROOT)_$(ARNOFW_VER) ARNOFW_CAT:=zcat ARNOFW_TARGET_BINARY:=/usr/sbin/arno-iptables-firewall Modified: branches/1.0/package/arnofw/arnofw.serial =================================================================== --- branches/1.0/package/arnofw/arnofw.serial 2012-11-15 00:13:50 UTC (rev 5766) +++ branches/1.0/package/arnofw/arnofw.serial 2012-11-18 23:57:13 UTC (rev 5767) @@ -1 +1 @@ -0002~0017~0000~0000~0000~ +0002~0018~0000~0000~0000~ This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. |
From: <abe...@us...> - 2013-05-07 23:30:41
|
Revision: 6076 http://sourceforge.net/p/astlinux/code/6076 Author: abelbeck Date: 2013-05-07 23:30:35 +0000 (Tue, 07 May 2013) Log Message: ----------- arnofw, time-schedule-host-block plugin, add TIME_SCHEDULE_HOST_BLOCK_LOG logging option Modified Paths: -------------- branches/1.0/package/arnofw/arnofw.serial branches/1.0/package/arnofw/time-schedule-host-block/30time-schedule-host-block.plugin.sh branches/1.0/package/arnofw/time-schedule-host-block/time-schedule-host-block.conf Modified: branches/1.0/package/arnofw/arnofw.serial =================================================================== --- branches/1.0/package/arnofw/arnofw.serial 2013-05-07 17:32:25 UTC (rev 6075) +++ branches/1.0/package/arnofw/arnofw.serial 2013-05-07 23:30:35 UTC (rev 6076) @@ -1 +1 @@ -0002~0019~0000~0000~0000~ +0002~0020~0000~0000~0000~ Modified: branches/1.0/package/arnofw/time-schedule-host-block/30time-schedule-host-block.plugin.sh =================================================================== --- branches/1.0/package/arnofw/time-schedule-host-block/30time-schedule-host-block.plugin.sh 2013-05-07 17:32:25 UTC (rev 6075) +++ branches/1.0/package/arnofw/time-schedule-host-block/30time-schedule-host-block.plugin.sh 2013-05-07 23:30:35 UTC (rev 6076) @@ -32,8 +32,11 @@ # Plugin start function plugin_start() { - local rule type data addr timestart timestop weekdays i DAYS SHOWRULE IFS + local rule type data addr timestart timestop weekdays i DAYS SHOWRULE LOG LOG_PREFIX IFS + LOG="-m limit --limit 3/m --limit-burst 1 -j LOG --log-level $LOGLEVEL --log-prefix" + LOG_PREFIX="AIF:Time Schedule Host Block:" + IFS=$EOL for rule in $TIME_SCHEDULE_HOST_BLOCK_MAC; do unset IFS @@ -83,16 +86,28 @@ case $type in LAN-EXT|lan-ext) echo "$SHOWRULE" + if [ "$TIME_SCHEDULE_HOST_BLOCK_LOG" = "1" ]; then + iptables -A LAN_INET_FORWARD_CHAIN -m mac --mac-source $addr \ + -m time --timestart $timestart --timestop $timestop $DAYS $LOG "$LOG_PREFIX" + fi iptables -A LAN_INET_FORWARD_CHAIN -m mac --mac-source $addr \ -m time --timestart $timestart --timestop $timestop $DAYS -j REJECT ;; DMZ-EXT|dmz-ext) echo "$SHOWRULE" + if [ "$TIME_SCHEDULE_HOST_BLOCK_LOG" = "1" ]; then + iptables -A DMZ_INET_FORWARD_CHAIN -m mac --mac-source $addr \ + -m time --timestart $timestart --timestop $timestop $DAYS $LOG "$LOG_PREFIX" + fi iptables -A DMZ_INET_FORWARD_CHAIN -m mac --mac-source $addr \ -m time --timestart $timestart --timestop $timestop $DAYS -j REJECT ;; ANY|any) echo "$SHOWRULE" + if [ "$TIME_SCHEDULE_HOST_BLOCK_LOG" = "1" ]; then + iptables -A FORWARD_CHAIN -m mac --mac-source $addr \ + -m time --timestart $timestart --timestop $timestop $DAYS $LOG "$LOG_PREFIX" + fi iptables -A FORWARD_CHAIN -m mac --mac-source $addr \ -m time --timestart $timestart --timestop $timestop $DAYS -j REJECT ;; @@ -131,16 +146,28 @@ case $type in LAN-EXT|lan-ext) echo "$SHOWRULE" + if [ "$TIME_SCHEDULE_HOST_BLOCK_LOG" = "1" ]; then + iptables -A LAN_INET_FORWARD_CHAIN -s $addr \ + -m time --timestart $timestart --timestop $timestop $DAYS $LOG "$LOG_PREFIX" + fi iptables -A LAN_INET_FORWARD_CHAIN -s $addr \ -m time --timestart $timestart --timestop $timestop $DAYS -j REJECT ;; DMZ-EXT|dmz-ext) echo "$SHOWRULE" + if [ "$TIME_SCHEDULE_HOST_BLOCK_LOG" = "1" ]; then + iptables -A DMZ_INET_FORWARD_CHAIN -s $addr \ + -m time --timestart $timestart --timestop $timestop $DAYS $LOG "$LOG_PREFIX" + fi iptables -A DMZ_INET_FORWARD_CHAIN -s $addr \ -m time --timestart $timestart --timestop $timestop $DAYS -j REJECT ;; ANY|any) echo "$SHOWRULE" + if [ "$TIME_SCHEDULE_HOST_BLOCK_LOG" = "1" ]; then + iptables -A FORWARD_CHAIN -s $addr \ + -m time --timestart $timestart --timestop $timestop $DAYS $LOG "$LOG_PREFIX" + fi iptables -A FORWARD_CHAIN -s $addr \ -m time --timestart $timestart --timestop $timestop $DAYS -j REJECT ;; @@ -152,6 +179,12 @@ esac done + if [ "$TIME_SCHEDULE_HOST_BLOCK_LOG" = "1" ]; then + echo "${INDENT}Logging of Time Schedule Host Block packets: Enabled" + else + echo "${INDENT}Logging of Time Schedule Host Block packets: Disabled" + fi + return 0 } Modified: branches/1.0/package/arnofw/time-schedule-host-block/time-schedule-host-block.conf =================================================================== --- branches/1.0/package/arnofw/time-schedule-host-block/time-schedule-host-block.conf 2013-05-07 17:32:25 UTC (rev 6075) +++ branches/1.0/package/arnofw/time-schedule-host-block/time-schedule-host-block.conf 2013-05-07 23:30:35 UTC (rev 6076) @@ -47,3 +47,8 @@ #DMZ-EXT|192.168.1.1/24~21:00~7:00 " +# Enable logging for both TIME_SCHEDULE_HOST_BLOCK_MAC and +# TIME_SCHEDULE_HOST_BLOCK variables when set to "1" +# ------------------------------------------------------------------------------ +TIME_SCHEDULE_HOST_BLOCK_LOG=0 + This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. |
From: <abe...@us...> - 2013-08-22 19:46:39
|
Revision: 6176 http://sourceforge.net/p/astlinux/code/6176 Author: abelbeck Date: 2013-08-22 19:46:33 +0000 (Thu, 22 Aug 2013) Log Message: ----------- arnofw, Adaptive Ban plugin, add support for 'prosody' and remove old 'mini_httpd' support Modified Paths: -------------- branches/1.0/package/arnofw/adaptive-ban/95adaptive-ban.plugin.sh branches/1.0/package/arnofw/adaptive-ban/adaptive-ban-helper.sh branches/1.0/package/arnofw/adaptive-ban/adaptive-ban.conf branches/1.0/package/arnofw/arnofw.serial Modified: branches/1.0/package/arnofw/adaptive-ban/95adaptive-ban.plugin.sh =================================================================== --- branches/1.0/package/arnofw/adaptive-ban/95adaptive-ban.plugin.sh 2013-08-22 19:00:25 UTC (rev 6175) +++ branches/1.0/package/arnofw/adaptive-ban/95adaptive-ban.plugin.sh 2013-08-22 19:46:33 UTC (rev 6176) @@ -2,10 +2,10 @@ # -= Arno's iptables firewall - Adaptive Ban plugin =- # PLUGIN_NAME="Adaptive Ban plugin" -PLUGIN_VERSION="1.06" +PLUGIN_VERSION="1.07" PLUGIN_CONF_FILE="adaptive-ban.conf" # -# Last changed : July 19, 2013 +# Last changed : August 22, 2013 # Requirements : AIF 2.0.0+ # Comments : Parse a log file for failed access with offending IP addresses # Ban the IP address after multiple failed attempts Modified: branches/1.0/package/arnofw/adaptive-ban/adaptive-ban-helper.sh =================================================================== --- branches/1.0/package/arnofw/adaptive-ban/adaptive-ban-helper.sh 2013-08-22 19:00:25 UTC (rev 6175) +++ branches/1.0/package/arnofw/adaptive-ban/adaptive-ban-helper.sh 2013-08-22 19:46:33 UTC (rev 6176) @@ -134,7 +134,7 @@ ;; lighttpd) filter_lighttpd "$file" "$PREFIX" "$HOST" ;; - mini_httpd) filter_mini_httpd "$file" "$PREFIX" "$HOST" + prosody) filter_prosody "$file" "$PREFIX" "$HOST" ;; pptpd) filter_pptpd "$file" "$PREFIX" "$HOST" ;; @@ -185,11 +185,11 @@ "$file" >"$TEMPFILE" } -filter_mini_httpd() +filter_prosody() { local file="$1" PREFIX="$2" HOST="$3" - sed -n -r -e "s/^${PREFIX}${HOST} authentication failure - access denied$/\1/p" \ + sed -n -r -e "s/^${PREFIX}.* Failed authentication attempt \(.*\) from IP: ${HOST}[[:space:]]*$/\1/p" \ "$file" >"$TEMPFILE" } Modified: branches/1.0/package/arnofw/adaptive-ban/adaptive-ban.conf =================================================================== --- branches/1.0/package/arnofw/adaptive-ban/adaptive-ban.conf 2013-08-22 19:00:25 UTC (rev 6175) +++ branches/1.0/package/arnofw/adaptive-ban/adaptive-ban.conf 2013-08-22 19:46:33 UTC (rev 6176) @@ -19,7 +19,7 @@ ADAPTIVE_BAN_COUNT=6 # A list of analysis types that are applied -# Choose from: sshd asterisk lighttpd mini_httpd pptpd +# Choose from: sshd asterisk lighttpd prosody pptpd # ------------------------------------------------------------------------------ ADAPTIVE_BAN_TYPES="sshd asterisk" Modified: branches/1.0/package/arnofw/arnofw.serial =================================================================== --- branches/1.0/package/arnofw/arnofw.serial 2013-08-22 19:00:25 UTC (rev 6175) +++ branches/1.0/package/arnofw/arnofw.serial 2013-08-22 19:46:33 UTC (rev 6176) @@ -1 +1 @@ -0002~0020~0000~0000~0000~ +0002~0021~0000~0000~0000~ This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. |
From: <abe...@us...> - 2014-02-02 14:07:26
|
Revision: 6395 http://sourceforge.net/p/astlinux/code/6395 Author: abelbeck Date: 2014-02-02 14:07:23 +0000 (Sun, 02 Feb 2014) Log Message: ----------- arnofw, version bump to 2.0.1e Modified Paths: -------------- branches/1.0/package/arnofw/arnofw.mk Removed Paths: ------------- branches/1.0/package/arnofw/arnofw-remove-trace-2-0-1e.patch Deleted: branches/1.0/package/arnofw/arnofw-remove-trace-2-0-1e.patch =================================================================== --- branches/1.0/package/arnofw/arnofw-remove-trace-2-0-1e.patch 2014-01-31 19:09:51 UTC (rev 6394) +++ branches/1.0/package/arnofw/arnofw-remove-trace-2-0-1e.patch 2014-02-02 14:07:23 UTC (rev 6395) @@ -1,150 +0,0 @@ ---- arno-iptables-firewall_2.0.1d/share/arno-iptables-firewall/environment.orig -+++ arno-iptables-firewall_2.0.1d/share/arno-iptables-firewall/environment -@@ -4,10 +4,8 @@ - # - # ~ In memory of my dear father ~ - # --# (C) Copyright 2001-2012 by Arno van Amersfoort --# Co-authors : Lonnie Abelbeck & Philip Prindeville -+# (C) Copyright 2001-2014 by Arno van Amersfoort & Lonnie Abelbeck - # Homepage : http://rocky.eld.leidenuniv.nl/ --# Freshmeat homepage : http://freshmeat.net/projects/iptables-firewall/?topic_id=151 - # Email : a r n o v a AT r o c k y DOT e l d DOT l e i d e n u n i v DOT n l - # (note: you must remove all spaces and substitute the @ and the . - # at the proper locations!) -@@ -46,16 +44,6 @@ - - ################################# Functions #################################### - --trace() --{ -- if [ -n "$TRACEFILE" ]; then -- ((PS4='' ; set -x ; : "$@" >/dev/null) 2>&1 ) | sed 's/^: //' >> $TRACEFILE -- else -- "$@" -- fi --} -- -- - # Find command path with '/hint/path/command' as the argument - find_command() - { -@@ -303,7 +291,7 @@ - { - local result retval IFS=' ' - -- result=`trace $IP4TABLES "$@" 2>&1` -+ result=`$IP4TABLES "$@" 2>&1` - retval=$? - - if [ $retval -ne 0 ]; then -@@ -330,7 +318,7 @@ - { - local result retval IFS=' ' - -- result=`trace $IP6TABLES "$@" 2>&1` -+ result=`$IP6TABLES "$@" 2>&1` - retval=$? - - if [ $retval -ne 0 ]; then -@@ -429,7 +417,7 @@ - { - local IFS=' ' - -- trace $IP4TABLES "$@" >/dev/null 2>&1 -+ $IP4TABLES "$@" >/dev/null 2>&1 - } - - -@@ -437,7 +425,7 @@ - { - local IFS=' ' - -- trace $IP6TABLES "$@" >/dev/null 2>&1 -+ $IP6TABLES "$@" >/dev/null 2>&1 - } - - -@@ -452,7 +440,7 @@ - # Make sure environment variable is not set - MODPROBE_OPTIONS="" - -- result=`trace $MODPROBE $@ 2>&1` -+ result=`$MODPROBE $@ 2>&1` - retval=$? - - if [ $retval -ne 0 ]; then -@@ -514,7 +502,7 @@ - modprobe_commandline="$modprobe_commandline $module" - - IFS=' ' -- result=`trace $modprobe_commandline 2>&1` -+ result=`$modprobe_commandline 2>&1` - retval=$? - - if [ $retval -ne 0 ]; then -@@ -554,7 +542,7 @@ - { - local result retval IFS=' ' - -- result=`trace $SYSCTL "$@" 2>&1` -+ result=`$SYSCTL "$@" 2>&1` - retval=$? - - if [ $retval -ne 0 ]; then -@@ -594,7 +582,7 @@ - fi - sysctl_commandline="$sysctl_commandline $variable" - -- result=`trace $sysctl_commandline 2>&1` -+ result=`$sysctl_commandline 2>&1` - retval=$? - - if [ $retval -eq 0 ]; then -@@ -645,7 +633,7 @@ - ################### - tc() - { -- trace $TC "$@" -+ $TC "$@" - } - - -@@ -653,7 +641,7 @@ - ################### - ip() - { -- trace $IP "$@" -+ $IP "$@" - } - - -@@ -767,7 +755,7 @@ - case $if1 in - *+) - if1="${if1%+}" -- if1="$($IP link | awk "\$2 ~ /${if1}[0-9]+:/ { print substr(\$2, 1, length(\$2)-1); }" | tr '\n' ' ')" -+ if1="$(ip link | awk "\$2 ~ /${if1}[0-9]+:/ { print substr(\$2, 1, length(\$2)-1); }" | tr '\n' ' ')" - if [ -z "$if1" ]; then - echo "wildcard: $if0 unmatched!" >&2 - continue -@@ -1654,14 +1642,6 @@ - IPV6_SUPPORT=0 - fi - --# check for tracing --################### --if [ "$TRACE" = "1" ]; then -- TRACEFILE="/tmp/aif-trace.`date '+%Y%m%d-%H:%M:%S'`" -- cp /dev/null $TRACEFILE -- DISABLE_IPTABLES_BATCH=1 --fi -- - # Default NAT_INTERNAL_NET to INTERNAL_NET, if not specified - ############################################################ - if [ -z "$NAT_INTERNAL_NET" ]; then -@@ -1689,3 +1669,4 @@ - PLUGIN_CONF_PATH="/etc/arno-iptables-firewall/plugins" - fi - fi -+ Modified: branches/1.0/package/arnofw/arnofw.mk =================================================================== --- branches/1.0/package/arnofw/arnofw.mk 2014-01-31 19:09:51 UTC (rev 6394) +++ branches/1.0/package/arnofw/arnofw.mk 2014-02-02 14:07:23 UTC (rev 6395) @@ -3,7 +3,7 @@ # Arno's IPtables Firewall Script # ############################################################# -ARNOFW_VER:=2.0.1d +ARNOFW_VER:=2.0.1e ARNOFW_ROOT:=arno-iptables-firewall ARNOFW_SOURCE:=$(ARNOFW_ROOT)_$(ARNOFW_VER).tar.gz ARNOFW_SITE:=http://rocky.eld.leidenuniv.nl/arno-iptables-firewall This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. |
From: <abe...@us...> - 2014-09-02 12:59:06
|
Revision: 6686 http://sourceforge.net/p/astlinux/code/6686 Author: abelbeck Date: 2014-09-02 12:58:58 +0000 (Tue, 02 Sep 2014) Log Message: ----------- arnofw, adaptive-ban plugin, add 'kamailio' analysis type. Note: requires 'WITH_ANTIFLOOD' enabled in kamailio for the logs to be generated Modified Paths: -------------- branches/1.0/package/arnofw/adaptive-ban/adaptive-ban-helper.sh branches/1.0/package/arnofw/adaptive-ban/adaptive-ban.conf branches/1.0/package/arnofw/arnofw.serial Modified: branches/1.0/package/arnofw/adaptive-ban/adaptive-ban-helper.sh =================================================================== --- branches/1.0/package/arnofw/adaptive-ban/adaptive-ban-helper.sh 2014-09-01 19:16:29 UTC (rev 6685) +++ branches/1.0/package/arnofw/adaptive-ban/adaptive-ban-helper.sh 2014-09-02 12:58:58 UTC (rev 6686) @@ -132,6 +132,8 @@ ;; asterisk) filter_asterisk "$file" "$PREFIX" "$HOST" ;; + kamailio) filter_kamailio "$file" "$PREFIX" "$HOST" + ;; lighttpd) filter_lighttpd "$file" "$PREFIX" "$HOST" ;; prosody) filter_prosody "$file" "$PREFIX" "$HOST" @@ -176,6 +178,14 @@ "$file" >"$TEMPFILE" } +filter_kamailio() +{ + local file="$1" PREFIX="$2" HOST="$3" + + sed -n -r -e "s/^${PREFIX}.* pike blocking .* from .* \(IP:${HOST}:[0-9]+\)$/\1/p" \ + "$file" >"$TEMPFILE" +} + filter_lighttpd() { local file="$1" PREFIX="$2" HOST="$3" Modified: branches/1.0/package/arnofw/adaptive-ban/adaptive-ban.conf =================================================================== --- branches/1.0/package/arnofw/adaptive-ban/adaptive-ban.conf 2014-09-01 19:16:29 UTC (rev 6685) +++ branches/1.0/package/arnofw/adaptive-ban/adaptive-ban.conf 2014-09-02 12:58:58 UTC (rev 6686) @@ -19,7 +19,7 @@ ADAPTIVE_BAN_COUNT=6 # A list of analysis types that are applied -# Choose from: sshd asterisk lighttpd prosody pptpd +# Choose from: sshd asterisk kamailio lighttpd prosody pptpd # ------------------------------------------------------------------------------ ADAPTIVE_BAN_TYPES="sshd asterisk" Modified: branches/1.0/package/arnofw/arnofw.serial =================================================================== --- branches/1.0/package/arnofw/arnofw.serial 2014-09-01 19:16:29 UTC (rev 6685) +++ branches/1.0/package/arnofw/arnofw.serial 2014-09-02 12:58:58 UTC (rev 6686) @@ -1 +1 @@ -0002~0021~0000~0000~0000~ +0002~0022~0000~0000~0000~ This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. |
From: <abe...@us...> - 2014-09-15 00:49:27
|
Revision: 6706 http://sourceforge.net/p/astlinux/code/6706 Author: abelbeck Date: 2014-09-15 00:49:22 +0000 (Mon, 15 Sep 2014) Log Message: ----------- arnofw, add new SIP User-Agent plugin Modified Paths: -------------- branches/1.0/package/arnofw/arnofw.mk branches/1.0/package/arnofw/arnofw.serial Added Paths: ----------- branches/1.0/package/arnofw/sip-user-agent/ branches/1.0/package/arnofw/sip-user-agent/30sip-user-agent.plugin.sh branches/1.0/package/arnofw/sip-user-agent/sip-user-agent.conf Modified: branches/1.0/package/arnofw/arnofw.mk =================================================================== --- branches/1.0/package/arnofw/arnofw.mk 2014-09-13 17:24:18 UTC (rev 6705) +++ branches/1.0/package/arnofw/arnofw.mk 2014-09-15 00:49:22 UTC (rev 6706) @@ -126,6 +126,13 @@ $(INSTALL) -m 0644 package/arnofw/time-schedule-host-block/time-schedule-host-block.conf \ $(TARGET_DIR)/stat$(ARNOFW_PLUGIN_CONFIG_DIR)/time-schedule-host-block.conf @echo + @echo "Install local version of SIP User-Agent plugin." + @echo + $(INSTALL) -m 0644 package/arnofw/sip-user-agent/30sip-user-agent.plugin.sh \ + $(TARGET_DIR)$(ARNOFW_PLUGIN_SCRIPT_DIR)/30sip-user-agent.plugin + $(INSTALL) -m 0644 package/arnofw/sip-user-agent/sip-user-agent.conf \ + $(TARGET_DIR)/stat$(ARNOFW_PLUGIN_CONFIG_DIR)/sip-user-agent.conf + @echo @echo "Install local version of PPTP VPN plugin." @echo $(INSTALL) -m 0644 package/arnofw/pptp-vpn/50pptp-vpn.plugin.sh \ Modified: branches/1.0/package/arnofw/arnofw.serial =================================================================== --- branches/1.0/package/arnofw/arnofw.serial 2014-09-13 17:24:18 UTC (rev 6705) +++ branches/1.0/package/arnofw/arnofw.serial 2014-09-15 00:49:22 UTC (rev 6706) @@ -1 +1 @@ -0002~0022~0000~0000~0000~ +0002~0023~0000~0000~0000~ Added: branches/1.0/package/arnofw/sip-user-agent/30sip-user-agent.plugin.sh =================================================================== --- branches/1.0/package/arnofw/sip-user-agent/30sip-user-agent.plugin.sh (rev 0) +++ branches/1.0/package/arnofw/sip-user-agent/30sip-user-agent.plugin.sh 2014-09-15 00:49:22 UTC (rev 6706) @@ -0,0 +1,183 @@ +# ------------------------------------------------------------------------------ +# -= Arno's iptables firewall - SIP User-Agent plugin =- +# +PLUGIN_NAME="SIP User-Agent plugin" +PLUGIN_VERSION="1.00" +PLUGIN_CONF_FILE="sip-user-agent.conf" +# +# Last changed : September 14, 2014 +# Requirements : kernel 2.6 + AIF 2.0.1 or better +# Comments : This filters SIP packets via inspection of the User-Agent field. +# +# Author : (C) Copyright 2008-2014 by Arno van Amersfoort & Lonnie Abelbeck +# Homepage : http://rocky.eld.leidenuniv.nl/ +# Freshmeat homepage : http://freshmeat.net/projects/iptables-firewall/?topic_id=151 +# Email : a r n o v a AT r o c k y DOT e l d DOT l e i d e n u n i v DOT n l +# (note: you must remove all spaces and substitute the @ and the . +# at the proper locations!) +# ------------------------------------------------------------------------------ +# This program is free software; you can redistribute it and/or +# modify it under the terms of the GNU General Public License +# version 2 as published by the Free Software Foundation. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. +# ------------------------------------------------------------------------------ + +# Plugin start function +plugin_start() +{ + local user_agent user_agents mode ACTION port ports_udp ports_tcp IFS + + # Create new chains: + iptables -N SIP_USER_AGENT 2>/dev/null + iptables -F SIP_USER_AGENT + + iptables -N SIP_USER_AGENT_DROP 2>/dev/null + iptables -F SIP_USER_AGENT_DROP + + if [ -n "$SIP_USER_AGENT_PASS_TYPES" ]; then + user_agents="$SIP_USER_AGENT_PASS_TYPES" + mode="pass" + ACTION="RETURN" + else + user_agents="${SIP_USER_AGENT_DROP_TYPES:-friendly-scanner sipcli}" + mode="drop" + ACTION="SIP_USER_AGENT_DROP" + fi + + ports_udp="$SIP_USER_AGENT_PORTS_UDP" + ports_tcp="$SIP_USER_AGENT_PORTS_TCP" + + if [ -z "$ports_udp" -a -z "$ports_tcp" ]; then + ports_udp="5060" + fi + + echo "${INDENT}SIP User-Agent(s): $user_agents ($mode mode)" + if [ -n "$ports_udp" ]; then + echo "${INDENT}SIP User-Agent for EXT->Local UDP Port(s): $ports_udp" + fi + if [ -n "$ports_tcp" ]; then + echo "${INDENT}SIP User-Agent for EXT->Local TCP Port(s): $ports_tcp" + fi + + if [ "$SIP_USER_AGENT_LOG" = "1" ]; then + echo "${INDENT}Logging of SIP User-Agent Dropped packets: Enabled" + iptables -A SIP_USER_AGENT_DROP -m limit --limit 1/m --limit-burst 1 -j LOG \ + --log-level $LOGLEVEL --log-prefix "AIF:SIP User-Agent Dropped: " + else + echo "${INDENT}Logging of SIP User-Agent Dropped packets: Disabled" + fi + iptables -A SIP_USER_AGENT_DROP -j DROP + + unset IFS + for user_agent in $user_agents; do + iptables -A SIP_USER_AGENT -m string --string "User-Agent: $user_agent" --algo bm --icase -j $ACTION + done + + if [ "$mode" = "pass" ]; then + iptables -A SIP_USER_AGENT -j SIP_USER_AGENT_DROP + fi + + # Insert rules into the main chain: + IFS=' ,' + for port in $ports_udp; do + iptables -A EXT_INPUT_CHAIN -p udp --dport $port -j SIP_USER_AGENT + done + for port in $ports_tcp; do + iptables -A EXT_INPUT_CHAIN -p tcp --dport $port -j SIP_USER_AGENT + done + + return 0 +} + + +# Plugin restart function +plugin_restart() +{ + + # Skip plugin_stop on a restart + plugin_start + + return 0 +} + + +# Plugin stop function +plugin_stop() +{ + + iptables -F SIP_USER_AGENT_DROP + iptables -X SIP_USER_AGENT_DROP 2>/dev/null + + iptables -F SIP_USER_AGENT + iptables -X SIP_USER_AGENT 2>/dev/null + + return 0 +} + + +# Plugin status function +plugin_status() +{ + + #iptables -xnvL SIP_USER_AGENT + return 0 +} + + +# Check sanity of eg. environment +plugin_sanity_check() +{ + return 0 +} + + +############ +# Mainline # +############ + +# Check where to find the config file +CONF_FILE="" +if [ -n "$PLUGIN_CONF_PATH" ]; then + CONF_FILE="$PLUGIN_CONF_PATH/$PLUGIN_CONF_FILE" +fi + +# Check if the config file exists +if [ ! -e "$CONF_FILE" ]; then + printf "NOTE: Config file \"$CONF_FILE\" not found!\n Plugin \"$PLUGIN_NAME v$PLUGIN_VERSION\" ignored!\n" >&2 + PLUGIN_RET_VAL=0 +else + # Source the plugin config file + . "$CONF_FILE" + + if [ "$ENABLED" = "1" -a "$PLUGIN_CMD" != "stop-restart" ] || + [ "$ENABLED" = "0" -a "$PLUGIN_CMD" = "stop-restart" ] || + [ -n "$PLUGIN_LOAD_FILE" -a "$PLUGIN_CMD" = "stop" ] || + [ -n "$PLUGIN_LOAD_FILE" -a "$PLUGIN_CMD" = "status" ]; then + # Show who we are: + echo "${INDENT}$PLUGIN_NAME v$PLUGIN_VERSION" + + # Increment indention + INDENT="$INDENT " + + # Only proceed if environment ok + if plugin_sanity_check; then + case $PLUGIN_CMD in + start|'') plugin_start; PLUGIN_RET_VAL=$?;; + restart ) plugin_restart; PLUGIN_RET_VAL=$?;; + stop|stop-restart) plugin_stop; PLUGIN_RET_VAL=$?;; + status ) plugin_status; PLUGIN_RET_VAL=$?;; + * ) PLUGIN_RET_VAL=1; printf "\033[40m\033[1;31m${INDENT}ERROR: Invalid plugin option \"$PLUGIN_CMD\"!\033[0m\n" >&2;; + esac + fi + else + PLUGIN_RET_VAL=0 + fi +fi Added: branches/1.0/package/arnofw/sip-user-agent/sip-user-agent.conf =================================================================== --- branches/1.0/package/arnofw/sip-user-agent/sip-user-agent.conf (rev 0) +++ branches/1.0/package/arnofw/sip-user-agent/sip-user-agent.conf 2014-09-15 00:49:22 UTC (rev 6706) @@ -0,0 +1,42 @@ +# ------------------------------------------------------------------------------ +# -= Arno's iptables firewall - SIP User-Agent plugin =- +# ------------------------------------------------------------------------------ + +# To actually enable this plugin make ENABLED=1: +# ------------------------------------------------------------------------------ +ENABLED=0 + +# This plugin monitors inbound (EXT->Local) SIP sessions on specified ports +# by inspecting the User-Agent field. +# No packets are allowed by this plugin, only denied. + +# Specify the left-most match of the SIP User-Agent: field, case insensitive. +# Multiple User-Agent matches are space separated. +# If matched, the packet continues the evaluation of firewall rules. +# If not matched, the packet is dropped. +# +# Note: If defined, SIP_USER_AGENT_DROP_TYPES is ignored. +# ------------------------------------------------------------------------------ +SIP_USER_AGENT_PASS_TYPES="" + +# Specify the left-most match of the SIP User-Agent: field, case insensitive. +# Multiple User-Agent matches are space separated. +# If matched, the packet is dropped. +# If not matched, the packet continues the evaluation of firewall rules. +# +# Note: Ignored if SIP_USER_AGENT_PASS_TYPES is defined. +# ------------------------------------------------------------------------------ +SIP_USER_AGENT_DROP_TYPES="friendly-scanner sipcli" + +# Specify the monitored UDP ports (5060 default) +# ------------------------------------------------------------------------------ +SIP_USER_AGENT_PORTS_UDP="5060" + +# Specify the monitored TCP ports (no default) +# ------------------------------------------------------------------------------ +SIP_USER_AGENT_PORTS_TCP="" + +# Enable logging for dropped packets when set to "1" +# ------------------------------------------------------------------------------ +SIP_USER_AGENT_LOG=0 + This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. |
From: <abe...@us...> - 2014-09-24 14:15:39
|
Revision: 6721 http://sourceforge.net/p/astlinux/code/6721 Author: abelbeck Date: 2014-09-24 14:15:36 +0000 (Wed, 24 Sep 2014) Log Message: ----------- arnofw, sip-user-agent plugin, add VaxSIPUserAgent blacklist user-agent Modified Paths: -------------- branches/1.0/package/arnofw/arnofw.serial branches/1.0/package/arnofw/sip-user-agent/30sip-user-agent.plugin.sh branches/1.0/package/arnofw/sip-user-agent/sip-user-agent.conf Modified: branches/1.0/package/arnofw/arnofw.serial =================================================================== --- branches/1.0/package/arnofw/arnofw.serial 2014-09-23 17:15:40 UTC (rev 6720) +++ branches/1.0/package/arnofw/arnofw.serial 2014-09-24 14:15:36 UTC (rev 6721) @@ -1 +1 @@ -0002~0023~0000~0000~0000~ +0002~0024~0000~0000~0000~ Modified: branches/1.0/package/arnofw/sip-user-agent/30sip-user-agent.plugin.sh =================================================================== --- branches/1.0/package/arnofw/sip-user-agent/30sip-user-agent.plugin.sh 2014-09-23 17:15:40 UTC (rev 6720) +++ branches/1.0/package/arnofw/sip-user-agent/30sip-user-agent.plugin.sh 2014-09-24 14:15:36 UTC (rev 6721) @@ -47,7 +47,7 @@ mode="whitelist" ACTION="RETURN" else - user_agents="${SIP_USER_AGENT_DROP_TYPES:-friendly-scanner sipcli}" + user_agents="${SIP_USER_AGENT_DROP_TYPES:-friendly-scanner sipcli VaxSIPUserAgent}" mode="blacklist" ACTION="SIP_USER_AGENT_DROP" fi Modified: branches/1.0/package/arnofw/sip-user-agent/sip-user-agent.conf =================================================================== --- branches/1.0/package/arnofw/sip-user-agent/sip-user-agent.conf 2014-09-23 17:15:40 UTC (rev 6720) +++ branches/1.0/package/arnofw/sip-user-agent/sip-user-agent.conf 2014-09-24 14:15:36 UTC (rev 6721) @@ -26,7 +26,7 @@ # # Note: Ignored if SIP_USER_AGENT_PASS_TYPES is defined. # ------------------------------------------------------------------------------ -SIP_USER_AGENT_DROP_TYPES="friendly-scanner sipcli" +SIP_USER_AGENT_DROP_TYPES="friendly-scanner sipcli VaxSIPUserAgent" # Specify the monitored UDP ports (5060 default) # ------------------------------------------------------------------------------ This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. |
From: <abe...@us...> - 2015-08-02 14:21:22
|
Revision: 7172 http://sourceforge.net/p/astlinux/code/7172 Author: abelbeck Date: 2015-08-02 14:21:20 +0000 (Sun, 02 Aug 2015) Log Message: ----------- arnofw, add -w (enable iptables lock wait) option, added to iptables 1.4.20 Modified Paths: -------------- branches/1.0/package/arnofw/adaptive-ban/adaptive-ban-helper.sh branches/1.0/package/arnofw/dyndns-host-open/dyndns-host-open-helper.sh Added Paths: ----------- branches/1.0/package/arnofw/arnofw-enable-iptables-lock-wait.patch Modified: branches/1.0/package/arnofw/adaptive-ban/adaptive-ban-helper.sh =================================================================== --- branches/1.0/package/arnofw/adaptive-ban/adaptive-ban-helper.sh 2015-07-31 16:41:13 UTC (rev 7171) +++ branches/1.0/package/arnofw/adaptive-ban/adaptive-ban-helper.sh 2015-08-02 14:21:20 UTC (rev 7172) @@ -286,7 +286,7 @@ { local result retval - result="$($IP4TABLES "$@" 2>&1)" + result="$($IP4TABLES -w "$@" 2>&1)" retval=$? if [ $retval -ne 0 ]; then @@ -302,7 +302,7 @@ { local result retval - result="$($IP6TABLES "$@" 2>&1)" + result="$($IP6TABLES -w "$@" 2>&1)" retval=$? if [ $retval -ne 0 ]; then Added: branches/1.0/package/arnofw/arnofw-enable-iptables-lock-wait.patch =================================================================== --- branches/1.0/package/arnofw/arnofw-enable-iptables-lock-wait.patch (rev 0) +++ branches/1.0/package/arnofw/arnofw-enable-iptables-lock-wait.patch 2015-08-02 14:21:20 UTC (rev 7172) @@ -0,0 +1,38 @@ +--- arno-iptables-firewall_2.0.1e/share/arno-iptables-firewall/environment.orig 2015-08-02 08:31:33.000000000 -0500 ++++ arno-iptables-firewall_2.0.1e/share/arno-iptables-firewall/environment 2015-08-02 08:33:37.000000000 -0500 +@@ -291,7 +291,7 @@ + { + local result retval IFS=' ' + +- result=`$IP4TABLES "$@" 2>&1` ++ result=`$IP4TABLES -w "$@" 2>&1` + retval=$? + + if [ $retval -ne 0 ]; then +@@ -318,7 +318,7 @@ + { + local result retval IFS=' ' + +- result=`$IP6TABLES "$@" 2>&1` ++ result=`$IP6TABLES -w "$@" 2>&1` + retval=$? + + if [ $retval -ne 0 ]; then +@@ -417,7 +417,7 @@ + { + local IFS=' ' + +- $IP4TABLES "$@" >/dev/null 2>&1 ++ $IP4TABLES -w "$@" >/dev/null 2>&1 + } + + +@@ -425,7 +425,7 @@ + { + local IFS=' ' + +- $IP6TABLES "$@" >/dev/null 2>&1 ++ $IP6TABLES -w "$@" >/dev/null 2>&1 + } + + Modified: branches/1.0/package/arnofw/dyndns-host-open/dyndns-host-open-helper.sh =================================================================== --- branches/1.0/package/arnofw/dyndns-host-open/dyndns-host-open-helper.sh 2015-07-31 16:41:13 UTC (rev 7171) +++ branches/1.0/package/arnofw/dyndns-host-open/dyndns-host-open-helper.sh 2015-08-02 14:21:20 UTC (rev 7172) @@ -142,7 +142,7 @@ { local result retval - result="$($IP4TABLES "$@" 2>&1)" + result="$($IP4TABLES -w "$@" 2>&1)" retval=$? if [ $retval -ne 0 ]; then This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. |
From: <abe...@us...> - 2015-08-13 22:43:37
|
Revision: 7190 http://sourceforge.net/p/astlinux/code/7190 Author: abelbeck Date: 2015-08-13 22:43:35 +0000 (Thu, 13 Aug 2015) Log Message: ----------- arnofw, version bump to pre-release 2.0.1f Modified Paths: -------------- branches/1.0/package/arnofw/adaptive-ban/95adaptive-ban.plugin.sh branches/1.0/package/arnofw/arnofw.mk branches/1.0/package/arnofw/arnofw.serial branches/1.0/package/arnofw/dyndns-host-open/50dyndns-host-open.plugin.sh branches/1.0/package/arnofw/miniupnpd/50miniupnpd.plugin.sh branches/1.0/package/arnofw/openvpn-server/50openvpn-server.plugin.sh branches/1.0/package/arnofw/pptp-vpn/50pptp-vpn.plugin.sh branches/1.0/package/arnofw/sip-user-agent/30sip-user-agent.plugin.sh branches/1.0/package/arnofw/time-schedule-host-block/30time-schedule-host-block.plugin.sh branches/1.0/package/arnofw/traffic-shaper/60traffic-shaper.plugin.sh Removed Paths: ------------- branches/1.0/package/arnofw/arnofw-NAT_LOCAL_REDIRECT.patch branches/1.0/package/arnofw/arnofw-enable-iptables-lock-wait.patch Modified: branches/1.0/package/arnofw/adaptive-ban/95adaptive-ban.plugin.sh =================================================================== --- branches/1.0/package/arnofw/adaptive-ban/95adaptive-ban.plugin.sh 2015-08-08 14:07:11 UTC (rev 7189) +++ branches/1.0/package/arnofw/adaptive-ban/95adaptive-ban.plugin.sh 2015-08-13 22:43:35 UTC (rev 7190) @@ -164,10 +164,12 @@ CONF_FILE="$PLUGIN_CONF_PATH/$PLUGIN_CONF_FILE" fi +# Preinit to success: +PLUGIN_RET_VAL=0 + # Check if the config file exists if [ ! -e "$CONF_FILE" ]; then printf "NOTE: Config file \"$CONF_FILE\" not found!\n Plugin \"$PLUGIN_NAME v$PLUGIN_VERSION\" ignored!\n" >&2 - PLUGIN_RET_VAL=0 else # Source the plugin config file . "$CONF_FILE" @@ -182,16 +184,15 @@ INDENT="$INDENT " # Only proceed if environment ok - if plugin_sanity_check; then + if ! plugin_sanity_check; then + PLUGIN_RET_VAL=1 + else case $PLUGIN_CMD in - start|'') plugin_start; PLUGIN_RET_VAL=$?;; - stop ) plugin_stop; PLUGIN_RET_VAL=$?;; - status ) plugin_status; PLUGIN_RET_VAL=$?;; - * ) PLUGIN_RET_VAL=1; printf "\033[40m\033[1;31m${INDENT}ERROR: Invalid plugin option \"$PLUGIN_CMD\"!\033[0m\n" >&2;; + start|'') plugin_start; PLUGIN_RET_VAL=$? ;; + stop ) plugin_stop; PLUGIN_RET_VAL=$? ;; + status ) plugin_status; PLUGIN_RET_VAL=$? ;; + * ) PLUGIN_RET_VAL=1; printf "\033[40m\033[1;31m${INDENT}ERROR: Invalid plugin option \"$PLUGIN_CMD\"!\033[0m\n" >&2 ;; esac fi - else - PLUGIN_RET_VAL=0 fi fi - Deleted: branches/1.0/package/arnofw/arnofw-NAT_LOCAL_REDIRECT.patch =================================================================== --- branches/1.0/package/arnofw/arnofw-NAT_LOCAL_REDIRECT.patch 2015-08-08 14:07:11 UTC (rev 7189) +++ branches/1.0/package/arnofw/arnofw-NAT_LOCAL_REDIRECT.patch 2015-08-13 22:43:35 UTC (rev 7190) @@ -1,44 +0,0 @@ -From efc3c82552ec009a20252ed3e412aff3ef983fa2 Mon Sep 17 00:00:00 2001 -From: Lonnie Abelbeck <lo...@ab...> -Date: Mon, 28 Jul 2014 08:19:47 -0500 -Subject: [PATCH] fixed: Move NAT_LOCAL_REDIRECT to be applied before the drop - logs, Issue #13 - ---- - bin/arno-iptables-firewall | 14 +++++++------- - 1 file changed, 7 insertions(+), 7 deletions(-) - -diff --git a/bin/arno-iptables-firewall b/bin/arno-iptables-firewall -index 0f74051..1e52ec8 100755 ---- a/bin/arno-iptables-firewall -+++ b/bin/arno-iptables-firewall -@@ -3373,6 +3373,13 @@ setup_ext_input_chain() - ip6tables -A EXT_INPUT_CHAIN -d ff00::/8 -j EXT_MULTICAST_CHAIN - fi - -+ # Allow all packets that have been locally redirected -+ ##################################################### -+ if [ "$NAT_LOCAL_REDIRECT" = "1" ]; then -+ echo " Enabling support for NAT local redirect" -+ ip4tables -A EXT_INPUT_CHAIN -m conntrack --ctstate DNAT -j ACCEPT -+ fi -+ - # Log packets to privileged TCP ports? - ################################################## - if [ "$PRIV_TCP_LOG" != "0" ]; then -@@ -3439,13 +3446,6 @@ setup_ext_input_chain() - echo " Logging of IPv4 IGMP packets disabled" - fi - -- # Allow all packets that have been locally redirected -- ##################################################### -- if [ "$NAT_LOCAL_REDIRECT" = "1" ]; then -- echo " Enabling support for NAT local redirect" -- ip4tables -A EXT_INPUT_CHAIN -m conntrack --ctstate DNAT -j ACCEPT -- fi -- - # Finally drop all in the broadcast chain - iptables -A EXT_BROADCAST_CHAIN -j DROP - --- -2.0.3 Deleted: branches/1.0/package/arnofw/arnofw-enable-iptables-lock-wait.patch =================================================================== --- branches/1.0/package/arnofw/arnofw-enable-iptables-lock-wait.patch 2015-08-08 14:07:11 UTC (rev 7189) +++ branches/1.0/package/arnofw/arnofw-enable-iptables-lock-wait.patch 2015-08-13 22:43:35 UTC (rev 7190) @@ -1,64 +0,0 @@ -From 8a5f13173cbc21b4c21b0fc97370f9882ef4cd94 Mon Sep 17 00:00:00 2001 -From: Lonnie Abelbeck <lo...@ab...> -Date: Mon, 3 Aug 2015 17:11:00 -0500 -Subject: [PATCH] fixed: Issue #17, Enable xtables lock "wait" option found in - iptables 1.4.20+ - ---- - share/arno-iptables-firewall/environment | 15 +++++++++++---- - 1 file changed, 11 insertions(+), 4 deletions(-) - -diff --git a/share/arno-iptables-firewall/environment b/share/arno-iptables-firewall/environment -index 0fe708f..bc2d24e 100644 ---- a/share/arno-iptables-firewall/environment -+++ b/share/arno-iptables-firewall/environment -@@ -296,7 +296,7 @@ ip4tables() - { - local result retval IFS=' ' - -- result=`$IP4TABLES "$@" 2>&1` -+ result=`$IP4TABLES${IPTABLES_OPTIONS:+ $IPTABLES_OPTIONS} "$@" 2>&1` - retval=$? - - if [ $retval -ne 0 ]; then -@@ -323,7 +323,7 @@ ip6tables() - { - local result retval IFS=' ' - -- result=`$IP6TABLES "$@" 2>&1` -+ result=`$IP6TABLES${IPTABLES_OPTIONS:+ $IPTABLES_OPTIONS} "$@" 2>&1` - retval=$? - - if [ $retval -ne 0 ]; then -@@ -422,7 +422,7 @@ try_ip4tables() - { - local IFS=' ' - -- $IP4TABLES "$@" >/dev/null 2>&1 -+ $IP4TABLES${IPTABLES_OPTIONS:+ $IPTABLES_OPTIONS} "$@" >/dev/null 2>&1 - } - - -@@ -430,7 +430,7 @@ try_ip6tables() - { - local IFS=' ' - -- $IP6TABLES "$@" >/dev/null 2>&1 -+ $IP6TABLES${IPTABLES_OPTIONS:+ $IPTABLES_OPTIONS} "$@" >/dev/null 2>&1 - } - - -@@ -1672,6 +1672,13 @@ if [ -z "$DIG" ]; then - NSLOOKUP="$(find_command /usr/bin/nslookup)" - fi - -+# Enable xtables lock "wait" option found in iptables 1.4.20+ -+if $IP4TABLES -w --version >/dev/null 2>&1; then -+ IPTABLES_OPTIONS="-w" -+else -+ IPTABLES_OPTIONS="" -+fi -+ - # Setup IPv6 detected environment variable - if sysctl_key net.ipv6.conf; then - IPV6_DETECTED=1 Modified: branches/1.0/package/arnofw/arnofw.mk =================================================================== --- branches/1.0/package/arnofw/arnofw.mk 2015-08-08 14:07:11 UTC (rev 7189) +++ branches/1.0/package/arnofw/arnofw.mk 2015-08-13 22:43:35 UTC (rev 7190) @@ -3,20 +3,20 @@ # Arno's IPtables Firewall Script # ############################################################# -ARNOFW_VER:=2.0.1e -ARNOFW_ROOT:=arno-iptables-firewall -ARNOFW_SOURCE:=$(ARNOFW_ROOT)_$(ARNOFW_VER).tar.gz -ARNOFW_SITE:=http://rocky.eld.leidenuniv.nl/arno-iptables-firewall -#ARNOFW_SITE:=http://files.astlinux.org -ARNOFW_DIR:=$(BUILD_DIR)/$(ARNOFW_ROOT)_$(ARNOFW_VER) -ARNOFW_CAT:=zcat -ARNOFW_TARGET_BINARY:=/usr/sbin/arno-iptables-firewall -ARNOFW_CONFIG_DIR:=/etc/arno-iptables-firewall -ARNOFW_SCRIPT_DIR:=/usr/share/arno-iptables-firewall -ARNOFW_PLUGIN_CONFIG_DIR:=$(ARNOFW_CONFIG_DIR)/plugins -ARNOFW_PLUGIN_SCRIPT_DIR:=$(ARNOFW_SCRIPT_DIR)/plugins -ARNOFW_CONFIG_SHIM:=$(ARNOFW_SCRIPT_DIR)/astlinux.shim -ARNOFW_CONFIG_SERIAL:=$(ARNOFW_CONFIG_DIR)/serial +ARNOFW_VER := 2.0.1f-DEVEL +ARNOFW_ROOT := arno-iptables-firewall +ARNOFW_SOURCE := $(ARNOFW_ROOT)_$(ARNOFW_VER).tar.gz +#ARNOFW_SITE := http://rocky.eld.leidenuniv.nl/arno-iptables-firewall +ARNOFW_SITE := http://files.astlinux.org +ARNOFW_DIR := $(BUILD_DIR)/$(ARNOFW_ROOT)_$(ARNOFW_VER) +ARNOFW_CAT := zcat +ARNOFW_TARGET_BINARY := /usr/sbin/arno-iptables-firewall +ARNOFW_CONFIG_DIR := /etc/arno-iptables-firewall +ARNOFW_SCRIPT_DIR := /usr/share/arno-iptables-firewall +ARNOFW_PLUGIN_CONFIG_DIR := $(ARNOFW_CONFIG_DIR)/plugins +ARNOFW_PLUGIN_SCRIPT_DIR := $(ARNOFW_SCRIPT_DIR)/plugins +ARNOFW_CONFIG_SHIM := $(ARNOFW_SCRIPT_DIR)/astlinux.shim +ARNOFW_CONFIG_SERIAL := $(ARNOFW_CONFIG_DIR)/serial $(DL_DIR)/$(ARNOFW_SOURCE): $(WGET) -P $(DL_DIR) $(ARNOFW_SITE)/$(ARNOFW_SOURCE) @@ -50,8 +50,6 @@ -e 's:^ENV_FILE="[^"]*":ENV_FILE="$(ARNOFW_SCRIPT_DIR)/environment":' \ -e 's:^ENV_FILE=[^"]*$$:ENV_FILE="$(ARNOFW_SCRIPT_DIR)/environment":' \ -e 's:^LOCAL_CONFIG_FILE="":LOCAL_CONFIG_FILE="$(ARNOFW_CONFIG_SHIM)":' \ - -e 's:^IP4TABLES="[^"]*":IP4TABLES="$(IPTABLES_BIN)":' \ - -e 's:^IP6TABLES="[^"]*":IP6TABLES="$(IP6TABLES_BIN)":' \ -e 's:^(INT_IF|EXT_IF|MODEM_IF|INTERNAL_NET|NAT|NAT_INTERNAL_NET|EXT_IF_DHCP_IP)=:#&:' \ -e 's:^NAT_LOCAL_REDIRECT=0$$:NAT_LOCAL_REDIRECT=1:' \ -e 's:^IGMP_LOG=1$$:IGMP_LOG=0:' \ Modified: branches/1.0/package/arnofw/arnofw.serial =================================================================== --- branches/1.0/package/arnofw/arnofw.serial 2015-08-08 14:07:11 UTC (rev 7189) +++ branches/1.0/package/arnofw/arnofw.serial 2015-08-13 22:43:35 UTC (rev 7190) @@ -1 +1 @@ -0002~0024~0000~0000~0000~ +0002~0025~0000~0000~0000~ Modified: branches/1.0/package/arnofw/dyndns-host-open/50dyndns-host-open.plugin.sh =================================================================== --- branches/1.0/package/arnofw/dyndns-host-open/50dyndns-host-open.plugin.sh 2015-08-08 14:07:11 UTC (rev 7189) +++ branches/1.0/package/arnofw/dyndns-host-open/50dyndns-host-open.plugin.sh 2015-08-13 22:43:35 UTC (rev 7190) @@ -243,10 +243,12 @@ CONF_FILE="$PLUGIN_CONF_PATH/$PLUGIN_CONF_FILE" fi +# Preinit to success: +PLUGIN_RET_VAL=0 + # Check if the config file exists if [ ! -e "$CONF_FILE" ]; then printf "NOTE: Config file \"$CONF_FILE\" not found!\n Plugin \"$PLUGIN_NAME v$PLUGIN_VERSION\" ignored!\n" >&2 - PLUGIN_RET_VAL=0 else # Source the plugin config file . "$CONF_FILE" @@ -262,16 +264,16 @@ INDENT="$INDENT " # Only proceed if environment ok - if plugin_sanity_check; then + if ! plugin_sanity_check; then + PLUGIN_RET_VAL=1 + else case $PLUGIN_CMD in - start|'') plugin_start; PLUGIN_RET_VAL=$?;; - restart ) plugin_restart; PLUGIN_RET_VAL=$?;; - stop|stop-restart) plugin_stop; PLUGIN_RET_VAL=$?;; - status ) plugin_status; PLUGIN_RET_VAL=$?;; - * ) PLUGIN_RET_VAL=1; printf "\033[40m\033[1;31m${INDENT}ERROR: Invalid plugin option \"$PLUGIN_CMD\"!\033[0m\n" >&2;; + start|'') plugin_start; PLUGIN_RET_VAL=$? ;; + restart ) plugin_restart; PLUGIN_RET_VAL=$? ;; + stop|stop-restart) plugin_stop; PLUGIN_RET_VAL=$? ;; + status ) plugin_status; PLUGIN_RET_VAL=$? ;; + * ) PLUGIN_RET_VAL=1; printf "\033[40m\033[1;31m${INDENT}ERROR: Invalid plugin option \"$PLUGIN_CMD\"!\033[0m\n" >&2 ;; esac fi - else - PLUGIN_RET_VAL=0 fi fi Modified: branches/1.0/package/arnofw/miniupnpd/50miniupnpd.plugin.sh =================================================================== --- branches/1.0/package/arnofw/miniupnpd/50miniupnpd.plugin.sh 2015-08-08 14:07:11 UTC (rev 7189) +++ branches/1.0/package/arnofw/miniupnpd/50miniupnpd.plugin.sh 2015-08-13 22:43:35 UTC (rev 7190) @@ -129,10 +129,12 @@ CONF_FILE="$PLUGIN_CONF_PATH/$PLUGIN_CONF_FILE" fi +# Preinit to success: +PLUGIN_RET_VAL=0 + # Check if the config file exists if [ ! -e "$CONF_FILE" ]; then printf "NOTE: Config file \"$CONF_FILE\" not found!\n Plugin \"$PLUGIN_NAME v$PLUGIN_VERSION\" ignored!\n" >&2 - PLUGIN_RET_VAL=0 else # Source the plugin config file . "$CONF_FILE" @@ -148,17 +150,16 @@ INDENT="$INDENT " # Only proceed if environment ok - if plugin_sanity_check; then + if ! plugin_sanity_check; then + PLUGIN_RET_VAL=1 + else case $PLUGIN_CMD in - start|'') plugin_start; PLUGIN_RET_VAL=$?;; - restart ) plugin_restart; PLUGIN_RET_VAL=$?;; - stop|stop-restart) plugin_stop; PLUGIN_RET_VAL=$?;; - status ) plugin_status; PLUGIN_RET_VAL=$?;; - * ) PLUGIN_RET_VAL=1; printf "\033[40m\033[1;31m ERROR: Invalid plugin option \"$PLUGIN_CMD\"!\033[0m\n" >&2;; + start|'') plugin_start; PLUGIN_RET_VAL=$? ;; + restart ) plugin_restart; PLUGIN_RET_VAL=$? ;; + stop|stop-restart) plugin_stop; PLUGIN_RET_VAL=$? ;; + status ) plugin_status; PLUGIN_RET_VAL=$? ;; + * ) PLUGIN_RET_VAL=1; printf "\033[40m\033[1;31m ERROR: Invalid plugin option \"$PLUGIN_CMD\"!\033[0m\n" >&2 ;; esac fi - else - PLUGIN_RET_VAL=0 fi fi - Modified: branches/1.0/package/arnofw/openvpn-server/50openvpn-server.plugin.sh =================================================================== --- branches/1.0/package/arnofw/openvpn-server/50openvpn-server.plugin.sh 2015-08-08 14:07:11 UTC (rev 7189) +++ branches/1.0/package/arnofw/openvpn-server/50openvpn-server.plugin.sh 2015-08-13 22:43:35 UTC (rev 7190) @@ -102,10 +102,12 @@ CONF_FILE="$PLUGIN_CONF_PATH/$PLUGIN_CONF_FILE" fi +# Preinit to success: +PLUGIN_RET_VAL=0 + # Check if the config file exists if [ ! -e "$CONF_FILE" ]; then printf "NOTE: Config file \"$CONF_FILE\" not found!\n Plugin \"$PLUGIN_NAME v$PLUGIN_VERSION\" ignored!\n" >&2 - PLUGIN_RET_VAL=0 else # Source the plugin config file . "$CONF_FILE" @@ -121,16 +123,16 @@ INDENT="$INDENT " # Only proceed if environment ok - if plugin_sanity_check; then + if ! plugin_sanity_check; then + PLUGIN_RET_VAL=1 + else case $PLUGIN_CMD in - start|'') plugin_start; PLUGIN_RET_VAL=$?;; - restart ) plugin_restart; PLUGIN_RET_VAL=$?;; - stop|stop-restart) plugin_stop; PLUGIN_RET_VAL=$?;; - status ) plugin_status; PLUGIN_RET_VAL=$?;; - * ) PLUGIN_RET_VAL=1; printf "\033[40m\033[1;31m ERROR: Invalid plugin option \"$PLUGIN_CMD\"!\033[0m\n" >&2;; + start|'') plugin_start; PLUGIN_RET_VAL=$? ;; + restart ) plugin_restart; PLUGIN_RET_VAL=$? ;; + stop|stop-restart) plugin_stop; PLUGIN_RET_VAL=$? ;; + status ) plugin_status; PLUGIN_RET_VAL=$? ;; + * ) PLUGIN_RET_VAL=1; printf "\033[40m\033[1;31m ERROR: Invalid plugin option \"$PLUGIN_CMD\"!\033[0m\n" >&2 ;; esac fi - else - PLUGIN_RET_VAL=0 fi fi Modified: branches/1.0/package/arnofw/pptp-vpn/50pptp-vpn.plugin.sh =================================================================== --- branches/1.0/package/arnofw/pptp-vpn/50pptp-vpn.plugin.sh 2015-08-08 14:07:11 UTC (rev 7189) +++ branches/1.0/package/arnofw/pptp-vpn/50pptp-vpn.plugin.sh 2015-08-13 22:43:35 UTC (rev 7190) @@ -185,10 +185,12 @@ CONF_FILE="$PLUGIN_CONF_PATH/$PLUGIN_CONF_FILE" fi +# Preinit to success: +PLUGIN_RET_VAL=0 + # Check if the config file exists if [ ! -e "$CONF_FILE" ]; then printf "NOTE: Config file \"$CONF_FILE\" not found!\n Plugin \"$PLUGIN_NAME v$PLUGIN_VERSION\" ignored!\n" >&2 - PLUGIN_RET_VAL=0 else # Source the plugin config file . "$CONF_FILE" @@ -204,16 +206,16 @@ INDENT="$INDENT " # Only proceed if environment ok - if plugin_sanity_check; then + if ! plugin_sanity_check; then + PLUGIN_RET_VAL=1 + else case $PLUGIN_CMD in - start|'') plugin_start; PLUGIN_RET_VAL=$?;; - restart ) plugin_restart; PLUGIN_RET_VAL=$?;; - stop|stop-restart) plugin_stop; PLUGIN_RET_VAL=$?;; - status ) plugin_status; PLUGIN_RET_VAL=$?;; - * ) PLUGIN_RET_VAL=1; printf "\033[40m\033[1;31m ERROR: Invalid plugin option \"$PLUGIN_CMD\"!\033[0m\n" >&2;; + start|'') plugin_start; PLUGIN_RET_VAL=$? ;; + restart ) plugin_restart; PLUGIN_RET_VAL=$? ;; + stop|stop-restart) plugin_stop; PLUGIN_RET_VAL=$? ;; + status ) plugin_status; PLUGIN_RET_VAL=$? ;; + * ) PLUGIN_RET_VAL=1; printf "\033[40m\033[1;31m ERROR: Invalid plugin option \"$PLUGIN_CMD\"!\033[0m\n" >&2 ;; esac fi - else - PLUGIN_RET_VAL=0 fi fi Modified: branches/1.0/package/arnofw/sip-user-agent/30sip-user-agent.plugin.sh =================================================================== --- branches/1.0/package/arnofw/sip-user-agent/30sip-user-agent.plugin.sh 2015-08-08 14:07:11 UTC (rev 7189) +++ branches/1.0/package/arnofw/sip-user-agent/30sip-user-agent.plugin.sh 2015-08-13 22:43:35 UTC (rev 7190) @@ -150,10 +150,12 @@ CONF_FILE="$PLUGIN_CONF_PATH/$PLUGIN_CONF_FILE" fi +# Preinit to success: +PLUGIN_RET_VAL=0 + # Check if the config file exists if [ ! -e "$CONF_FILE" ]; then printf "NOTE: Config file \"$CONF_FILE\" not found!\n Plugin \"$PLUGIN_NAME v$PLUGIN_VERSION\" ignored!\n" >&2 - PLUGIN_RET_VAL=0 else # Source the plugin config file . "$CONF_FILE" @@ -169,16 +171,16 @@ INDENT="$INDENT " # Only proceed if environment ok - if plugin_sanity_check; then + if ! plugin_sanity_check; then + PLUGIN_RET_VAL=1 + else case $PLUGIN_CMD in - start|'') plugin_start; PLUGIN_RET_VAL=$?;; - restart ) plugin_restart; PLUGIN_RET_VAL=$?;; - stop|stop-restart) plugin_stop; PLUGIN_RET_VAL=$?;; - status ) plugin_status; PLUGIN_RET_VAL=$?;; - * ) PLUGIN_RET_VAL=1; printf "\033[40m\033[1;31m${INDENT}ERROR: Invalid plugin option \"$PLUGIN_CMD\"!\033[0m\n" >&2;; + start|'') plugin_start; PLUGIN_RET_VAL=$? ;; + restart ) plugin_restart; PLUGIN_RET_VAL=$? ;; + stop|stop-restart) plugin_stop; PLUGIN_RET_VAL=$? ;; + status ) plugin_status; PLUGIN_RET_VAL=$? ;; + * ) PLUGIN_RET_VAL=1; printf "\033[40m\033[1;31m${INDENT}ERROR: Invalid plugin option \"$PLUGIN_CMD\"!\033[0m\n" >&2 ;; esac fi - else - PLUGIN_RET_VAL=0 fi fi Modified: branches/1.0/package/arnofw/time-schedule-host-block/30time-schedule-host-block.plugin.sh =================================================================== --- branches/1.0/package/arnofw/time-schedule-host-block/30time-schedule-host-block.plugin.sh 2015-08-08 14:07:11 UTC (rev 7189) +++ branches/1.0/package/arnofw/time-schedule-host-block/30time-schedule-host-block.plugin.sh 2015-08-13 22:43:35 UTC (rev 7190) @@ -234,10 +234,12 @@ CONF_FILE="$PLUGIN_CONF_PATH/$PLUGIN_CONF_FILE" fi +# Preinit to success: +PLUGIN_RET_VAL=0 + # Check if the config file exists if [ ! -e "$CONF_FILE" ]; then printf "NOTE: Config file \"$CONF_FILE\" not found!\n Plugin \"$PLUGIN_NAME v$PLUGIN_VERSION\" ignored!\n" >&2 - PLUGIN_RET_VAL=0 else # Source the plugin config file . "$CONF_FILE" @@ -253,16 +255,16 @@ INDENT="$INDENT " # Only proceed if environment ok - if plugin_sanity_check; then + if ! plugin_sanity_check; then + PLUGIN_RET_VAL=1 + else case $PLUGIN_CMD in - start|'') plugin_start; PLUGIN_RET_VAL=$?;; - restart ) plugin_restart; PLUGIN_RET_VAL=$?;; - stop|stop-restart) plugin_stop; PLUGIN_RET_VAL=$?;; - status ) plugin_status; PLUGIN_RET_VAL=$?;; - * ) PLUGIN_RET_VAL=1; printf "\033[40m\033[1;31m ERROR: Invalid plugin option \"$PLUGIN_CMD\"!\033[0m\n" >&2;; + start|'') plugin_start; PLUGIN_RET_VAL=$? ;; + restart ) plugin_restart; PLUGIN_RET_VAL=$? ;; + stop|stop-restart) plugin_stop; PLUGIN_RET_VAL=$? ;; + status ) plugin_status; PLUGIN_RET_VAL=$? ;; + * ) PLUGIN_RET_VAL=1; printf "\033[40m\033[1;31m ERROR: Invalid plugin option \"$PLUGIN_CMD\"!\033[0m\n" >&2 ;; esac fi - else - PLUGIN_RET_VAL=0 fi fi Modified: branches/1.0/package/arnofw/traffic-shaper/60traffic-shaper.plugin.sh =================================================================== --- branches/1.0/package/arnofw/traffic-shaper/60traffic-shaper.plugin.sh 2015-08-08 14:07:11 UTC (rev 7189) +++ branches/1.0/package/arnofw/traffic-shaper/60traffic-shaper.plugin.sh 2015-08-13 22:43:35 UTC (rev 7190) @@ -438,10 +438,12 @@ CONF_FILE="$PLUGIN_CONF_PATH/$PLUGIN_CONF_FILE" fi +# Preinit to success: +PLUGIN_RET_VAL=0 + # Check if the config file exists if [ ! -e "$CONF_FILE" ]; then printf "NOTE: Config file \"$CONF_FILE\" not found!\n Plugin \"$PLUGIN_NAME v$PLUGIN_VERSION\" ignored!\n" >&2 - PLUGIN_RET_VAL=0 else # Source the plugin config file . "$CONF_FILE" @@ -456,15 +458,15 @@ INDENT="$INDENT " # Only proceed if environment ok - if plugin_sanity_check; then + if ! plugin_sanity_check; then + PLUGIN_RET_VAL=1 + else case $PLUGIN_CMD in - start|'') plugin_start; PLUGIN_RET_VAL=$?;; - stop ) plugin_stop; PLUGIN_RET_VAL=$?;; - status ) plugin_status; PLUGIN_RET_VAL=$?;; + start|'') plugin_start; PLUGIN_RET_VAL=$? ;; + stop ) plugin_stop; PLUGIN_RET_VAL=$? ;; + status ) plugin_status; PLUGIN_RET_VAL=$? ;; * ) PLUGIN_RET_VAL=1; printf "\033[40m\033[1;31m${INDENT}ERROR: Invalid plugin option \"$PLUGIN_CMD\"!\033[0m\n" >&2 ;; esac fi - else - PLUGIN_RET_VAL=0 fi fi This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. |
From: <abe...@us...> - 2016-01-09 17:51:25
|
Revision: 7451 http://sourceforge.net/p/astlinux/code/7451 Author: abelbeck Date: 2016-01-09 17:51:22 +0000 (Sat, 09 Jan 2016) Log Message: ----------- arnofw, add new PPTP VPN Passthrough plugin from upstream Ref: https://github.com/arno-iptables-firewall/aif/commit/ade2e3fd17771b861f97dd3adb5307e4da16dc4e Modified Paths: -------------- branches/1.0/package/arnofw/arnofw.serial Added Paths: ----------- branches/1.0/package/arnofw/arnofw-pptp-vpn-passthrough.patch Added: branches/1.0/package/arnofw/arnofw-pptp-vpn-passthrough.patch =================================================================== --- branches/1.0/package/arnofw/arnofw-pptp-vpn-passthrough.patch (rev 0) +++ branches/1.0/package/arnofw/arnofw-pptp-vpn-passthrough.patch 2016-01-09 17:51:22 UTC (rev 7451) @@ -0,0 +1,186 @@ +From ade2e3fd17771b861f97dd3adb5307e4da16dc4e Mon Sep 17 00:00:00 2001 +From: Lonnie Abelbeck <lo...@ab...> +Date: Sat, 9 Jan 2016 10:04:46 -0600 +Subject: [PATCH] added: PPTP VPN Passthrough plugin, Issue #27 + +--- + .../plugins/pptp-vpn-passthrough.conf | 14 +++ + .../plugins/50pptp-vpn-passthrough.plugin | 135 +++++++++++++++++++++ + .../plugins/pptp-vpn-passthrough.CHANGELOG | 4 + + 3 files changed, 153 insertions(+) + create mode 100644 etc/arno-iptables-firewall/plugins/pptp-vpn-passthrough.conf + create mode 100644 share/arno-iptables-firewall/plugins/50pptp-vpn-passthrough.plugin + create mode 100644 share/arno-iptables-firewall/plugins/pptp-vpn-passthrough.CHANGELOG + +diff --git a/etc/arno-iptables-firewall/plugins/pptp-vpn-passthrough.conf b/etc/arno-iptables-firewall/plugins/pptp-vpn-passthrough.conf +new file mode 100644 +index 0000000..250bc0d +--- /dev/null ++++ b/etc/arno-iptables-firewall/plugins/pptp-vpn-passthrough.conf +@@ -0,0 +1,14 @@ ++# ------------------------------------------------------------------------------ ++# -= Arno's iptables firewall - PPTP VPN Passthrough plugin =- ++# ------------------------------------------------------------------------------ ++ ++# To actually enable this plugin make ENABLED=1: ++# ------------------------------------------------------------------------------ ++ENABLED=0 ++ ++# PPTP uses the GRE protocol for transport, as such, when PPTP VPN clients ++# have NAT between them and the PPTP VPN server special packet handling must be performed. ++# This plugin loads the required Linux Kernel modules to handle that situation. ++# ++# No configuration options ++# ------------------------------------------------------------------------------ +diff --git a/share/arno-iptables-firewall/plugins/50pptp-vpn-passthrough.plugin b/share/arno-iptables-firewall/plugins/50pptp-vpn-passthrough.plugin +new file mode 100644 +index 0000000..379a1dd +--- /dev/null ++++ b/share/arno-iptables-firewall/plugins/50pptp-vpn-passthrough.plugin +@@ -0,0 +1,135 @@ ++# ------------------------------------------------------------------------------ ++# -= Arno's iptables firewall - PPTP VPN Passthrough plugin =- ++# ++PLUGIN_NAME="PPTP VPN Passthrough plugin" ++PLUGIN_VERSION="1.00" ++PLUGIN_CONF_FILE="pptp-vpn-passthrough.conf" ++# ++# Last changed : January 9, 2016 ++# Requirements : AIF 2.0.0+ and ip_nat_pptp ++# Comments : This plugin loads the required kernel modules for PPTP VPN Clients ++# to access remote PPTP VPN Server(s) when NAT is enabled. ++# ++# Author : (C) Copyright 2016 by Lonnie Abelbeck & Arno van Amersfoort ++# Homepage : http://rocky.eld.leidenuniv.nl/ ++# Email : a r n o v a AT r o c k y DOT e l d DOT l e i d e n u n i v DOT n l ++# (note: you must remove all spaces and substitute the @ and the . ++# at the proper locations!) ++# ------------------------------------------------------------------------------ ++# This program is free software; you can redistribute it and/or ++# modify it under the terms of the GNU General Public License ++# version 2 as published by the Free Software Foundation. ++# ++# This program is distributed in the hope that it will be useful, ++# but WITHOUT ANY WARRANTY; without even the implied warranty of ++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++# GNU General Public License for more details. ++# ++# You should have received a copy of the GNU General Public License ++# along with this program; if not, write to the Free Software ++# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. ++# ------------------------------------------------------------------------------ ++ ++# Plugin start function ++plugin_start() ++{ ++ ++ if [ "$NAT" = "1" ]; then ++ echo "${INDENT}Enable PPTP NAT helper module" ++ modprobe_multi nf_nat_pptp ip_nat_pptp ++ else ++ echo "${INDENT}ERROR: NAT is not enabled, this plugin will be ignored." ++ fi ++ ++ return 0 ++} ++ ++ ++# Plugin restart function ++plugin_restart() ++{ ++ ++ # Skip plugin_stop on a restart ++ plugin_start ++ ++ return 0 ++} ++ ++ ++# Plugin stop function ++plugin_stop() ++{ ++ ++ if [ "$NAT" = "1" ]; then ++ if [ -e /proc/modules -a -x "$MODPROBE" ]; then ++ if ! $MODPROBE -r nf_nat_pptp >/dev/null 2>&1; then ++ $MODPROBE -r ip_nat_pptp >/dev/null 2>&1 ++ fi ++ if [ $? -eq 0 ]; then ++ echo "${INDENT}Disabled PPTP NAT helper module" ++ fi ++ fi ++ fi ++ ++ return 0 ++} ++ ++ ++# Plugin status function ++plugin_status() ++{ ++ return 0 ++} ++ ++ ++# Check sanity of eg. environment ++plugin_sanity_check() ++{ ++ return 0 ++} ++ ++ ++############ ++# Mainline # ++############ ++ ++# Check where to find the config file ++CONF_FILE="" ++if [ -n "$PLUGIN_CONF_PATH" ]; then ++ CONF_FILE="$PLUGIN_CONF_PATH/$PLUGIN_CONF_FILE" ++fi ++ ++# Preinit to success: ++PLUGIN_RET_VAL=0 ++ ++# Check if the config file exists ++if [ ! -e "$CONF_FILE" ]; then ++ printf "NOTE: Config file \"$CONF_FILE\" not found!\n Plugin \"$PLUGIN_NAME v$PLUGIN_VERSION\" ignored!\n" >&2 ++else ++ # Source the plugin config file ++ . "$CONF_FILE" ++ ++ if [ "$ENABLED" = "1" -a "$PLUGIN_CMD" != "stop-restart" ] || ++ [ "$ENABLED" = "0" -a "$PLUGIN_CMD" = "stop-restart" ] || ++ [ -n "$PLUGIN_LOAD_FILE" -a "$PLUGIN_CMD" = "stop" ] || ++ [ -n "$PLUGIN_LOAD_FILE" -a "$PLUGIN_CMD" = "status" ]; then ++ # Show who we are: ++ echo "${INDENT}$PLUGIN_NAME v$PLUGIN_VERSION" ++ ++ # Increment indention ++ INDENT="$INDENT " ++ ++ # Only proceed if environment ok ++ if ! plugin_sanity_check; then ++ PLUGIN_RET_VAL=1 ++ else ++ case $PLUGIN_CMD in ++ start|'') plugin_start; PLUGIN_RET_VAL=$? ;; ++ restart ) plugin_restart; PLUGIN_RET_VAL=$? ;; ++ stop|stop-restart) plugin_stop; PLUGIN_RET_VAL=$? ;; ++ status ) plugin_status; PLUGIN_RET_VAL=$? ;; ++ * ) PLUGIN_RET_VAL=1; printf "\033[40m\033[1;31m${INDENT}ERROR: Invalid plugin option \"$PLUGIN_CMD\"!\033[0m\n" >&2 ;; ++ esac ++ fi ++ fi ++fi +diff --git a/share/arno-iptables-firewall/plugins/pptp-vpn-passthrough.CHANGELOG b/share/arno-iptables-firewall/plugins/pptp-vpn-passthrough.CHANGELOG +new file mode 100644 +index 0000000..042b789 +--- /dev/null ++++ b/share/arno-iptables-firewall/plugins/pptp-vpn-passthrough.CHANGELOG +@@ -0,0 +1,4 @@ ++Version 1.00 (January 9, 2016) ++----------------------------------- +++ Initial version ++ + Modified: branches/1.0/package/arnofw/arnofw.serial =================================================================== --- branches/1.0/package/arnofw/arnofw.serial 2016-01-09 15:16:38 UTC (rev 7450) +++ branches/1.0/package/arnofw/arnofw.serial 2016-01-09 17:51:22 UTC (rev 7451) @@ -1 +1 @@ -0002~0025~0000~0000~0000~ +0002~0026~0000~0000~0000~ This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. |
From: <abe...@us...> - 2016-06-11 20:31:28
|
Revision: 7716 http://sourceforge.net/p/astlinux/code/7716 Author: abelbeck Date: 2016-06-11 20:31:25 +0000 (Sat, 11 Jun 2016) Log Message: ----------- arnofw, Add LAN to LAN filtering rules (AIF issue #28), bump serial number for updated default firewall.conf Ref: https://github.com/arno-iptables-firewall/aif/issues/28 Modified Paths: -------------- branches/1.0/package/arnofw/arnofw.serial Added Paths: ----------- branches/1.0/package/arnofw/arnofw-0001-do-not-reset-accept_ra.patch branches/1.0/package/arnofw/arnofw-0002-icmpv6-add-MLD-cleanup-logging.patch branches/1.0/package/arnofw/arnofw-0003-pptp-vpn-passthrough.patch branches/1.0/package/arnofw/arnofw-0004-add-LAN_LAN_FORWARD_CHAIN.patch Removed Paths: ------------- branches/1.0/package/arnofw/arnofw-do-not-reset-accept_ra.patch branches/1.0/package/arnofw/arnofw-icmpv6-add-MLD-cleanup-logging.patch branches/1.0/package/arnofw/arnofw-pptp-vpn-passthrough.patch Copied: branches/1.0/package/arnofw/arnofw-0001-do-not-reset-accept_ra.patch (from rev 7715, branches/1.0/package/arnofw/arnofw-do-not-reset-accept_ra.patch) =================================================================== --- branches/1.0/package/arnofw/arnofw-0001-do-not-reset-accept_ra.patch (rev 0) +++ branches/1.0/package/arnofw/arnofw-0001-do-not-reset-accept_ra.patch 2016-06-11 20:31:25 UTC (rev 7716) @@ -0,0 +1,11 @@ +--- arno-iptables-firewall_2.0.1f/bin/arno-iptables-firewall.orig 2015-10-30 15:52:23.000000000 -0500 ++++ arno-iptables-firewall_2.0.1f/bin/arno-iptables-firewall 2015-10-30 16:00:37.000000000 -0500 +@@ -495,7 +495,7 @@ + sysctl_set_all "net.ipv6.conf" "forwarding" 1 + echo " Disabling Local IPv6 Auto-Configuration" + sysctl_set_all "net.ipv6.conf" "autoconf" 0 +- sysctl_set_all "net.ipv6.conf" "accept_ra" 0 ++ ## Setting accept_ra=0 is not needed with forwarding=1, don't overwrite any existing accept_ra=2 values + fi + elif [ "$IP_FORWARDING" = "0" ]; then + echo " DISABLING packet forwarding" Copied: branches/1.0/package/arnofw/arnofw-0002-icmpv6-add-MLD-cleanup-logging.patch (from rev 7715, branches/1.0/package/arnofw/arnofw-icmpv6-add-MLD-cleanup-logging.patch) =================================================================== --- branches/1.0/package/arnofw/arnofw-0002-icmpv6-add-MLD-cleanup-logging.patch (rev 0) +++ branches/1.0/package/arnofw/arnofw-0002-icmpv6-add-MLD-cleanup-logging.patch 2016-06-11 20:31:25 UTC (rev 7716) @@ -0,0 +1,75 @@ +From 7bd64927a401050769b7da18fd2ae52370cc2390 Mon Sep 17 00:00:00 2001 +From: Lonnie Abelbeck <lo...@ab...> +Date: Sat, 13 Feb 2016 16:16:16 -0600 +Subject: [PATCH] changed: added support for ICMPv6 Multicast Listener + Discovery, disabled by default with OPEN_ICMPV6_MLD=0. Additionally make sure + all un-needed ICMPv6 packets are dropped so they don't appear as annoying + logs, more common with native IPv6 support by ISP's. Thanks to David Kerr for + pointing out the issue and testing a solution. + +--- + bin/arno-iptables-firewall | 10 ++++++++++ + etc/arno-iptables-firewall/firewall.conf | 6 ++++++ + share/arno-iptables-firewall/environment | 4 ++++ + 3 files changed, 20 insertions(+) + +diff --git a/bin/arno-iptables-firewall b/bin/arno-iptables-firewall +index f5095a5..b02a85f 100755 +--- a/bin/arno-iptables-firewall ++++ b/bin/arno-iptables-firewall +@@ -4574,6 +4574,11 @@ setup_firewall_rules() + for icmpv6_type in $ICMPV6_SPECIAL_TYPES; do + ip6tables -A INPUT -i $interface -p icmpv6 --icmpv6-type $icmpv6_type -m hl --hl-eq 255 -j ACCEPT + done ++ if [ "$OPEN_ICMPV6_MLD" = "1" ]; then ++ for icmpv6_type in $ICMPV6_MLD_TYPES; do ++ ip6tables -A INPUT -i $interface -p icmpv6 --icmpv6-type $icmpv6_type -s fe80::/10 -m hl --hl-eq 1 -j ACCEPT ++ done ++ fi + fi + + # Apply external (internet) interface policy for the input chain: +@@ -4592,6 +4597,11 @@ setup_firewall_rules() + + # ICMP traffic (flood) + iptables -A INPUT -i $interface -p icmp -m state --state NEW -j EXT_ICMP_FLOOD_CHAIN ++ ++ # Drop any remaining ICMPv6 traffic ++ if [ "$IPV6_SUPPORT" = "1" ]; then ++ ip6tables -A INPUT -i $interface -p icmpv6 -j POST_INPUT_DROP_CHAIN ++ fi + done + + +diff --git a/etc/arno-iptables-firewall/firewall.conf b/etc/arno-iptables-firewall/firewall.conf +index 9e80e20..2291916 100644 +--- a/etc/arno-iptables-firewall/firewall.conf ++++ b/etc/arno-iptables-firewall/firewall.conf +@@ -1158,6 +1158,12 @@ OPEN_ICMP=0 + # ----------------------------------------------------------------------------- + OPEN_ICMPV6=1 + ++# Enable (1) to make the default policy allow IPv6 ICMPv6 ++# Multicast Listener Discovery (RFC 2710, 3810) for INET access ++# Note: Requires setting OPEN_ICMPV6=1 to apply. ++# ----------------------------------------------------------------------------- ++OPEN_ICMPV6_MLD=0 ++ + # Put in the following variables which ports or IP protocols you want to leave + # open to the whole world. + # ----------------------------------------------------------------------------- +diff --git a/share/arno-iptables-firewall/environment b/share/arno-iptables-firewall/environment +index 5728e4c..616c29c 100644 +--- a/share/arno-iptables-firewall/environment ++++ b/share/arno-iptables-firewall/environment +@@ -1698,6 +1698,10 @@ fi + ###################################################################### + ICMPV6_SPECIAL_TYPES="133 134 135 136" + ++# IPv6 ICMPv6 Multicast Listener Discovery (RFC 2710, 3810) ++###################################################################### ++ICMPV6_MLD_TYPES="130 131 132 143" ++ + # Check plugin bin path and fallback in case it's empty + ####################################################### + if [ -z "$PLUGIN_BIN_PATH" ]; then Copied: branches/1.0/package/arnofw/arnofw-0003-pptp-vpn-passthrough.patch (from rev 7715, branches/1.0/package/arnofw/arnofw-pptp-vpn-passthrough.patch) =================================================================== --- branches/1.0/package/arnofw/arnofw-0003-pptp-vpn-passthrough.patch (rev 0) +++ branches/1.0/package/arnofw/arnofw-0003-pptp-vpn-passthrough.patch 2016-06-11 20:31:25 UTC (rev 7716) @@ -0,0 +1,186 @@ +From ade2e3fd17771b861f97dd3adb5307e4da16dc4e Mon Sep 17 00:00:00 2001 +From: Lonnie Abelbeck <lo...@ab...> +Date: Sat, 9 Jan 2016 10:04:46 -0600 +Subject: [PATCH] added: PPTP VPN Passthrough plugin, Issue #27 + +--- + .../plugins/pptp-vpn-passthrough.conf | 14 +++ + .../plugins/50pptp-vpn-passthrough.plugin | 135 +++++++++++++++++++++ + .../plugins/pptp-vpn-passthrough.CHANGELOG | 4 + + 3 files changed, 153 insertions(+) + create mode 100644 etc/arno-iptables-firewall/plugins/pptp-vpn-passthrough.conf + create mode 100644 share/arno-iptables-firewall/plugins/50pptp-vpn-passthrough.plugin + create mode 100644 share/arno-iptables-firewall/plugins/pptp-vpn-passthrough.CHANGELOG + +diff --git a/etc/arno-iptables-firewall/plugins/pptp-vpn-passthrough.conf b/etc/arno-iptables-firewall/plugins/pptp-vpn-passthrough.conf +new file mode 100644 +index 0000000..250bc0d +--- /dev/null ++++ b/etc/arno-iptables-firewall/plugins/pptp-vpn-passthrough.conf +@@ -0,0 +1,14 @@ ++# ------------------------------------------------------------------------------ ++# -= Arno's iptables firewall - PPTP VPN Passthrough plugin =- ++# ------------------------------------------------------------------------------ ++ ++# To actually enable this plugin make ENABLED=1: ++# ------------------------------------------------------------------------------ ++ENABLED=0 ++ ++# PPTP uses the GRE protocol for transport, as such, when PPTP VPN clients ++# have NAT between them and the PPTP VPN server special packet handling must be performed. ++# This plugin loads the required Linux Kernel modules to handle that situation. ++# ++# No configuration options ++# ------------------------------------------------------------------------------ +diff --git a/share/arno-iptables-firewall/plugins/50pptp-vpn-passthrough.plugin b/share/arno-iptables-firewall/plugins/50pptp-vpn-passthrough.plugin +new file mode 100644 +index 0000000..379a1dd +--- /dev/null ++++ b/share/arno-iptables-firewall/plugins/50pptp-vpn-passthrough.plugin +@@ -0,0 +1,135 @@ ++# ------------------------------------------------------------------------------ ++# -= Arno's iptables firewall - PPTP VPN Passthrough plugin =- ++# ++PLUGIN_NAME="PPTP VPN Passthrough plugin" ++PLUGIN_VERSION="1.00" ++PLUGIN_CONF_FILE="pptp-vpn-passthrough.conf" ++# ++# Last changed : January 9, 2016 ++# Requirements : AIF 2.0.0+ and ip_nat_pptp ++# Comments : This plugin loads the required kernel modules for PPTP VPN Clients ++# to access remote PPTP VPN Server(s) when NAT is enabled. ++# ++# Author : (C) Copyright 2016 by Lonnie Abelbeck & Arno van Amersfoort ++# Homepage : http://rocky.eld.leidenuniv.nl/ ++# Email : a r n o v a AT r o c k y DOT e l d DOT l e i d e n u n i v DOT n l ++# (note: you must remove all spaces and substitute the @ and the . ++# at the proper locations!) ++# ------------------------------------------------------------------------------ ++# This program is free software; you can redistribute it and/or ++# modify it under the terms of the GNU General Public License ++# version 2 as published by the Free Software Foundation. ++# ++# This program is distributed in the hope that it will be useful, ++# but WITHOUT ANY WARRANTY; without even the implied warranty of ++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++# GNU General Public License for more details. ++# ++# You should have received a copy of the GNU General Public License ++# along with this program; if not, write to the Free Software ++# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. ++# ------------------------------------------------------------------------------ ++ ++# Plugin start function ++plugin_start() ++{ ++ ++ if [ "$NAT" = "1" ]; then ++ echo "${INDENT}Enable PPTP NAT helper module" ++ modprobe_multi nf_nat_pptp ip_nat_pptp ++ else ++ echo "${INDENT}ERROR: NAT is not enabled, this plugin will be ignored." ++ fi ++ ++ return 0 ++} ++ ++ ++# Plugin restart function ++plugin_restart() ++{ ++ ++ # Skip plugin_stop on a restart ++ plugin_start ++ ++ return 0 ++} ++ ++ ++# Plugin stop function ++plugin_stop() ++{ ++ ++ if [ "$NAT" = "1" ]; then ++ if [ -e /proc/modules -a -x "$MODPROBE" ]; then ++ if ! $MODPROBE -r nf_nat_pptp >/dev/null 2>&1; then ++ $MODPROBE -r ip_nat_pptp >/dev/null 2>&1 ++ fi ++ if [ $? -eq 0 ]; then ++ echo "${INDENT}Disabled PPTP NAT helper module" ++ fi ++ fi ++ fi ++ ++ return 0 ++} ++ ++ ++# Plugin status function ++plugin_status() ++{ ++ return 0 ++} ++ ++ ++# Check sanity of eg. environment ++plugin_sanity_check() ++{ ++ return 0 ++} ++ ++ ++############ ++# Mainline # ++############ ++ ++# Check where to find the config file ++CONF_FILE="" ++if [ -n "$PLUGIN_CONF_PATH" ]; then ++ CONF_FILE="$PLUGIN_CONF_PATH/$PLUGIN_CONF_FILE" ++fi ++ ++# Preinit to success: ++PLUGIN_RET_VAL=0 ++ ++# Check if the config file exists ++if [ ! -e "$CONF_FILE" ]; then ++ printf "NOTE: Config file \"$CONF_FILE\" not found!\n Plugin \"$PLUGIN_NAME v$PLUGIN_VERSION\" ignored!\n" >&2 ++else ++ # Source the plugin config file ++ . "$CONF_FILE" ++ ++ if [ "$ENABLED" = "1" -a "$PLUGIN_CMD" != "stop-restart" ] || ++ [ "$ENABLED" = "0" -a "$PLUGIN_CMD" = "stop-restart" ] || ++ [ -n "$PLUGIN_LOAD_FILE" -a "$PLUGIN_CMD" = "stop" ] || ++ [ -n "$PLUGIN_LOAD_FILE" -a "$PLUGIN_CMD" = "status" ]; then ++ # Show who we are: ++ echo "${INDENT}$PLUGIN_NAME v$PLUGIN_VERSION" ++ ++ # Increment indention ++ INDENT="$INDENT " ++ ++ # Only proceed if environment ok ++ if ! plugin_sanity_check; then ++ PLUGIN_RET_VAL=1 ++ else ++ case $PLUGIN_CMD in ++ start|'') plugin_start; PLUGIN_RET_VAL=$? ;; ++ restart ) plugin_restart; PLUGIN_RET_VAL=$? ;; ++ stop|stop-restart) plugin_stop; PLUGIN_RET_VAL=$? ;; ++ status ) plugin_status; PLUGIN_RET_VAL=$? ;; ++ * ) PLUGIN_RET_VAL=1; printf "\033[40m\033[1;31m${INDENT}ERROR: Invalid plugin option \"$PLUGIN_CMD\"!\033[0m\n" >&2 ;; ++ esac ++ fi ++ fi ++fi +diff --git a/share/arno-iptables-firewall/plugins/pptp-vpn-passthrough.CHANGELOG b/share/arno-iptables-firewall/plugins/pptp-vpn-passthrough.CHANGELOG +new file mode 100644 +index 0000000..042b789 +--- /dev/null ++++ b/share/arno-iptables-firewall/plugins/pptp-vpn-passthrough.CHANGELOG +@@ -0,0 +1,4 @@ ++Version 1.00 (January 9, 2016) ++----------------------------------- +++ Initial version ++ + Added: branches/1.0/package/arnofw/arnofw-0004-add-LAN_LAN_FORWARD_CHAIN.patch =================================================================== --- branches/1.0/package/arnofw/arnofw-0004-add-LAN_LAN_FORWARD_CHAIN.patch (rev 0) +++ branches/1.0/package/arnofw/arnofw-0004-add-LAN_LAN_FORWARD_CHAIN.patch 2016-06-11 20:31:25 UTC (rev 7716) @@ -0,0 +1,173 @@ +diff --git a/README b/README +index 093151a..93641a4 100644 +--- a/README ++++ b/README +@@ -480,6 +480,7 @@ INT_FORWARD_IN_CHAIN - Internal-net FORWARD chain for INcoming traffic + INT_FORWARD_OUT_CHAIN - Internal-net FORWARD chain for OUTcoming traffic + INT_INPUT_CHAIN - Internal-net INPUT chain + INT_OUTPUT_CHAIN - Internal-net OUTPUT chain ++LAN_LAN_FORWARD_CHAIN - LAN to LAN (Inter-LAN) forward chain + LAN_INET_FORWARD_CHAIN - LAN to internet (external net) forward chain + POST_INPUT_CHAIN - This chain is always processed last(post) in the + INPUT chain +diff --git a/bin/arno-iptables-firewall b/bin/arno-iptables-firewall +index b02a85f..67d79ec 100755 +--- a/bin/arno-iptables-firewall ++++ b/bin/arno-iptables-firewall +@@ -2263,6 +2263,72 @@ setup_int_input_chain() + } + + ++################################################## ++# Setup chain for the LAN-to-LAN forward traffic # ++################################################## ++setup_lan_lan_forward_chain() ++{ ++ echo " Setting up LAN->LAN policy" ++ ++ # TCP ports to ALLOW for certain Inter-LAN hosts ++ ################################################ ++ unset IFS ++ for rule in $LAN_LAN_HOST_OPEN_TCP; do ++ if parse_rule "$rule" LAN_LAN_HOST_OPEN_TCP "shosts:ANYHOST-dhosts-ports:ANYPORT"; then ++ ++ echo " Allowing $shosts(LAN) to $dhosts(LAN) for TCP port(s): $ports" ++ ++ IFS=',' ++ for shost in `ip_range "$shosts"`; do ++ for dhost in `ip_range "$dhosts"`; do ++ for port in $ports; do ++ iptables -A LAN_LAN_FORWARD_CHAIN -s $shost -d $dhost -p tcp --dport $port -j ACCEPT ++ done ++ done ++ done ++ fi ++ done ++ ++ # UDP ports to ALLOW for certain Inter-LAN hosts ++ ################################################ ++ unset IFS ++ for rule in $LAN_LAN_HOST_OPEN_UDP; do ++ if parse_rule "$rule" LAN_LAN_HOST_OPEN_UDP "shosts:ANYHOST-dhosts-ports:ANYPORT"; then ++ ++ echo " Allowing $shosts(LAN) to $dhosts(LAN) for UDP port(s): $ports" ++ ++ IFS=',' ++ for shost in `ip_range "$shosts"`; do ++ for dhost in `ip_range "$dhosts"`; do ++ for port in $ports; do ++ iptables -A LAN_LAN_FORWARD_CHAIN -s $shost -d $dhost -p udp --dport $port -j ACCEPT ++ done ++ done ++ done ++ fi ++ done ++ ++ # IP protocol(s) to ALLOW for certain Inter-LAN hosts ++ ##################################################### ++ unset IFS ++ for rule in $LAN_LAN_HOST_OPEN_IP; do ++ if parse_rule "$rule" LAN_LAN_HOST_OPEN_IP "shosts:ANYHOST-dhosts-protos"; then ++ ++ echo " Allowing $shosts(LAN) to $dhosts(LAN) for IP protocol(s): $protos" ++ ++ IFS=',' ++ for shost in `ip_range "$shosts"`; do ++ for dhost in `ip_range "$dhosts"`; do ++ for proto in $protos; do ++ iptables -A LAN_LAN_FORWARD_CHAIN -s $shost -d $dhost -p $proto -j ACCEPT ++ done ++ done ++ done ++ fi ++ done ++} ++ ++ + ################################################### + # Setup chain for the LAN-to-INET forward traffic # + ################################################### +@@ -4803,7 +4869,8 @@ setup_firewall_rules() + echo " Logging of denied LAN->INET FORWARD connections disabled" + fi + +- # Setup helper chain for the LAN: ++ # Setup helper chains for the LAN: ++ setup_lan_lan_forward_chain; + setup_lan_inet_forward_chain; + + IFS=' ,' +@@ -4813,6 +4880,12 @@ setup_firewall_rules() + # Always make subnets on the SAME interface trust each other + iptables -A FORWARD -i $iif -o $iif -j ACCEPT + ++ for output_if in $INT_IF; do ++ if [ "$iif" != "$output_if" ]; then ++ iptables -A FORWARD -i $iif -o $output_if -j LAN_LAN_FORWARD_CHAIN ++ fi ++ done ++ + for eif in $EXT_IF; do + iptables -A FORWARD -i $iif -o $eif -j LAN_INET_FORWARD_CHAIN + done +@@ -5035,6 +5108,7 @@ create_user_chains() + iptables -N DMZ_LAN_FORWARD_CHAIN + iptables -N INET_DMZ_FORWARD_CHAIN + iptables -N DMZ_INET_FORWARD_CHAIN ++ iptables -N LAN_LAN_FORWARD_CHAIN + iptables -N LAN_INET_FORWARD_CHAIN + + # Chains for the external interface +@@ -5091,6 +5165,7 @@ flush_user_chains() + iptables -F DMZ_LAN_FORWARD_CHAIN + iptables -F INET_DMZ_FORWARD_CHAIN + iptables -F DMZ_INET_FORWARD_CHAIN ++ iptables -F LAN_LAN_FORWARD_CHAIN + iptables -F LAN_INET_FORWARD_CHAIN + + # Chains for the external interface +diff --git a/etc/arno-iptables-firewall/firewall.conf b/etc/arno-iptables-firewall/firewall.conf +index 2291916..73554d2 100644 +--- a/etc/arno-iptables-firewall/firewall.conf ++++ b/etc/arno-iptables-firewall/firewall.conf +@@ -696,6 +696,40 @@ LAN_HOST_DENY_IP="" + + + ############################################################################### ++# LAN_LAN_xxx = LAN->LAN access rules (forward) # ++############################################################################### ++ ++# Put in the following variables which LAN hosts you want to allow to certain ++# hosts/services on a different LAN (net). ++# ++# TCP/UDP form: ++# "SRCIP1,SRCIP2,...>DESTIP1~port \ ++# SRCIP3,...>DESTIP2~port" ++# ++# IP form: ++# "SRCIP1,SRCIP2,...>DESTIP1~protocol \ ++# SRCIP3,...>DESTIP2~protocol" ++# ++# TCP/UDP examples: ++# Simple (Allow port 80 to LAN host 1.2.3.4 from all other LAN hosts(0/0)): ++# LAN_LAN_HOST_OPEN_xxx="0/0>1.2.3.4~80" ++# Advanced (Allow port 20 & 21 to LAN host 1.2.3.4 from all other LAN hosts (0/0) and ++# allow port 80 from LAN host 5.6.7.8 (only) to LAN host 1.2.3.4): ++# LAN_LAN_HOST_OPEN_xxx="0/0>1.2.3.4~20,21 5.6.7.8>1.2.3.4~80" ++# ++# IP protocol example: ++# (Allow protocols 47 & 48 to LAN host 1.2.3.4 from all other LAN hosts(0/0)): ++# LAN_LAN_HOST_OPEN_IP="0/0>1.2.3.4~47,48" ++# ++# NOTE 1: If no SRCIPx is specified, any source host is used ++# NOTE 2: If no port is specified, any port is used ++# ----------------------------------------------------------------------------- ++LAN_LAN_HOST_OPEN_TCP="" ++LAN_LAN_HOST_OPEN_UDP="" ++LAN_LAN_HOST_OPEN_IP="" ++ ++ ++############################################################################### + # LAN_INET_xxx = LAN->internet access rules (forward) # + # # + # Note that when the LAN_INET_OPEN_xxx & LAN_INET_HOST_OPEN_xxx variables are # Deleted: branches/1.0/package/arnofw/arnofw-do-not-reset-accept_ra.patch =================================================================== --- branches/1.0/package/arnofw/arnofw-do-not-reset-accept_ra.patch 2016-06-10 13:54:37 UTC (rev 7715) +++ branches/1.0/package/arnofw/arnofw-do-not-reset-accept_ra.patch 2016-06-11 20:31:25 UTC (rev 7716) @@ -1,11 +0,0 @@ ---- arno-iptables-firewall_2.0.1f/bin/arno-iptables-firewall.orig 2015-10-30 15:52:23.000000000 -0500 -+++ arno-iptables-firewall_2.0.1f/bin/arno-iptables-firewall 2015-10-30 16:00:37.000000000 -0500 -@@ -495,7 +495,7 @@ - sysctl_set_all "net.ipv6.conf" "forwarding" 1 - echo " Disabling Local IPv6 Auto-Configuration" - sysctl_set_all "net.ipv6.conf" "autoconf" 0 -- sysctl_set_all "net.ipv6.conf" "accept_ra" 0 -+ ## Setting accept_ra=0 is not needed with forwarding=1, don't overwrite any existing accept_ra=2 values - fi - elif [ "$IP_FORWARDING" = "0" ]; then - echo " DISABLING packet forwarding" Deleted: branches/1.0/package/arnofw/arnofw-icmpv6-add-MLD-cleanup-logging.patch =================================================================== --- branches/1.0/package/arnofw/arnofw-icmpv6-add-MLD-cleanup-logging.patch 2016-06-10 13:54:37 UTC (rev 7715) +++ branches/1.0/package/arnofw/arnofw-icmpv6-add-MLD-cleanup-logging.patch 2016-06-11 20:31:25 UTC (rev 7716) @@ -1,75 +0,0 @@ -From 7bd64927a401050769b7da18fd2ae52370cc2390 Mon Sep 17 00:00:00 2001 -From: Lonnie Abelbeck <lo...@ab...> -Date: Sat, 13 Feb 2016 16:16:16 -0600 -Subject: [PATCH] changed: added support for ICMPv6 Multicast Listener - Discovery, disabled by default with OPEN_ICMPV6_MLD=0. Additionally make sure - all un-needed ICMPv6 packets are dropped so they don't appear as annoying - logs, more common with native IPv6 support by ISP's. Thanks to David Kerr for - pointing out the issue and testing a solution. - ---- - bin/arno-iptables-firewall | 10 ++++++++++ - etc/arno-iptables-firewall/firewall.conf | 6 ++++++ - share/arno-iptables-firewall/environment | 4 ++++ - 3 files changed, 20 insertions(+) - -diff --git a/bin/arno-iptables-firewall b/bin/arno-iptables-firewall -index f5095a5..b02a85f 100755 ---- a/bin/arno-iptables-firewall -+++ b/bin/arno-iptables-firewall -@@ -4574,6 +4574,11 @@ setup_firewall_rules() - for icmpv6_type in $ICMPV6_SPECIAL_TYPES; do - ip6tables -A INPUT -i $interface -p icmpv6 --icmpv6-type $icmpv6_type -m hl --hl-eq 255 -j ACCEPT - done -+ if [ "$OPEN_ICMPV6_MLD" = "1" ]; then -+ for icmpv6_type in $ICMPV6_MLD_TYPES; do -+ ip6tables -A INPUT -i $interface -p icmpv6 --icmpv6-type $icmpv6_type -s fe80::/10 -m hl --hl-eq 1 -j ACCEPT -+ done -+ fi - fi - - # Apply external (internet) interface policy for the input chain: -@@ -4592,6 +4597,11 @@ setup_firewall_rules() - - # ICMP traffic (flood) - iptables -A INPUT -i $interface -p icmp -m state --state NEW -j EXT_ICMP_FLOOD_CHAIN -+ -+ # Drop any remaining ICMPv6 traffic -+ if [ "$IPV6_SUPPORT" = "1" ]; then -+ ip6tables -A INPUT -i $interface -p icmpv6 -j POST_INPUT_DROP_CHAIN -+ fi - done - - -diff --git a/etc/arno-iptables-firewall/firewall.conf b/etc/arno-iptables-firewall/firewall.conf -index 9e80e20..2291916 100644 ---- a/etc/arno-iptables-firewall/firewall.conf -+++ b/etc/arno-iptables-firewall/firewall.conf -@@ -1158,6 +1158,12 @@ OPEN_ICMP=0 - # ----------------------------------------------------------------------------- - OPEN_ICMPV6=1 - -+# Enable (1) to make the default policy allow IPv6 ICMPv6 -+# Multicast Listener Discovery (RFC 2710, 3810) for INET access -+# Note: Requires setting OPEN_ICMPV6=1 to apply. -+# ----------------------------------------------------------------------------- -+OPEN_ICMPV6_MLD=0 -+ - # Put in the following variables which ports or IP protocols you want to leave - # open to the whole world. - # ----------------------------------------------------------------------------- -diff --git a/share/arno-iptables-firewall/environment b/share/arno-iptables-firewall/environment -index 5728e4c..616c29c 100644 ---- a/share/arno-iptables-firewall/environment -+++ b/share/arno-iptables-firewall/environment -@@ -1698,6 +1698,10 @@ fi - ###################################################################### - ICMPV6_SPECIAL_TYPES="133 134 135 136" - -+# IPv6 ICMPv6 Multicast Listener Discovery (RFC 2710, 3810) -+###################################################################### -+ICMPV6_MLD_TYPES="130 131 132 143" -+ - # Check plugin bin path and fallback in case it's empty - ####################################################### - if [ -z "$PLUGIN_BIN_PATH" ]; then Deleted: branches/1.0/package/arnofw/arnofw-pptp-vpn-passthrough.patch =================================================================== --- branches/1.0/package/arnofw/arnofw-pptp-vpn-passthrough.patch 2016-06-10 13:54:37 UTC (rev 7715) +++ branches/1.0/package/arnofw/arnofw-pptp-vpn-passthrough.patch 2016-06-11 20:31:25 UTC (rev 7716) @@ -1,186 +0,0 @@ -From ade2e3fd17771b861f97dd3adb5307e4da16dc4e Mon Sep 17 00:00:00 2001 -From: Lonnie Abelbeck <lo...@ab...> -Date: Sat, 9 Jan 2016 10:04:46 -0600 -Subject: [PATCH] added: PPTP VPN Passthrough plugin, Issue #27 - ---- - .../plugins/pptp-vpn-passthrough.conf | 14 +++ - .../plugins/50pptp-vpn-passthrough.plugin | 135 +++++++++++++++++++++ - .../plugins/pptp-vpn-passthrough.CHANGELOG | 4 + - 3 files changed, 153 insertions(+) - create mode 100644 etc/arno-iptables-firewall/plugins/pptp-vpn-passthrough.conf - create mode 100644 share/arno-iptables-firewall/plugins/50pptp-vpn-passthrough.plugin - create mode 100644 share/arno-iptables-firewall/plugins/pptp-vpn-passthrough.CHANGELOG - -diff --git a/etc/arno-iptables-firewall/plugins/pptp-vpn-passthrough.conf b/etc/arno-iptables-firewall/plugins/pptp-vpn-passthrough.conf -new file mode 100644 -index 0000000..250bc0d ---- /dev/null -+++ b/etc/arno-iptables-firewall/plugins/pptp-vpn-passthrough.conf -@@ -0,0 +1,14 @@ -+# ------------------------------------------------------------------------------ -+# -= Arno's iptables firewall - PPTP VPN Passthrough plugin =- -+# ------------------------------------------------------------------------------ -+ -+# To actually enable this plugin make ENABLED=1: -+# ------------------------------------------------------------------------------ -+ENABLED=0 -+ -+# PPTP uses the GRE protocol for transport, as such, when PPTP VPN clients -+# have NAT between them and the PPTP VPN server special packet handling must be performed. -+# This plugin loads the required Linux Kernel modules to handle that situation. -+# -+# No configuration options -+# ------------------------------------------------------------------------------ -diff --git a/share/arno-iptables-firewall/plugins/50pptp-vpn-passthrough.plugin b/share/arno-iptables-firewall/plugins/50pptp-vpn-passthrough.plugin -new file mode 100644 -index 0000000..379a1dd ---- /dev/null -+++ b/share/arno-iptables-firewall/plugins/50pptp-vpn-passthrough.plugin -@@ -0,0 +1,135 @@ -+# ------------------------------------------------------------------------------ -+# -= Arno's iptables firewall - PPTP VPN Passthrough plugin =- -+# -+PLUGIN_NAME="PPTP VPN Passthrough plugin" -+PLUGIN_VERSION="1.00" -+PLUGIN_CONF_FILE="pptp-vpn-passthrough.conf" -+# -+# Last changed : January 9, 2016 -+# Requirements : AIF 2.0.0+ and ip_nat_pptp -+# Comments : This plugin loads the required kernel modules for PPTP VPN Clients -+# to access remote PPTP VPN Server(s) when NAT is enabled. -+# -+# Author : (C) Copyright 2016 by Lonnie Abelbeck & Arno van Amersfoort -+# Homepage : http://rocky.eld.leidenuniv.nl/ -+# Email : a r n o v a AT r o c k y DOT e l d DOT l e i d e n u n i v DOT n l -+# (note: you must remove all spaces and substitute the @ and the . -+# at the proper locations!) -+# ------------------------------------------------------------------------------ -+# This program is free software; you can redistribute it and/or -+# modify it under the terms of the GNU General Public License -+# version 2 as published by the Free Software Foundation. -+# -+# This program is distributed in the hope that it will be useful, -+# but WITHOUT ANY WARRANTY; without even the implied warranty of -+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -+# GNU General Public License for more details. -+# -+# You should have received a copy of the GNU General Public License -+# along with this program; if not, write to the Free Software -+# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. -+# ------------------------------------------------------------------------------ -+ -+# Plugin start function -+plugin_start() -+{ -+ -+ if [ "$NAT" = "1" ]; then -+ echo "${INDENT}Enable PPTP NAT helper module" -+ modprobe_multi nf_nat_pptp ip_nat_pptp -+ else -+ echo "${INDENT}ERROR: NAT is not enabled, this plugin will be ignored." -+ fi -+ -+ return 0 -+} -+ -+ -+# Plugin restart function -+plugin_restart() -+{ -+ -+ # Skip plugin_stop on a restart -+ plugin_start -+ -+ return 0 -+} -+ -+ -+# Plugin stop function -+plugin_stop() -+{ -+ -+ if [ "$NAT" = "1" ]; then -+ if [ -e /proc/modules -a -x "$MODPROBE" ]; then -+ if ! $MODPROBE -r nf_nat_pptp >/dev/null 2>&1; then -+ $MODPROBE -r ip_nat_pptp >/dev/null 2>&1 -+ fi -+ if [ $? -eq 0 ]; then -+ echo "${INDENT}Disabled PPTP NAT helper module" -+ fi -+ fi -+ fi -+ -+ return 0 -+} -+ -+ -+# Plugin status function -+plugin_status() -+{ -+ return 0 -+} -+ -+ -+# Check sanity of eg. environment -+plugin_sanity_check() -+{ -+ return 0 -+} -+ -+ -+############ -+# Mainline # -+############ -+ -+# Check where to find the config file -+CONF_FILE="" -+if [ -n "$PLUGIN_CONF_PATH" ]; then -+ CONF_FILE="$PLUGIN_CONF_PATH/$PLUGIN_CONF_FILE" -+fi -+ -+# Preinit to success: -+PLUGIN_RET_VAL=0 -+ -+# Check if the config file exists -+if [ ! -e "$CONF_FILE" ]; then -+ printf "NOTE: Config file \"$CONF_FILE\" not found!\n Plugin \"$PLUGIN_NAME v$PLUGIN_VERSION\" ignored!\n" >&2 -+else -+ # Source the plugin config file -+ . "$CONF_FILE" -+ -+ if [ "$ENABLED" = "1" -a "$PLUGIN_CMD" != "stop-restart" ] || -+ [ "$ENABLED" = "0" -a "$PLUGIN_CMD" = "stop-restart" ] || -+ [ -n "$PLUGIN_LOAD_FILE" -a "$PLUGIN_CMD" = "stop" ] || -+ [ -n "$PLUGIN_LOAD_FILE" -a "$PLUGIN_CMD" = "status" ]; then -+ # Show who we are: -+ echo "${INDENT}$PLUGIN_NAME v$PLUGIN_VERSION" -+ -+ # Increment indention -+ INDENT="$INDENT " -+ -+ # Only proceed if environment ok -+ if ! plugin_sanity_check; then -+ PLUGIN_RET_VAL=1 -+ else -+ case $PLUGIN_CMD in -+ start|'') plugin_start; PLUGIN_RET_VAL=$? ;; -+ restart ) plugin_restart; PLUGIN_RET_VAL=$? ;; -+ stop|stop-restart) plugin_stop; PLUGIN_RET_VAL=$? ;; -+ status ) plugin_status; PLUGIN_RET_VAL=$? ;; -+ * ) PLUGIN_RET_VAL=1; printf "\033[40m\033[1;31m${INDENT}ERROR: Invalid plugin option \"$PLUGIN_CMD\"!\033[0m\n" >&2 ;; -+ esac -+ fi -+ fi -+fi -diff --git a/share/arno-iptables-firewall/plugins/pptp-vpn-passthrough.CHANGELOG b/share/arno-iptables-firewall/plugins/pptp-vpn-passthrough.CHANGELOG -new file mode 100644 -index 0000000..042b789 ---- /dev/null -+++ b/share/arno-iptables-firewall/plugins/pptp-vpn-passthrough.CHANGELOG -@@ -0,0 +1,4 @@ -+Version 1.00 (January 9, 2016) -+----------------------------------- -++ Initial version -+ - Modified: branches/1.0/package/arnofw/arnofw.serial =================================================================== --- branches/1.0/package/arnofw/arnofw.serial 2016-06-10 13:54:37 UTC (rev 7715) +++ branches/1.0/package/arnofw/arnofw.serial 2016-06-11 20:31:25 UTC (rev 7716) @@ -1 +1 @@ -0002~0026~0000~0000~0000~ +0002~0027~0000~0000~0000~ This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. |
From: <abe...@us...> - 2016-07-12 15:57:53
|
Revision: 7751 http://sourceforge.net/p/astlinux/code/7751 Author: abelbeck Date: 2016-07-12 15:57:50 +0000 (Tue, 12 Jul 2016) Log Message: ----------- arnofw, add support for new NAT_IF variable in AIF, tracks EXT_IF interfaces that are NAT'ed Modified Paths: -------------- branches/1.0/package/arnofw/arnofw.wrapper branches/1.0/package/arnofw/miniupnpd/50miniupnpd.plugin.sh Modified: branches/1.0/package/arnofw/arnofw.wrapper =================================================================== --- branches/1.0/package/arnofw/arnofw.wrapper 2016-07-11 13:55:09 UTC (rev 7750) +++ branches/1.0/package/arnofw/arnofw.wrapper 2016-07-12 15:57:50 UTC (rev 7751) @@ -160,17 +160,22 @@ if [ -z "$PPPOEIF" ]; then EXT_IF="" + NAT_IF="" unset IFS for intf in $EXTIF $EXT2IF; do EXT_IF="$EXT_IF${EXT_IF:+ }$intf" + NAT_IF="$NAT_IF${NAT_IF:+ }$intf" done else EXT_IF="${PPPOE_EXTIF:-ppp+}" + NAT_IF="${PPPOE_EXTIF:-ppp+}" unset IFS for intf in $EXTIF $EXT2IF; do case "$intf" in ppp[0-9]*) ;; - *) EXT_IF="$EXT_IF $intf" ;; + *) EXT_IF="$EXT_IF $intf" + NAT_IF="$NAT_IF $intf" + ;; esac done fi Modified: branches/1.0/package/arnofw/miniupnpd/50miniupnpd.plugin.sh =================================================================== --- branches/1.0/package/arnofw/miniupnpd/50miniupnpd.plugin.sh 2016-07-11 13:55:09 UTC (rev 7750) +++ branches/1.0/package/arnofw/miniupnpd/50miniupnpd.plugin.sh 2016-07-12 15:57:50 UTC (rev 7751) @@ -2,14 +2,14 @@ # -= Arno's iptables firewall - MiniUPnPd plugin =- # PLUGIN_NAME="MiniUPnPd plugin" -PLUGIN_VERSION="1.0" +PLUGIN_VERSION="1.01" PLUGIN_CONF_FILE="miniupnpd.conf" # -# Last changed : July 6, 2012 +# Last changed : July 12, 2016 # Requirements : AIF 2.0.0+ with miniupnpd daemon # Comments : Setup of the iptables chains that the miniupnpd daemon manages # -# Author : (C) Copyright 2012 by Lonnie Abelbeck & Arno van Amersfoort +# Author : (C) Copyright 2012-2016 by Lonnie Abelbeck & Arno van Amersfoort # Homepage : http://rocky.eld.leidenuniv.nl/ # Freshmeat homepage : http://freshmeat.net/projects/iptables-firewall/?topic_id=151 # Email : a r n o v a AT r o c k y DOT e l d DOT l e i d e n u n i v DOT n l @@ -67,7 +67,7 @@ # Reconnect both MINIUPNPD chains, flushed on a restart IFS=' ,' - for eif in $EXT_IF; do + for eif in ${NAT_IF:-$EXT_IF}; do ip4tables -t nat -A POST_NAT_PREROUTING_CHAIN -i $eif -j MINIUPNPD ip4tables -A POST_FORWARD_CHAIN -i $eif ! -o $eif -j MINIUPNPD @@ -89,7 +89,7 @@ fi IFS=' ,' - for eif in $EXT_IF; do + for eif in ${NAT_IF:-$EXT_IF}; do ip4tables -t nat -D POST_NAT_PREROUTING_CHAIN -i $eif -j MINIUPNPD ip4tables -D POST_FORWARD_CHAIN -i $eif ! -o $eif -j MINIUPNPD This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. |
From: <abe...@us...> - 2016-07-13 19:31:58
|
Revision: 7753 http://sourceforge.net/p/astlinux/code/7753 Author: abelbeck Date: 2016-07-13 19:31:55 +0000 (Wed, 13 Jul 2016) Log Message: ----------- arnofw, version bump to 2.0.1g-RC1, remove all our patches Modified Paths: -------------- branches/1.0/package/arnofw/arnofw.mk Removed Paths: ------------- branches/1.0/package/arnofw/arnofw-0001-do-not-reset-accept_ra.patch branches/1.0/package/arnofw/arnofw-0002-icmpv6-add-MLD-cleanup-logging.patch branches/1.0/package/arnofw/arnofw-0003-pptp-vpn-passthrough.patch branches/1.0/package/arnofw/arnofw-0004-add-LAN_LAN_FORWARD_CHAIN.patch branches/1.0/package/arnofw/arnofw-0005-add-LAN_DMZ_ALLOW_IF.patch Deleted: branches/1.0/package/arnofw/arnofw-0001-do-not-reset-accept_ra.patch =================================================================== --- branches/1.0/package/arnofw/arnofw-0001-do-not-reset-accept_ra.patch 2016-07-12 17:02:11 UTC (rev 7752) +++ branches/1.0/package/arnofw/arnofw-0001-do-not-reset-accept_ra.patch 2016-07-13 19:31:55 UTC (rev 7753) @@ -1,11 +0,0 @@ ---- arno-iptables-firewall_2.0.1f/bin/arno-iptables-firewall.orig 2015-10-30 15:52:23.000000000 -0500 -+++ arno-iptables-firewall_2.0.1f/bin/arno-iptables-firewall 2015-10-30 16:00:37.000000000 -0500 -@@ -495,7 +495,7 @@ - sysctl_set_all "net.ipv6.conf" "forwarding" 1 - echo " Disabling Local IPv6 Auto-Configuration" - sysctl_set_all "net.ipv6.conf" "autoconf" 0 -- sysctl_set_all "net.ipv6.conf" "accept_ra" 0 -+ ## Setting accept_ra=0 is not needed with forwarding=1, don't overwrite any existing accept_ra=2 values - fi - elif [ "$IP_FORWARDING" = "0" ]; then - echo " DISABLING packet forwarding" Deleted: branches/1.0/package/arnofw/arnofw-0002-icmpv6-add-MLD-cleanup-logging.patch =================================================================== --- branches/1.0/package/arnofw/arnofw-0002-icmpv6-add-MLD-cleanup-logging.patch 2016-07-12 17:02:11 UTC (rev 7752) +++ branches/1.0/package/arnofw/arnofw-0002-icmpv6-add-MLD-cleanup-logging.patch 2016-07-13 19:31:55 UTC (rev 7753) @@ -1,75 +0,0 @@ -From 7bd64927a401050769b7da18fd2ae52370cc2390 Mon Sep 17 00:00:00 2001 -From: Lonnie Abelbeck <lo...@ab...> -Date: Sat, 13 Feb 2016 16:16:16 -0600 -Subject: [PATCH] changed: added support for ICMPv6 Multicast Listener - Discovery, disabled by default with OPEN_ICMPV6_MLD=0. Additionally make sure - all un-needed ICMPv6 packets are dropped so they don't appear as annoying - logs, more common with native IPv6 support by ISP's. Thanks to David Kerr for - pointing out the issue and testing a solution. - ---- - bin/arno-iptables-firewall | 10 ++++++++++ - etc/arno-iptables-firewall/firewall.conf | 6 ++++++ - share/arno-iptables-firewall/environment | 4 ++++ - 3 files changed, 20 insertions(+) - -diff --git a/bin/arno-iptables-firewall b/bin/arno-iptables-firewall -index f5095a5..b02a85f 100755 ---- a/bin/arno-iptables-firewall -+++ b/bin/arno-iptables-firewall -@@ -4574,6 +4574,11 @@ setup_firewall_rules() - for icmpv6_type in $ICMPV6_SPECIAL_TYPES; do - ip6tables -A INPUT -i $interface -p icmpv6 --icmpv6-type $icmpv6_type -m hl --hl-eq 255 -j ACCEPT - done -+ if [ "$OPEN_ICMPV6_MLD" = "1" ]; then -+ for icmpv6_type in $ICMPV6_MLD_TYPES; do -+ ip6tables -A INPUT -i $interface -p icmpv6 --icmpv6-type $icmpv6_type -s fe80::/10 -m hl --hl-eq 1 -j ACCEPT -+ done -+ fi - fi - - # Apply external (internet) interface policy for the input chain: -@@ -4592,6 +4597,11 @@ setup_firewall_rules() - - # ICMP traffic (flood) - iptables -A INPUT -i $interface -p icmp -m state --state NEW -j EXT_ICMP_FLOOD_CHAIN -+ -+ # Drop any remaining ICMPv6 traffic -+ if [ "$IPV6_SUPPORT" = "1" ]; then -+ ip6tables -A INPUT -i $interface -p icmpv6 -j POST_INPUT_DROP_CHAIN -+ fi - done - - -diff --git a/etc/arno-iptables-firewall/firewall.conf b/etc/arno-iptables-firewall/firewall.conf -index 9e80e20..2291916 100644 ---- a/etc/arno-iptables-firewall/firewall.conf -+++ b/etc/arno-iptables-firewall/firewall.conf -@@ -1158,6 +1158,12 @@ OPEN_ICMP=0 - # ----------------------------------------------------------------------------- - OPEN_ICMPV6=1 - -+# Enable (1) to make the default policy allow IPv6 ICMPv6 -+# Multicast Listener Discovery (RFC 2710, 3810) for INET access -+# Note: Requires setting OPEN_ICMPV6=1 to apply. -+# ----------------------------------------------------------------------------- -+OPEN_ICMPV6_MLD=0 -+ - # Put in the following variables which ports or IP protocols you want to leave - # open to the whole world. - # ----------------------------------------------------------------------------- -diff --git a/share/arno-iptables-firewall/environment b/share/arno-iptables-firewall/environment -index 5728e4c..616c29c 100644 ---- a/share/arno-iptables-firewall/environment -+++ b/share/arno-iptables-firewall/environment -@@ -1698,6 +1698,10 @@ fi - ###################################################################### - ICMPV6_SPECIAL_TYPES="133 134 135 136" - -+# IPv6 ICMPv6 Multicast Listener Discovery (RFC 2710, 3810) -+###################################################################### -+ICMPV6_MLD_TYPES="130 131 132 143" -+ - # Check plugin bin path and fallback in case it's empty - ####################################################### - if [ -z "$PLUGIN_BIN_PATH" ]; then Deleted: branches/1.0/package/arnofw/arnofw-0003-pptp-vpn-passthrough.patch =================================================================== --- branches/1.0/package/arnofw/arnofw-0003-pptp-vpn-passthrough.patch 2016-07-12 17:02:11 UTC (rev 7752) +++ branches/1.0/package/arnofw/arnofw-0003-pptp-vpn-passthrough.patch 2016-07-13 19:31:55 UTC (rev 7753) @@ -1,186 +0,0 @@ -From ade2e3fd17771b861f97dd3adb5307e4da16dc4e Mon Sep 17 00:00:00 2001 -From: Lonnie Abelbeck <lo...@ab...> -Date: Sat, 9 Jan 2016 10:04:46 -0600 -Subject: [PATCH] added: PPTP VPN Passthrough plugin, Issue #27 - ---- - .../plugins/pptp-vpn-passthrough.conf | 14 +++ - .../plugins/50pptp-vpn-passthrough.plugin | 135 +++++++++++++++++++++ - .../plugins/pptp-vpn-passthrough.CHANGELOG | 4 + - 3 files changed, 153 insertions(+) - create mode 100644 etc/arno-iptables-firewall/plugins/pptp-vpn-passthrough.conf - create mode 100644 share/arno-iptables-firewall/plugins/50pptp-vpn-passthrough.plugin - create mode 100644 share/arno-iptables-firewall/plugins/pptp-vpn-passthrough.CHANGELOG - -diff --git a/etc/arno-iptables-firewall/plugins/pptp-vpn-passthrough.conf b/etc/arno-iptables-firewall/plugins/pptp-vpn-passthrough.conf -new file mode 100644 -index 0000000..250bc0d ---- /dev/null -+++ b/etc/arno-iptables-firewall/plugins/pptp-vpn-passthrough.conf -@@ -0,0 +1,14 @@ -+# ------------------------------------------------------------------------------ -+# -= Arno's iptables firewall - PPTP VPN Passthrough plugin =- -+# ------------------------------------------------------------------------------ -+ -+# To actually enable this plugin make ENABLED=1: -+# ------------------------------------------------------------------------------ -+ENABLED=0 -+ -+# PPTP uses the GRE protocol for transport, as such, when PPTP VPN clients -+# have NAT between them and the PPTP VPN server special packet handling must be performed. -+# This plugin loads the required Linux Kernel modules to handle that situation. -+# -+# No configuration options -+# ------------------------------------------------------------------------------ -diff --git a/share/arno-iptables-firewall/plugins/50pptp-vpn-passthrough.plugin b/share/arno-iptables-firewall/plugins/50pptp-vpn-passthrough.plugin -new file mode 100644 -index 0000000..379a1dd ---- /dev/null -+++ b/share/arno-iptables-firewall/plugins/50pptp-vpn-passthrough.plugin -@@ -0,0 +1,135 @@ -+# ------------------------------------------------------------------------------ -+# -= Arno's iptables firewall - PPTP VPN Passthrough plugin =- -+# -+PLUGIN_NAME="PPTP VPN Passthrough plugin" -+PLUGIN_VERSION="1.00" -+PLUGIN_CONF_FILE="pptp-vpn-passthrough.conf" -+# -+# Last changed : January 9, 2016 -+# Requirements : AIF 2.0.0+ and ip_nat_pptp -+# Comments : This plugin loads the required kernel modules for PPTP VPN Clients -+# to access remote PPTP VPN Server(s) when NAT is enabled. -+# -+# Author : (C) Copyright 2016 by Lonnie Abelbeck & Arno van Amersfoort -+# Homepage : http://rocky.eld.leidenuniv.nl/ -+# Email : a r n o v a AT r o c k y DOT e l d DOT l e i d e n u n i v DOT n l -+# (note: you must remove all spaces and substitute the @ and the . -+# at the proper locations!) -+# ------------------------------------------------------------------------------ -+# This program is free software; you can redistribute it and/or -+# modify it under the terms of the GNU General Public License -+# version 2 as published by the Free Software Foundation. -+# -+# This program is distributed in the hope that it will be useful, -+# but WITHOUT ANY WARRANTY; without even the implied warranty of -+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -+# GNU General Public License for more details. -+# -+# You should have received a copy of the GNU General Public License -+# along with this program; if not, write to the Free Software -+# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. -+# ------------------------------------------------------------------------------ -+ -+# Plugin start function -+plugin_start() -+{ -+ -+ if [ "$NAT" = "1" ]; then -+ echo "${INDENT}Enable PPTP NAT helper module" -+ modprobe_multi nf_nat_pptp ip_nat_pptp -+ else -+ echo "${INDENT}ERROR: NAT is not enabled, this plugin will be ignored." -+ fi -+ -+ return 0 -+} -+ -+ -+# Plugin restart function -+plugin_restart() -+{ -+ -+ # Skip plugin_stop on a restart -+ plugin_start -+ -+ return 0 -+} -+ -+ -+# Plugin stop function -+plugin_stop() -+{ -+ -+ if [ "$NAT" = "1" ]; then -+ if [ -e /proc/modules -a -x "$MODPROBE" ]; then -+ if ! $MODPROBE -r nf_nat_pptp >/dev/null 2>&1; then -+ $MODPROBE -r ip_nat_pptp >/dev/null 2>&1 -+ fi -+ if [ $? -eq 0 ]; then -+ echo "${INDENT}Disabled PPTP NAT helper module" -+ fi -+ fi -+ fi -+ -+ return 0 -+} -+ -+ -+# Plugin status function -+plugin_status() -+{ -+ return 0 -+} -+ -+ -+# Check sanity of eg. environment -+plugin_sanity_check() -+{ -+ return 0 -+} -+ -+ -+############ -+# Mainline # -+############ -+ -+# Check where to find the config file -+CONF_FILE="" -+if [ -n "$PLUGIN_CONF_PATH" ]; then -+ CONF_FILE="$PLUGIN_CONF_PATH/$PLUGIN_CONF_FILE" -+fi -+ -+# Preinit to success: -+PLUGIN_RET_VAL=0 -+ -+# Check if the config file exists -+if [ ! -e "$CONF_FILE" ]; then -+ printf "NOTE: Config file \"$CONF_FILE\" not found!\n Plugin \"$PLUGIN_NAME v$PLUGIN_VERSION\" ignored!\n" >&2 -+else -+ # Source the plugin config file -+ . "$CONF_FILE" -+ -+ if [ "$ENABLED" = "1" -a "$PLUGIN_CMD" != "stop-restart" ] || -+ [ "$ENABLED" = "0" -a "$PLUGIN_CMD" = "stop-restart" ] || -+ [ -n "$PLUGIN_LOAD_FILE" -a "$PLUGIN_CMD" = "stop" ] || -+ [ -n "$PLUGIN_LOAD_FILE" -a "$PLUGIN_CMD" = "status" ]; then -+ # Show who we are: -+ echo "${INDENT}$PLUGIN_NAME v$PLUGIN_VERSION" -+ -+ # Increment indention -+ INDENT="$INDENT " -+ -+ # Only proceed if environment ok -+ if ! plugin_sanity_check; then -+ PLUGIN_RET_VAL=1 -+ else -+ case $PLUGIN_CMD in -+ start|'') plugin_start; PLUGIN_RET_VAL=$? ;; -+ restart ) plugin_restart; PLUGIN_RET_VAL=$? ;; -+ stop|stop-restart) plugin_stop; PLUGIN_RET_VAL=$? ;; -+ status ) plugin_status; PLUGIN_RET_VAL=$? ;; -+ * ) PLUGIN_RET_VAL=1; printf "\033[40m\033[1;31m${INDENT}ERROR: Invalid plugin option \"$PLUGIN_CMD\"!\033[0m\n" >&2 ;; -+ esac -+ fi -+ fi -+fi -diff --git a/share/arno-iptables-firewall/plugins/pptp-vpn-passthrough.CHANGELOG b/share/arno-iptables-firewall/plugins/pptp-vpn-passthrough.CHANGELOG -new file mode 100644 -index 0000000..042b789 ---- /dev/null -+++ b/share/arno-iptables-firewall/plugins/pptp-vpn-passthrough.CHANGELOG -@@ -0,0 +1,4 @@ -+Version 1.00 (January 9, 2016) -+----------------------------------- -++ Initial version -+ - Deleted: branches/1.0/package/arnofw/arnofw-0004-add-LAN_LAN_FORWARD_CHAIN.patch =================================================================== --- branches/1.0/package/arnofw/arnofw-0004-add-LAN_LAN_FORWARD_CHAIN.patch 2016-07-12 17:02:11 UTC (rev 7752) +++ branches/1.0/package/arnofw/arnofw-0004-add-LAN_LAN_FORWARD_CHAIN.patch 2016-07-13 19:31:55 UTC (rev 7753) @@ -1,253 +0,0 @@ -diff --git a/README b/README -index 093151a..802ce61 100644 ---- a/README -+++ b/README -@@ -480,6 +480,7 @@ INT_FORWARD_IN_CHAIN - Internal-net FORWARD chain for INcoming traffic - INT_FORWARD_OUT_CHAIN - Internal-net FORWARD chain for OUTcoming traffic - INT_INPUT_CHAIN - Internal-net INPUT chain - INT_OUTPUT_CHAIN - Internal-net OUTPUT chain -+LAN_LAN_FORWARD_CHAIN - LAN to LAN (Inter-LAN) forward chain (AIF private use only) - LAN_INET_FORWARD_CHAIN - LAN to internet (external net) forward chain - POST_INPUT_CHAIN - This chain is always processed last(post) in the - INPUT chain -diff --git a/bin/arno-iptables-firewall b/bin/arno-iptables-firewall -index b02a85f..beee62d 100755 ---- a/bin/arno-iptables-firewall -+++ b/bin/arno-iptables-firewall -@@ -2263,6 +2263,79 @@ setup_int_input_chain() - } - - -+################################################## -+# Setup chain for the LAN-to-LAN forward traffic # -+################################################## -+setup_lan_lan_forward_chain() -+{ -+ local rtn_val=1 -+ -+ echo " Setting up LAN->LAN policy" -+ -+ # TCP ports to ALLOW for certain Inter-LAN hosts -+ ################################################ -+ unset IFS -+ for rule in $LAN_LAN_HOST_OPEN_TCP; do -+ if parse_rule "$rule" LAN_LAN_HOST_OPEN_TCP "shosts:ANYHOST-dhosts-ports:ANYPORT"; then -+ -+ echo " Allowing $shosts(LAN) to $dhosts(LAN) for TCP port(s): $ports" -+ -+ IFS=',' -+ for shost in `ip_range "$shosts"`; do -+ for dhost in `ip_range "$dhosts"`; do -+ for port in $ports; do -+ iptables -A LAN_LAN_FORWARD_CHAIN -s $shost -d $dhost -p tcp --dport $port -j ACCEPT -+ rtn_val=0 -+ done -+ done -+ done -+ fi -+ done -+ -+ # UDP ports to ALLOW for certain Inter-LAN hosts -+ ################################################ -+ unset IFS -+ for rule in $LAN_LAN_HOST_OPEN_UDP; do -+ if parse_rule "$rule" LAN_LAN_HOST_OPEN_UDP "shosts:ANYHOST-dhosts-ports:ANYPORT"; then -+ -+ echo " Allowing $shosts(LAN) to $dhosts(LAN) for UDP port(s): $ports" -+ -+ IFS=',' -+ for shost in `ip_range "$shosts"`; do -+ for dhost in `ip_range "$dhosts"`; do -+ for port in $ports; do -+ iptables -A LAN_LAN_FORWARD_CHAIN -s $shost -d $dhost -p udp --dport $port -j ACCEPT -+ rtn_val=0 -+ done -+ done -+ done -+ fi -+ done -+ -+ # IP protocol(s) to ALLOW for certain Inter-LAN hosts -+ ##################################################### -+ unset IFS -+ for rule in $LAN_LAN_HOST_OPEN_IP; do -+ if parse_rule "$rule" LAN_LAN_HOST_OPEN_IP "shosts:ANYHOST-dhosts-protos"; then -+ -+ echo " Allowing $shosts(LAN) to $dhosts(LAN) for IP protocol(s): $protos" -+ -+ IFS=',' -+ for shost in `ip_range "$shosts"`; do -+ for dhost in `ip_range "$dhosts"`; do -+ for proto in $protos; do -+ iptables -A LAN_LAN_FORWARD_CHAIN -s $shost -d $dhost -p $proto -j ACCEPT -+ rtn_val=0 -+ done -+ done -+ done -+ fi -+ done -+ -+ return $rtn_val -+} -+ -+ - ################################################### - # Setup chain for the LAN-to-INET forward traffic # - ################################################### -@@ -4803,7 +4876,10 @@ setup_firewall_rules() - echo " Logging of denied LAN->INET FORWARD connections disabled" - fi - -- # Setup helper chain for the LAN: -+ # Setup helper chains for the LAN: -+ setup_lan_lan_forward_chain; -+ lan_lan_forward_result=$? -+ - setup_lan_inet_forward_chain; - - IFS=' ,' -@@ -4813,10 +4889,20 @@ setup_firewall_rules() - # Always make subnets on the SAME interface trust each other - iptables -A FORWARD -i $iif -o $iif -j ACCEPT - -+ # Optimize by only adding to FORWARD if LAN_LAN_FORWARD_CHAIN contains rules -+ if [ $lan_lan_forward_result -eq 0 ]; then -+ for output_if in $INT_IF; do -+ if [ "$iif" != "$output_if" ]; then -+ iptables -A FORWARD -i $iif -o $output_if -j LAN_LAN_FORWARD_CHAIN -+ fi -+ done -+ fi -+ - for eif in $EXT_IF; do - iptables -A FORWARD -i $iif -o $eif -j LAN_INET_FORWARD_CHAIN - done - done -+ unset lan_lan_forward_result - fi - - -@@ -5035,6 +5121,7 @@ create_user_chains() - iptables -N DMZ_LAN_FORWARD_CHAIN - iptables -N INET_DMZ_FORWARD_CHAIN - iptables -N DMZ_INET_FORWARD_CHAIN -+ iptables -N LAN_LAN_FORWARD_CHAIN - iptables -N LAN_INET_FORWARD_CHAIN - - # Chains for the external interface -@@ -5091,6 +5178,7 @@ flush_user_chains() - iptables -F DMZ_LAN_FORWARD_CHAIN - iptables -F INET_DMZ_FORWARD_CHAIN - iptables -F DMZ_INET_FORWARD_CHAIN -+ iptables -F LAN_LAN_FORWARD_CHAIN - iptables -F LAN_INET_FORWARD_CHAIN - - # Chains for the external interface -diff --git a/etc/arno-iptables-firewall/firewall.conf b/etc/arno-iptables-firewall/firewall.conf -index 2291916..73554d2 100644 ---- a/etc/arno-iptables-firewall/firewall.conf -+++ b/etc/arno-iptables-firewall/firewall.conf -@@ -696,6 +696,40 @@ LAN_HOST_DENY_IP="" - - - ############################################################################### -+# LAN_LAN_xxx = LAN->LAN access rules (forward) # -+############################################################################### -+ -+# Put in the following variables which LAN hosts you want to allow to certain -+# hosts/services on a different LAN (net). -+# -+# TCP/UDP form: -+# "SRCIP1,SRCIP2,...>DESTIP1~port \ -+# SRCIP3,...>DESTIP2~port" -+# -+# IP form: -+# "SRCIP1,SRCIP2,...>DESTIP1~protocol \ -+# SRCIP3,...>DESTIP2~protocol" -+# -+# TCP/UDP examples: -+# Simple (Allow port 80 to LAN host 1.2.3.4 from all other LAN hosts(0/0)): -+# LAN_LAN_HOST_OPEN_xxx="0/0>1.2.3.4~80" -+# Advanced (Allow port 20 & 21 to LAN host 1.2.3.4 from all other LAN hosts (0/0) and -+# allow port 80 from LAN host 5.6.7.8 (only) to LAN host 1.2.3.4): -+# LAN_LAN_HOST_OPEN_xxx="0/0>1.2.3.4~20,21 5.6.7.8>1.2.3.4~80" -+# -+# IP protocol example: -+# (Allow protocols 47 & 48 to LAN host 1.2.3.4 from all other LAN hosts(0/0)): -+# LAN_LAN_HOST_OPEN_IP="0/0>1.2.3.4~47,48" -+# -+# NOTE 1: If no SRCIPx is specified, any source host is used -+# NOTE 2: If no port is specified, any port is used -+# ----------------------------------------------------------------------------- -+LAN_LAN_HOST_OPEN_TCP="" -+LAN_LAN_HOST_OPEN_UDP="" -+LAN_LAN_HOST_OPEN_IP="" -+ -+ -+############################################################################### - # LAN_INET_xxx = LAN->internet access rules (forward) # - # # - # Note that when the LAN_INET_OPEN_xxx & LAN_INET_HOST_OPEN_xxx variables are # - - -From dd4ac2ea35da58eb625a3e1bb87dc707044f13a6 Mon Sep 17 00:00:00 2001 -From: Lonnie Abelbeck <lo...@ab...> -Date: Wed, 22 Jun 2016 14:55:37 -0500 -Subject: [PATCH] removed: unused INT_FORWARD_IN_CHAIN and - INT_FORWARD_OUT_CHAIN user chains, related #28 - ---- - README | 2 -- - bin/arno-iptables-firewall | 12 ------------ - 2 files changed, 14 deletions(-) - -diff --git a/README b/README -index 802ce61..3f88069 100644 ---- a/README -+++ b/README -@@ -476,8 +476,6 @@ HOST_BLOCK_DST - Chain containing the list of destination based - blocked hosts - HOST_BLOCK_SRC - Chain containing the list of source based blocked - hosts --INT_FORWARD_IN_CHAIN - Internal-net FORWARD chain for INcoming traffic --INT_FORWARD_OUT_CHAIN - Internal-net FORWARD chain for OUTcoming traffic - INT_INPUT_CHAIN - Internal-net INPUT chain - INT_OUTPUT_CHAIN - Internal-net OUTPUT chain - LAN_LAN_FORWARD_CHAIN - LAN to LAN (Inter-LAN) forward chain (AIF private use only) -diff --git a/bin/arno-iptables-firewall b/bin/arno-iptables-firewall -index beee62d..99735ee 100755 ---- a/bin/arno-iptables-firewall -+++ b/bin/arno-iptables-firewall -@@ -4769,14 +4769,6 @@ setup_firewall_rules() - iptables -A FORWARD -o $eif -j EXT_FORWARD_OUT_CHAIN - done - -- # Source the IN/OUT chains for the internal interface(s) -- ######################################################## -- IFS=' ,' -- for iif in $INT_IF; do -- iptables -A FORWARD -i $iif -j INT_FORWARD_IN_CHAIN -- iptables -A FORWARD -o $iif -j INT_FORWARD_OUT_CHAIN -- done -- - # Source the IN/OUT chains for the dmz interface(s) - ######################################################## - IFS=' ,' -@@ -5135,8 +5127,6 @@ create_user_chains() - - # INT(LAN) chains - iptables -N INT_INPUT_CHAIN -- iptables -N INT_FORWARD_IN_CHAIN -- iptables -N INT_FORWARD_OUT_CHAIN - iptables -N INT_OUTPUT_CHAIN - - # DMZ chains -@@ -5192,8 +5182,6 @@ flush_user_chains() - - # INT(LAN) chains - iptables -F INT_INPUT_CHAIN -- iptables -F INT_FORWARD_IN_CHAIN -- iptables -F INT_FORWARD_OUT_CHAIN - iptables -F INT_OUTPUT_CHAIN - - # DMZ chains Deleted: branches/1.0/package/arnofw/arnofw-0005-add-LAN_DMZ_ALLOW_IF.patch =================================================================== --- branches/1.0/package/arnofw/arnofw-0005-add-LAN_DMZ_ALLOW_IF.patch 2016-07-12 17:02:11 UTC (rev 7752) +++ branches/1.0/package/arnofw/arnofw-0005-add-LAN_DMZ_ALLOW_IF.patch 2016-07-13 19:31:55 UTC (rev 7753) @@ -1,46 +0,0 @@ -diff --git a/bin/arno-iptables-firewall b/bin/arno-iptables-firewall -index 0cb5cba..d825c0b 100755 ---- a/bin/arno-iptables-firewall -+++ b/bin/arno-iptables-firewall -@@ -4814,6 +4814,8 @@ setup_firewall_rules() - setup_dmz_inet_forward_chain; - setup_dmz_lan_forward_chain; - -+ echo " Allowing LAN->DMZ for LAN interface(s): ${LAN_DMZ_ALLOW_IF:-$INT_IF}" -+ - IFS=' ,' - for dif in $DMZ_IF; do - echo "Applying DMZ FORWARD policy to interface: $dif" -@@ -4834,8 +4836,13 @@ setup_firewall_rules() - # Apply policy for DMZ->LAN - iptables -A FORWARD -i $dif -o $iif -j DMZ_LAN_FORWARD_CHAIN - -- # Apply policy for LAN->DMZ (allow all) -- iptables -A FORWARD -i $iif -o $dif -j ACCEPT -+ # Apply policy for LAN->DMZ (allow all INT_IF when LAN_DMZ_ALLOW_IF is not defined) -+ for interface in ${LAN_DMZ_ALLOW_IF:-$INT_IF}; do -+ if [ "$iif" = "$interface" ]; then -+ iptables -A FORWARD -i $iif -o $dif -j ACCEPT -+ break -+ fi -+ done - done - done - fi -diff --git a/etc/arno-iptables-firewall/firewall.conf b/etc/arno-iptables-firewall/firewall.conf -index 83ef1dc..6d3bd19 100644 ---- a/etc/arno-iptables-firewall/firewall.conf -+++ b/etc/arno-iptables-firewall/firewall.conf -@@ -125,6 +125,12 @@ DMZ_IF="" - # ----------------------------------------------------------------------------- - DMZ_NET="" - -+# Specify the LAN (INT_IF) interfaces that are allowed full access to the -+# DMZ interface(s). (LAN to DMZ forwarding policy) -+# If LAN_DMZ_ALLOW_IF is not defined, all the INT_IF interfaces will be allowed. -+# ----------------------------------------------------------------------------- -+LAN_DMZ_ALLOW_IF="" -+ - # Set this variable to 0 to disable antispoof checking for the dmz nets - # (EXPERT SETTING!) - # ----------------------------------------------------------------------------- Modified: branches/1.0/package/arnofw/arnofw.mk =================================================================== --- branches/1.0/package/arnofw/arnofw.mk 2016-07-12 17:02:11 UTC (rev 7752) +++ branches/1.0/package/arnofw/arnofw.mk 2016-07-13 19:31:55 UTC (rev 7753) @@ -3,11 +3,11 @@ # Arno's IPtables Firewall Script # ############################################################# -ARNOFW_VER := 2.0.1f +ARNOFW_VER := 2.0.1g-RC1 ARNOFW_ROOT := arno-iptables-firewall ARNOFW_SOURCE := $(ARNOFW_ROOT)_$(ARNOFW_VER).tar.gz -ARNOFW_SITE := http://rocky.eld.leidenuniv.nl/arno-iptables-firewall -#ARNOFW_SITE := http://files.astlinux-project.org +#ARNOFW_SITE := http://rocky.eld.leidenuniv.nl/arno-iptables-firewall +ARNOFW_SITE := http://files.astlinux-project.org ARNOFW_DIR := $(BUILD_DIR)/$(ARNOFW_ROOT)_$(ARNOFW_VER) ARNOFW_CAT := zcat ARNOFW_TARGET_BINARY := /usr/sbin/arno-iptables-firewall This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. |
From: <abe...@us...> - 2016-09-10 16:31:30
|
Revision: 7828 http://sourceforge.net/p/astlinux/code/7828 Author: abelbeck Date: 2016-09-10 16:31:27 +0000 (Sat, 10 Sep 2016) Log Message: ----------- arnofw, version bump to 2.0.1g-RC2, added support for 'ipset' Modified Paths: -------------- branches/1.0/package/arnofw/arnofw.mk branches/1.0/package/arnofw/arnofw.wrapper Modified: branches/1.0/package/arnofw/arnofw.mk =================================================================== --- branches/1.0/package/arnofw/arnofw.mk 2016-09-09 17:09:18 UTC (rev 7827) +++ branches/1.0/package/arnofw/arnofw.mk 2016-09-10 16:31:27 UTC (rev 7828) @@ -3,7 +3,7 @@ # Arno's IPtables Firewall Script # ############################################################# -ARNOFW_VER := 2.0.1g-RC1 +ARNOFW_VER := 2.0.1g-RC2 ARNOFW_ROOT := arno-iptables-firewall ARNOFW_SOURCE := $(ARNOFW_ROOT)_$(ARNOFW_VER).tar.gz #ARNOFW_SITE := http://rocky.eld.leidenuniv.nl/arno-iptables-firewall Modified: branches/1.0/package/arnofw/arnofw.wrapper =================================================================== --- branches/1.0/package/arnofw/arnofw.wrapper 2016-09-09 17:09:18 UTC (rev 7827) +++ branches/1.0/package/arnofw/arnofw.wrapper 2016-09-10 16:31:27 UTC (rev 7828) @@ -155,6 +155,8 @@ { local intf lan lans extCIDR ovpnIF ovpnIP ovpnNM allowif allowifs denyif count IFS + IPTABLES_IPSET=1 + MANGLE_TOS=0 if [ "$IPV6" = "yes" ]; then This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. |
From: <abe...@us...> - 2016-09-14 18:15:58
|
Revision: 7832 http://sourceforge.net/p/astlinux/code/7832 Author: abelbeck Date: 2016-09-14 18:15:56 +0000 (Wed, 14 Sep 2016) Log Message: ----------- arnofw, version bump to 2.0.1g-RC3, added BLOCK_NETSET_DIR which efficiently creates ipset's for blocklists using .netset files. Additionally added reload-blocklist-netset script to generate the .netset files Modified Paths: -------------- branches/1.0/package/arnofw/arnofw.mk Added Paths: ----------- branches/1.0/package/arnofw/reload-blocklist-netset Removed Paths: ------------- branches/1.0/package/arnofw/arnofw-0001-handle-ipset-errors.patch Deleted: branches/1.0/package/arnofw/arnofw-0001-handle-ipset-errors.patch =================================================================== --- branches/1.0/package/arnofw/arnofw-0001-handle-ipset-errors.patch 2016-09-11 19:08:52 UTC (rev 7831) +++ branches/1.0/package/arnofw/arnofw-0001-handle-ipset-errors.patch 2016-09-14 18:15:56 UTC (rev 7832) @@ -1,81 +0,0 @@ -From d06e18113b683ff6b19810eae25db5e4dd11ce2e Mon Sep 17 00:00:00 2001 -From: Lonnie Abelbeck <lo...@ab...> -Date: Sun, 11 Sep 2016 13:26:55 -0500 -Subject: [PATCH] added: handle errors for ipset BLOCK_HOSTS and - BLOCK_HOSTS_FILE - ---- - bin/arno-iptables-firewall | 30 +++++++++++++++++++++++++++--- - 1 file changed, 27 insertions(+), 3 deletions(-) - -diff --git a/bin/arno-iptables-firewall b/bin/arno-iptables-firewall -index aacf489..0e8739b 100755 ---- a/bin/arno-iptables-firewall -+++ b/bin/arno-iptables-firewall -@@ -4158,7 +4158,7 @@ setup_output_log() - ###################################### - setup_hostblock_chain() - { -- local hashsize maxelem -+ local hashsize maxelem swap4_err=0 swap6_err=0 - - if iptables -F HOST_BLOCK_SRC 2>&1 |grep -q "No chain" || \ - iptables -F HOST_BLOCK_DST 2>&1 |grep -q "No chain"; then -@@ -4216,10 +4216,18 @@ if ipset_check; then - case $? in - 4) - ipset add -exist aif_blocklist_tmp $host -+ if [ $? -ne 0 ]; then -+ swap4_err=1 -+ RULE_WARNING=$((RULE_WARNING + 1)) -+ fi - ;; - 6) - if [ "$IPV6_SUPPORT" = "1" ]; then - ipset add -exist aif_blocklist6_tmp $host -+ if [ $? -ne 0 ]; then -+ swap6_err=1 -+ RULE_WARNING=$((RULE_WARNING + 1)) -+ fi - fi - ;; - esac -@@ -4273,9 +4281,17 @@ if ipset_check; then - echo "$total_cnt host line(s) read" - - ipset restore < "$IP4TABLES_BATCH_FILE" -+ if [ $? -ne 0 ]; then -+ swap4_err=1 -+ RULE_WARNING=$((RULE_WARNING + 1)) -+ fi - rm -f "$IP4TABLES_BATCH_FILE" - if [ "$IPV6_SUPPORT" = "1" ]; then - ipset restore < "$IP6TABLES_BATCH_FILE" -+ if [ $? -ne 0 ]; then -+ swap6_err=1 -+ RULE_WARNING=$((RULE_WARNING + 1)) -+ fi - rm -f "$IP6TABLES_BATCH_FILE" - fi - else -@@ -4283,10 +4299,18 @@ if ipset_check; then - fi - fi - -- ipset swap aif_blocklist aif_blocklist_tmp -+ if [ $swap4_err -eq 0 ]; then -+ ipset swap aif_blocklist aif_blocklist_tmp -+ else -+ printf "\033[40m\033[1;31mERROR: IPv4 \"ipset swap ...\" not applied.\033[0m\n" >&2 -+ fi - ipset destroy aif_blocklist_tmp - if [ "$IPV6_SUPPORT" = "1" ]; then -- ipset swap aif_blocklist6 aif_blocklist6_tmp -+ if [ $swap6_err -eq 0 ]; then -+ ipset swap aif_blocklist6 aif_blocklist6_tmp -+ else -+ printf "\033[40m\033[1;31mERROR: IPv6 \"ipset swap ...\" not applied.\033[0m\n" >&2 -+ fi - ipset destroy aif_blocklist6_tmp - fi - else Modified: branches/1.0/package/arnofw/arnofw.mk =================================================================== --- branches/1.0/package/arnofw/arnofw.mk 2016-09-11 19:08:52 UTC (rev 7831) +++ branches/1.0/package/arnofw/arnofw.mk 2016-09-14 18:15:56 UTC (rev 7832) @@ -3,7 +3,7 @@ # Arno's IPtables Firewall Script # ############################################################# -ARNOFW_VER := 2.0.1g-RC2 +ARNOFW_VER := 2.0.1g-RC3 ARNOFW_ROOT := arno-iptables-firewall ARNOFW_SOURCE := $(ARNOFW_ROOT)_$(ARNOFW_VER).tar.gz #ARNOFW_SITE := http://rocky.eld.leidenuniv.nl/arno-iptables-firewall @@ -64,6 +64,8 @@ $(TARGET_DIR)$(ARNOFW_CONFIG_SHIM) $(INSTALL) -D -m 0755 package/arnofw/reload-spamhaus-drop \ $(TARGET_DIR)/usr/sbin/reload-spamhaus-drop + $(INSTALL) -D -m 0755 package/arnofw/reload-blocklist-netset \ + $(TARGET_DIR)/usr/sbin/reload-blocklist-netset @rm -f $(TARGET_DIR)$(ARNOFW_PLUGIN_SCRIPT_DIR)/*.CHANGELOG @echo @echo "Remove plugins that don't apply." Added: branches/1.0/package/arnofw/reload-blocklist-netset =================================================================== --- branches/1.0/package/arnofw/reload-blocklist-netset (rev 0) +++ branches/1.0/package/arnofw/reload-blocklist-netset 2016-09-14 18:15:56 UTC (rev 7832) @@ -0,0 +1,173 @@ +#!/bin/sh +## +## reload-blocklist-netset +## +## Cron may be used to run this script once or twice every day. Example: +## 05 05,15 * * * reload-blocklist-netset /mnt/kd/blocklists firehol_level1 spamhaus_dropv6 >/dev/null 2>&1 +## +## Multiple netset entries may be space or comma separated. +## +## In this example, a /mnt/kd/blocklists/firehol_level1.netset +## and a /mnt/kd/blocklists/spamhaus_dropv6.netset file will be created. +## Note: The specified directory must pre-exist, it will not be created. +## +## This script prevents any netset from being updated more often than +## the defined 'AGE' value. +## + +DIR="$1" + +UPDATES=0 + +list_netsets() +{ + cat <<EOF + +Available IPv4 Blocklist Netsets: + firehol_level1: Blacklist composed from IP lists, providing maximum protection with minimum false positives. + firehol_level2: Blacklist that track attacks, during about the last 48 hours. + firehol_level3: Blacklist that track attacks, spyware, viruses, reported or detected in the last 30 days. + spamhaus_drop: Spamhaus DROP (Don't Route Or Peer), consisting of netblocks that are "hijacked" by cyber-crime operations. + spamhaus_edrop: Spamhaus EDROP is an extension of the DROP list that includes suballocated netblocks. + +Available IPv6 Blocklist Netsets: +spamhaus_dropv6: Spamhaus DROPv6 list includes IPv6 ranges allocated to spammers or cyber criminals. + +EOF +} + +netset_url() +{ + local netset="$1" + + case $netset in + ## IPv4 + firehol_level1) + URL="https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/firehol_level1.netset" + ALT_URL="" + AGE=3600 + ;; + firehol_level2) + URL="https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/firehol_level2.netset" + ALT_URL="" + AGE=3600 + ;; + firehol_level3) + URL="https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/firehol_level3.netset" + ALT_URL="" + AGE=3600 + ;; + spamhaus_drop) + URL="https://www.spamhaus.org/drop/drop.txt" + ALT_URL="https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/spamhaus_drop.netset" + AGE=43200 + ;; + spamhaus_edrop) + URL="https://www.spamhaus.org/drop/edrop.txt" + ALT_URL="https://raw.githubusercontent.com/firehol/blocklist-ipsets/master/spamhaus_edrop.netset" + AGE=43200 + ;; + + ## IPv6 + spamhaus_dropv6) + URL="https://www.spamhaus.org/drop/dropv6.txt" + ALT_URL="" + AGE=43200 + ;; + + *) + URL="" + ALT_URL="" + AGE=0 + ;; + esac +} + +download_file() +{ + local file="$1" url="$2" + + curl -sSfL --globoff --retry 1 --connect-timeout 15 --max-time 1800 -o "$file" "$url" >/dev/null +} + +valid_update_age() +{ + local netset="$1" age="$2" file + + file="$DIR/$netset.netset" + + if [ -f "$file" ]; then + if [ $(( $(date +%s) - $(date -r "$file" +%s) )) -lt $age ]; then + return 1 + fi + fi + return 0 +} + +blocklist_netset() +{ + local netset tmp_file count mesg IFS + + IFS=' ,' + for netset in $*; do + unset IFS + netset_url $netset + if [ -z "$URL" ]; then + echo "reload-blocklist-netset: Unknown Netset: $netset" >&2 + continue + fi + if ! valid_update_age $netset $AGE; then + echo "reload-blocklist-netset: The file '$netset.netset' has been updated within $AGE seconds, skipping." >&2 + continue + fi + tmp_file="$(mktemp "/tmp/reload_blocklist.XXXXXX")" + if ! download_file "$tmp_file" "$URL"; then + if [ -z "$ALT_URL" ] || ! download_file "$tmp_file" "$ALT_URL"; then + rm -f "$tmp_file" + mesg="Retrieving '$netset' netset failed for '$URL', skipping." + logger -s -t reload-blocklist-netset -p kern.info "$mesg" + continue + fi + fi + if grep -q -i -e '^<!DOCTYPE HTML' -e '^<HTML' "$tmp_file"; then + rm -f "$tmp_file" + mesg="Netset '$netset' text format is invalid for '$URL', skipping." + logger -s -t reload-blocklist-netset -p kern.info "$mesg" + continue + fi + + cp "$tmp_file" "$DIR/$netset.netset" + rm -f "$tmp_file" + UPDATES=$((UPDATES + 1)) + + count=$(grep -c '^[1-9a-fA-F]' "$DIR/$netset.netset") + mesg="Netset '$netset' has been updated. Contains $count addresses/nets." + logger -t reload-blocklist-netset -p kern.info "$mesg" + echo "$mesg" + done +} + +if [ -z "$DIR" ]; then + echo "Usage: reload-blocklist-netset netset_dir netset_1 [ netset_2 ... ]" + list_netsets + exit 1 +fi + +if [ ! -d "$DIR" ]; then + echo "reload-blocklist-netset: Directory not found: $DIR" + exit 1 +fi + +shift 1 + +if [ -z "$1" ]; then + list_netsets + exit 1 +fi + +blocklist_netset "$@" + +if [ $UPDATES -gt 0 ]; then + arno-iptables-firewall force-reload +fi + Property changes on: branches/1.0/package/arnofw/reload-blocklist-netset ___________________________________________________________________ Added: svn:executable ## -0,0 +1 ## +* \ No newline at end of property This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. |
From: <abe...@us...> - 2016-09-23 15:23:55
|
Revision: 7860 http://sourceforge.net/p/astlinux/code/7860 Author: abelbeck Date: 2016-09-23 15:23:53 +0000 (Fri, 23 Sep 2016) Log Message: ----------- arnofw, version bump to 2.0.1g-RC7, minor tweaks Modified Paths: -------------- branches/1.0/package/arnofw/arnofw.mk branches/1.0/package/arnofw/arnofw.serial Modified: branches/1.0/package/arnofw/arnofw.mk =================================================================== --- branches/1.0/package/arnofw/arnofw.mk 2016-09-22 18:17:07 UTC (rev 7859) +++ branches/1.0/package/arnofw/arnofw.mk 2016-09-23 15:23:53 UTC (rev 7860) @@ -3,7 +3,7 @@ # Arno's IPtables Firewall Script # ############################################################# -ARNOFW_VER := 2.0.1g-RC6 +ARNOFW_VER := 2.0.1g-RC7 ARNOFW_ROOT := arno-iptables-firewall ARNOFW_SOURCE := $(ARNOFW_ROOT)_$(ARNOFW_VER).tar.gz #ARNOFW_SITE := http://rocky.eld.leidenuniv.nl/arno-iptables-firewall Modified: branches/1.0/package/arnofw/arnofw.serial =================================================================== --- branches/1.0/package/arnofw/arnofw.serial 2016-09-22 18:17:07 UTC (rev 7859) +++ branches/1.0/package/arnofw/arnofw.serial 2016-09-23 15:23:53 UTC (rev 7860) @@ -1 +1 @@ -0002~0027~0000~0000~0000~ +0002~0028~0000~0000~0000~ This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. |
From: <abe...@us...> - 2016-11-19 15:20:07
|
Revision: 7967 http://sourceforge.net/p/astlinux/code/7967 Author: abelbeck Date: 2016-11-19 15:20:05 +0000 (Sat, 19 Nov 2016) Log Message: ----------- arnofw, for strongswan IPsec (VPN contains ipsec) add new rc.conf variables: IPSEC_ALLOWED_ENDPOINTS and IPSEC_ALLOWED_VPN_NETS Modified Paths: -------------- branches/1.0/package/arnofw/arnofw.serial branches/1.0/package/arnofw/ipsec-vpn-astlinux.conf Modified: branches/1.0/package/arnofw/arnofw.serial =================================================================== --- branches/1.0/package/arnofw/arnofw.serial 2016-11-19 13:15:07 UTC (rev 7966) +++ branches/1.0/package/arnofw/arnofw.serial 2016-11-19 15:20:05 UTC (rev 7967) @@ -1 +1 @@ -0002~0029~0000~0000~0000~ +0002~0030~0000~0000~0000~ Modified: branches/1.0/package/arnofw/ipsec-vpn-astlinux.conf =================================================================== --- branches/1.0/package/arnofw/ipsec-vpn-astlinux.conf 2016-11-19 13:15:07 UTC (rev 7966) +++ branches/1.0/package/arnofw/ipsec-vpn-astlinux.conf 2016-11-19 15:20:05 UTC (rev 7967) @@ -67,8 +67,8 @@ if [ $vpntype_ipsec -eq 1 ]; then ENABLED=1 - IPSEC_ALLOWED_HOSTS="0/0" - IPSEC_VPN_NETS="" + IPSEC_ALLOWED_HOSTS="${IPSEC_ALLOWED_ENDPOINTS:-0/0}" + IPSEC_VPN_NETS="$IPSEC_ALLOWED_VPN_NETS" IPSEC_NAT_TRAVERSAL=1 fi This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. |
From: <abe...@us...> - 2017-05-09 14:07:45
|
Revision: 8291 http://sourceforge.net/p/astlinux/code/8291 Author: abelbeck Date: 2017-05-09 14:07:42 +0000 (Tue, 09 May 2017) Log Message: ----------- arnofw, add support for EXT_IF_DHCPV6_IPV6 config variable, AIF Issue #34 Modified Paths: -------------- branches/1.0/package/arnofw/arnofw.wrapper Added Paths: ----------- branches/1.0/package/arnofw/arnofw-0002-EXT_IF_DHCPV6_IPV6.patch Added: branches/1.0/package/arnofw/arnofw-0002-EXT_IF_DHCPV6_IPV6.patch =================================================================== --- branches/1.0/package/arnofw/arnofw-0002-EXT_IF_DHCPV6_IPV6.patch (rev 0) +++ branches/1.0/package/arnofw/arnofw-0002-EXT_IF_DHCPV6_IPV6.patch 2017-05-09 14:07:42 UTC (rev 8291) @@ -0,0 +1,39 @@ +diff --git a/bin/arno-iptables-firewall b/bin/arno-iptables-firewall +index 50b024c..1ee713f 100755 +--- a/bin/arno-iptables-firewall ++++ b/bin/arno-iptables-firewall +@@ -2698,9 +2698,11 @@ setup_ext_input_chain() + echo " Enabling support for DHCP-assigned-IP (DHCP client)" + # Allow this host to be an DHCP client: + ip4tables -A EXT_INPUT_CHAIN -p udp --sport 67 --dport 68 -j ACCEPT ++ fi ++ if [ "$EXT_IF_DHCP_IP" = "1" -o "$EXT_IF_DHCPV6_IPV6" = "1" ]; then + if [ "$IPV6_SUPPORT" = "1" ]; then + # Allow this host to be an DHCPv6 client: +- ip6tables -A EXT_INPUT_CHAIN -p udp --sport 547 --dport 546 -j ACCEPT ++ ip6tables -A EXT_INPUT_CHAIN -s fe80::/10 -p udp --sport 547 --dport 546 -j ACCEPT + fi + fi + +diff --git a/etc/arno-iptables-firewall/firewall.conf b/etc/arno-iptables-firewall/firewall.conf +index e3c8894..766cbdd 100644 +--- a/etc/arno-iptables-firewall/firewall.conf ++++ b/etc/arno-iptables-firewall/firewall.conf +@@ -39,10 +39,16 @@ + EXT_IF="" + + # Enable if THIS machines (dynamically) obtains its IP through (IPv4) DHCP +-# and/or (IPv6) DHCPv6 (from your ISP) ++# and possibly (IPv6) DHCPv6 (from your ISP) + # ------------------------------------------------------------------------------ + EXT_IF_DHCP_IP=0 + ++# Enable if THIS machines (dynamically) obtains its IP through (IPv6) DHCPv6 ++# and not (IPv4) DHCP. Applies only when EXT_IF_DHCP_IP is set to "0". ++# (IPv6 Only) ++# ------------------------------------------------------------------------------ ++EXT_IF_DHCPV6_IPV6=0 ++ + # (EXPERT SETTING!) Here you can override your external(!) IPv4 subnet(s). + # Normally these are (attempted to be) autodetected, so leaving this empty + # should work for most scenarios. This setting is used when eg. running a DHCP Modified: branches/1.0/package/arnofw/arnofw.wrapper =================================================================== --- branches/1.0/package/arnofw/arnofw.wrapper 2017-05-09 00:57:44 UTC (rev 8290) +++ branches/1.0/package/arnofw/arnofw.wrapper 2017-05-09 14:07:42 UTC (rev 8291) @@ -222,11 +222,20 @@ fi EXT_IF_DHCP_IP=0 - if [ -n "$EXTIF" -a -z "$EXTIP" ] && [ "$EXTIF" != "ppp0" -o -z "$PPPOEIF" ]; then - EXT_IF_DHCP_IP=1 + EXT_IF_DHCPV6_IPV6=0 + if [ -n "$EXTIF" ] && [ "$EXTIF" != "ppp0" -o -z "$PPPOEIF" ]; then + if [ -z "$EXTIP" ]; then + EXT_IF_DHCP_IP=1 + elif [ "$IPV6" = "yes" -a "$DHCPV6_CLIENT_ENABLE" = "yes" ]; then + EXT_IF_DHCPV6_IPV6=1 + fi fi - if [ -n "$EXT2IF" -a -z "$EXT2IP" ] && [ "$EXT2IF" != "ppp0" -o -z "$PPPOEIF" ]; then - EXT_IF_DHCP_IP=1 + if [ -n "$EXT2IF" ] && [ "$EXT2IF" != "ppp0" -o -z "$PPPOEIF" ]; then + if [ -z "$EXT2IP" ]; then + EXT_IF_DHCP_IP=1 + elif [ "$IPV6" = "yes" -a "$EXT2DHCPV6_CLIENT_ENABLE" = "yes" ]; then + EXT_IF_DHCPV6_IPV6=1 + fi fi if [ "$EXTDHCP" = "yes" -a -n "$EXTIP" -a -n "$EXTGW" -a -z "$EXT2IF" -a -z "$PPPOEIF" ]; then This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. |
From: <abe...@us...> - 2017-05-29 16:04:50
|
Revision: 8353 http://sourceforge.net/p/astlinux/code/8353 Author: abelbeck Date: 2017-05-29 16:04:48 +0000 (Mon, 29 May 2017) Log Message: ----------- arnofw, add 'Network Prefix Translation' plugin (NPTv6) Modified Paths: -------------- branches/1.0/package/arnofw/arnofw.mk branches/1.0/package/arnofw/arnofw.serial Added Paths: ----------- branches/1.0/package/arnofw/net-prefix-translation/ branches/1.0/package/arnofw/net-prefix-translation/20net-prefix-translation.plugin.sh branches/1.0/package/arnofw/net-prefix-translation/net-prefix-translation.conf Modified: branches/1.0/package/arnofw/arnofw.mk =================================================================== --- branches/1.0/package/arnofw/arnofw.mk 2017-05-28 18:37:02 UTC (rev 8352) +++ branches/1.0/package/arnofw/arnofw.mk 2017-05-29 16:04:48 UTC (rev 8353) @@ -163,6 +163,13 @@ $(TARGET_DIR)$(ARNOFW_PLUGIN_SCRIPT_DIR)/50miniupnpd.plugin $(INSTALL) -m 0644 package/arnofw/miniupnpd/miniupnpd-astlinux.conf \ $(TARGET_DIR)/stat$(ARNOFW_PLUGIN_CONFIG_DIR)/miniupnpd.conf + @echo + @echo "Install local version of net-prefix-translation plugin." + @echo + $(INSTALL) -m 0644 package/arnofw/net-prefix-translation/20net-prefix-translation.plugin.sh \ + $(TARGET_DIR)$(ARNOFW_PLUGIN_SCRIPT_DIR)/20net-prefix-translation.plugin + $(INSTALL) -m 0644 package/arnofw/net-prefix-translation/net-prefix-translation.conf \ + $(TARGET_DIR)/stat$(ARNOFW_PLUGIN_CONFIG_DIR)/net-prefix-translation.conf arnofw: $(TARGET_DIR)$(ARNOFW_TARGET_BINARY) Modified: branches/1.0/package/arnofw/arnofw.serial =================================================================== --- branches/1.0/package/arnofw/arnofw.serial 2017-05-28 18:37:02 UTC (rev 8352) +++ branches/1.0/package/arnofw/arnofw.serial 2017-05-29 16:04:48 UTC (rev 8353) @@ -1 +1 @@ -0002~0032~0000~0000~0000~ +0002~0033~0000~0000~0000~ Added: branches/1.0/package/arnofw/net-prefix-translation/20net-prefix-translation.plugin.sh =================================================================== --- branches/1.0/package/arnofw/net-prefix-translation/20net-prefix-translation.plugin.sh (rev 0) +++ branches/1.0/package/arnofw/net-prefix-translation/20net-prefix-translation.plugin.sh 2017-05-29 16:04:48 UTC (rev 8353) @@ -0,0 +1,286 @@ +# ------------------------------------------------------------------------------ +# -= Arno's iptables firewall - Network Prefix Translation plugin =- +# +PLUGIN_NAME="Network Prefix Translation plugin" +PLUGIN_VERSION="1.00" +PLUGIN_CONF_FILE="net-prefix-translation.conf" +# +# Last changed : May 28, 2017 +# Requirements : AIF 2.0.1g+, ip6tables NETMAP support +# Comments : NPTv6 (Network Prefix Translation) for IPv6 +# Perform a 1:1 mapping of ULA <-> GUA prefixes +# via the external interface. +# +# Author : (C) Copyright 2017 by Lonnie Abelbeck & Arno van Amersfoort +# Homepage : http://rocky.eld.leidenuniv.nl/ +# Email : a r n o v a AT r o c k y DOT e l d DOT l e i d e n u n i v DOT n l +# (note: you must remove all spaces and substitute the @ and the . +# at the proper locations!) +# ------------------------------------------------------------------------------ +# This program is free software; you can redistribute it and/or +# modify it under the terms of the GNU General Public License +# version 2 as published by the Free Software Foundation. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. +# ------------------------------------------------------------------------------ + +NET_PREFIX_TRANSLATION_GLOBAL_IPV6="/var/tmp/aif-net-prefix-translation-global-ipv6" + +net_prefix_translation_global_ipv6() +{ + local lan IFS + + IFS=' ,' + for lan in $NET_PREFIX_TRANSLATION_IF; do + ip -6 -o addr show dev $lan scope global 2>/dev/null \ + | awk '$3 == "inet6" { print $4; }' + done +} + +net_prefix_translation_global_prefix() +{ + local global_prefix prefix len cut_chars prefix_label prefix_len ipv6 ipv6_ex IFS + + global_prefix="" + if [ -n "$NET_PREFIX_TRANSLATION_IF" ]; then + prefix_len="$(echo "$NET_PREFIX_TRANSLATION_GLOBAL_PREFIX" | cut -s -d'/' -f2)" + case $prefix_len in + 64) cut_chars="1-19" + prefix_label="::/64" + ;; + 60) cut_chars="1-18" + prefix_label="0::/60" + ;; + 56) cut_chars="1-17" + prefix_label="00::/56" + ;; + 52) cut_chars="1-16" + prefix_label="000::/52" + ;; + 48) cut_chars="1-15" + prefix_label="0000::/48" + ;; + *) cut_chars="" + prefix_label="" + ;; + esac + + if [ -n "$cut_chars" -a -n "$prefix_label" ]; then + unset IFS + for prefix in $(net_prefix_translation_global_ipv6); do + len="$(echo "$prefix" | sed -n -r -e 's/^[0-9a-fA-F:]+\/([0-9]+)$/\1/p')" + if [ -n "$len" ]; then + if [ $len -ge 32 -a $len -le 64 ]; then + ipv6="$(echo "$prefix" | cut -d'/' -f1)" + ipv6_ex="$(netcalc "$ipv6" | sed -n -r -e 's/^Expanded IPv6 *: *([0-9a-fA-F:]+).*$/\1/p')" + global_prefix="$(echo "$ipv6_ex" | cut -c $cut_chars)" + if [ -n "$global_prefix" ]; then + global_prefix="$global_prefix$prefix_label" + break + fi + fi + fi + done + fi + else + global_prefix="$NET_PREFIX_TRANSLATION_GLOBAL_PREFIX" + fi + + echo "$global_prefix" +} + +# Plugin start function +plugin_start() +{ + local global_prefix local_prefix eif IFS + + #### remove when in main script #### + ip6tables -t nat -F + ip6tables -t nat -X + #### + + ip6tables -t nat -N NET_PREFIX_TRANSLATION_IN 2>/dev/null + ip6tables -t nat -F NET_PREFIX_TRANSLATION_IN + + ip6tables -t nat -N NET_PREFIX_TRANSLATION_OUT 2>/dev/null + ip6tables -t nat -F NET_PREFIX_TRANSLATION_OUT + + global_prefix="$(net_prefix_translation_global_prefix)" + + if [ -z "$global_prefix" ]; then + echo "${INDENT}Network Prefix Translation Global Prefix: Not Found" + return 1 + fi + + local_prefix="$NET_PREFIX_TRANSLATION_LOCAL_PREFIX" + + echo "${INDENT}Network Prefix Translation Global Prefix: $global_prefix" + echo "${INDENT}Network Prefix Translation Local Prefix: $local_prefix" + + IFS=' ,' + for eif in $EXT_IF; do + ip6tables -t nat -A NET_PREFIX_TRANSLATION_IN -i $eif -d $global_prefix -j NETMAP --to $local_prefix + ip6tables -t nat -A NET_PREFIX_TRANSLATION_OUT -o $eif -s $local_prefix -j NETMAP --to $global_prefix + done + + echo "$global_prefix" > "$NET_PREFIX_TRANSLATION_GLOBAL_IPV6" + + ip6tables -t nat -A PREROUTING -j NET_PREFIX_TRANSLATION_IN + ip6tables -t nat -A POSTROUTING -j NET_PREFIX_TRANSLATION_OUT + + return 0 +} + + +# Plugin restart function +plugin_restart() +{ + + # Skip plugin_stop on a restart + plugin_start + + return 0 +} + + +# Plugin stop function +plugin_stop() +{ + + ip6tables -t nat -D PREROUTING -j NET_PREFIX_TRANSLATION_IN + ip6tables -t nat -D POSTROUTING -j NET_PREFIX_TRANSLATION_OUT + + ip6tables -t nat -F NET_PREFIX_TRANSLATION_IN + ip6tables -t nat -X NET_PREFIX_TRANSLATION_IN 2>/dev/null + + ip6tables -t nat -F NET_PREFIX_TRANSLATION_OUT + ip6tables -t nat -X NET_PREFIX_TRANSLATION_OUT 2>/dev/null + + rm -f "$NET_PREFIX_TRANSLATION_GLOBAL_IPV6" + + return 0 +} + + +# Plugin status function +plugin_status() +{ + local old_prefix global_prefix local_prefix eif IFS + + if [ -f "$NET_PREFIX_TRANSLATION_GLOBAL_IPV6" ]; then + old_prefix="$(cat "$NET_PREFIX_TRANSLATION_GLOBAL_IPV6")" + else + old_prefix="" + fi + + global_prefix="$(net_prefix_translation_global_prefix)" + + if [ -z "$global_prefix" ]; then + echo " Network Prefix Translation Global Prefix: Not Found" + return 0 + fi + + if [ "$old_prefix" = "$global_prefix" ]; then + echo " Network Prefix Translation Global Prefix did not change: $global_prefix" + return 0 + fi + + local_prefix="$NET_PREFIX_TRANSLATION_LOCAL_PREFIX" + + if [ "$NET_PREFIX_TRANSLATION_UPDATE_ON_STATUS" != "0" ]; then + # update rules + + ip6tables -t nat -F NET_PREFIX_TRANSLATION_IN + ip6tables -t nat -F NET_PREFIX_TRANSLATION_OUT + + IFS=' ,' + for eif in $EXT_IF; do + ip6tables -t nat -A NET_PREFIX_TRANSLATION_IN -i $eif -d $global_prefix -j NETMAP --to $local_prefix + ip6tables -t nat -A NET_PREFIX_TRANSLATION_OUT -o $eif -s $local_prefix -j NETMAP --to $global_prefix + done + + echo "$global_prefix" > "$NET_PREFIX_TRANSLATION_GLOBAL_IPV6" + echo " Network Prefix Translation Global Prefix (updated): $global_prefix" + else + echo " Network Prefix Translation Global Prefix needs updating to: $global_prefix" + fi + + return 0 +} + + +# Check sanity of eg. environment +plugin_sanity_check() +{ + # Sanity check + + if [ -z "$(echo "$NET_PREFIX_TRANSLATION_GLOBAL_PREFIX" | cut -s -d'/' -f2)" ]; then + printf "\033[40m\033[1;31m${INDENT}ERROR: NET_PREFIX_TRANSLATION_GLOBAL_PREFIX is missing a /nn prefix!\033[0m\n" >&2 + return 1 + fi + + if [ -z "$(echo "$NET_PREFIX_TRANSLATION_LOCAL_PREFIX" | cut -s -d'/' -f2)" ]; then + printf "\033[40m\033[1;31m${INDENT}ERROR: NET_PREFIX_TRANSLATION_LOCAL_PREFIX is missing a /nn prefix!\033[0m\n" >&2 + return 1 + fi + + if [ -n "$NET_PREFIX_TRANSLATION_IF" ] && ! check_command netcalc; then + printf "\033[40m\033[1;31m${INDENT}ERROR: Required binary \"netcalc\" is not available!\033[0m\n" >&2 + return 1 + fi + + return 0 +} + + +############ +# Mainline # +############ + +# Check where to find the config file +CONF_FILE="" +if [ -n "$PLUGIN_CONF_PATH" ]; then + CONF_FILE="$PLUGIN_CONF_PATH/$PLUGIN_CONF_FILE" +fi + +# Preinit to success: +PLUGIN_RET_VAL=0 + +# Check if the config file exists +if [ ! -e "$CONF_FILE" ]; then + printf "NOTE: Config file \"$CONF_FILE\" not found!\n Plugin \"$PLUGIN_NAME v$PLUGIN_VERSION\" ignored!\n" >&2 +else + # Source the plugin config file + . "$CONF_FILE" + + if [ "$ENABLED" = "1" -a "$PLUGIN_CMD" != "stop-restart" ] || + [ "$ENABLED" = "0" -a "$PLUGIN_CMD" = "stop-restart" ] || + [ -n "$PLUGIN_LOAD_FILE" -a "$PLUGIN_CMD" = "stop" ] || + [ -n "$PLUGIN_LOAD_FILE" -a "$PLUGIN_CMD" = "status" ]; then + # Show who we are: + echo "${INDENT}$PLUGIN_NAME v$PLUGIN_VERSION" + + # Increment indention + INDENT="$INDENT " + + # Only proceed if environment ok + if ! plugin_sanity_check; then + PLUGIN_RET_VAL=1 + else + case $PLUGIN_CMD in + start|'') plugin_start; PLUGIN_RET_VAL=$? ;; + restart ) plugin_restart; PLUGIN_RET_VAL=$? ;; + stop|stop-restart) plugin_stop; PLUGIN_RET_VAL=$? ;; + status ) plugin_status; PLUGIN_RET_VAL=$? ;; + * ) PLUGIN_RET_VAL=1; printf "\033[40m\033[1;31m ERROR: Invalid plugin option \"$PLUGIN_CMD\"!\033[0m\n" >&2 ;; + esac + fi + fi +fi Added: branches/1.0/package/arnofw/net-prefix-translation/net-prefix-translation.conf =================================================================== --- branches/1.0/package/arnofw/net-prefix-translation/net-prefix-translation.conf (rev 0) +++ branches/1.0/package/arnofw/net-prefix-translation/net-prefix-translation.conf 2017-05-29 16:04:48 UTC (rev 8353) @@ -0,0 +1,56 @@ +# ------------------------------------------------------------------------------ +# -= Arno's iptables firewall - Network Prefix Translation plugin =- +# ------------------------------------------------------------------------------ + +# To actually enable this plugin make ENABLED=1: +# ------------------------------------------------------------------------------ +ENABLED=0 + +# NPTv6 (Network Prefix Translation) for IPv6 +# +# Commonly used to assign fixed ULA (Unique Local IPv6 Unicast Addresses) +# (RFC4193) prefixes to local networks and perform a 1:1 mapping to a +# GUA (IPv6 Global Unicast Address) (RFC3587) prefix provided by your ISP. +# Should the GUA prefix change, the local ULA prefix can remain the same. +# +# The simplest case is where the GUA prefix is static, or seldom changes, +# specify the global prefix with NET_PREFIX_TRANSLATION_GLOBAL_PREFIX. +# +# Example: +# NET_PREFIX_TRANSLATION_GLOBAL_PREFIX="2001:db8:abcd:1230::/60" +# (IPv6 Only) +# ------------------------------------------------------------------------------ +NET_PREFIX_TRANSLATION_GLOBAL_PREFIX="::/60" + +# The more common case is where the GUA prefix is dynamic, using DHCPv6-PD. +# In this case monitor an interface that is automatically assgined a prefix. +# The value of NET_PREFIX_TRANSLATION_GLOBAL_PREFIX is used only to determine +# the prefix length. When NET_PREFIX_TRANSLATION_IF is not defined, +# NET_PREFIX_TRANSLATION_GLOBAL_PREFIX is used, and must be fully specified. +# +# Example: (first INT_IF interface will be used) +# NET_PREFIX_TRANSLATION_IF="$INT_IF" +# ------------------------------------------------------------------------------ +NET_PREFIX_TRANSLATION_IF="$INT_IF" + +# You must define NET_PREFIX_TRANSLATION_LOCAL_PREFIX by generating a ULA, +# using a script or web site, whatever you are most comfortable with. +# +# Example: (generate your own, random, ULA) +# NET_PREFIX_TRANSLATION_LOCAL_PREFIX="fd04:928b:f87e::/48" +# (IPv6 Only) +# ------------------------------------------------------------------------------ +NET_PREFIX_TRANSLATION_LOCAL_PREFIX="fd04:928b:f87e::/48" + +# When this plugin's status is called, if the global IPv6 prefix has changed, +# noted by the IPv6 prefix associated with NET_PREFIX_TRANSLATION_IF, the +# rules will be updated. Set NET_PREFIX_TRANSLATION_UPDATE_ON_STATUS to "0" +# to disable this automatic update on status. +# +# Example: +# $ arno-iptables-firewall status-plugins net-prefix-translation +# +# Defaults to update on status if not set to "0" +# ------------------------------------------------------------------------------ +NET_PREFIX_TRANSLATION_UPDATE_ON_STATUS=1 + This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. |