From: <ppr...@us...> - 2008-05-05 07:59:28
|
Revision: 1742 http://astlinux.svn.sourceforge.net/astlinux/?rev=1742&view=rev Author: pprindeville Date: 2008-05-05 00:59:24 -0700 (Mon, 05 May 2008) Log Message: ----------- More script cleanup Modified Paths: -------------- trunk/package/asterisk/asterisk.init trunk/package/iproute2/astshape.init trunk/package/iptables/astfw trunk/package/iptables/iptables.init trunk/target/generic/target_skeleton/etc/init.d/single Modified: trunk/package/asterisk/asterisk.init =================================================================== --- trunk/package/asterisk/asterisk.init 2008-05-03 22:10:40 UTC (rev 1741) +++ trunk/package/asterisk/asterisk.init 2008-05-05 07:59:24 UTC (rev 1742) @@ -2,72 +2,62 @@ . /etc/rc.conf -if [ "$EXTENSIONS" ] -then -if `echo $EXTENSIONS | grep -qi pbxware` -then -exit +if [ -n "$EXTENSIONS" ]; then + if `echo $EXTENSIONS | grep -qi pbxware`; then + exit + fi fi -fi init () { -mkdir /var/run/asterisk -if [ ! -d /var/log/asterisk ] -then -mkdir /var/log/asterisk -fi + mkdir /var/run/asterisk -mkdir /var/spool/asterisk -cp -a /stat/var/spool/asterisk/* /var/spool/asterisk/ -ln -s /stat/var/lib/asterisk /var/lib/asterisk + if [ ! -d /var/log/asterisk ]; then + mkdir /var/log/asterisk + fi -if [ -d /mnt/kd/voicemail ] -then -rm -rf /var/spool/asterisk/voicemail -ln -s /mnt/kd/voicemail /var/spool/asterisk/voicemail -fi + mkdir /var/spool/asterisk + cp -a /stat/var/spool/asterisk/* /var/spool/asterisk/ + ln -s /stat/var/lib/asterisk /var/lib/asterisk -if [ -d /mnt/kd/monitor ] -then -rm -rf /var/spool/asterisk/monitor -ln -s /mnt/kd/monitor /var/spool/asterisk/monitor -fi + if [ -d /mnt/kd/voicemail ]; then + rm -rf /var/spool/asterisk/voicemail + ln -s /mnt/kd/voicemail /var/spool/asterisk/voicemail + fi -if [ -d /mnt/kd/asterisk ] -then -ln -s /mnt/kd/asterisk /tmp/etc/asterisk -fi + if [ -d /mnt/kd/monitor ]; then + rm -rf /var/spool/asterisk/monitor + ln -s /mnt/kd/monitor /var/spool/asterisk/monitor + fi -if [ ! -r /tmp/etc/asterisk ] -then -mkdir /tmp/etc/asterisk -cp -a /stat/etc/asterisk/* /tmp/etc/asterisk/ -# ln -s /stat/etc/asterisk /tmp/etc/asterisk -fi + if [ -d /mnt/kd/asterisk ]; then + ln -s /mnt/kd/asterisk /tmp/etc/asterisk + fi -if [ -f /mnt/kd/astdb ] -then -ln -s /mnt/kd/astdb /tmp/astdb -fi + if [ ! -r /tmp/etc/asterisk ]; then + mkdir /tmp/etc/asterisk + cp -a /stat/etc/asterisk/* /tmp/etc/asterisk/ + # ln -s /stat/etc/asterisk /tmp/etc/asterisk + fi -if [ -d /mnt/kd/cdr-csv ] -then -ln -s /mnt/kd/cdr-csv /var/log/asterisk/cdr-csv -else -mkdir -p /var/log/asterisk/cdr-csv -fi + if [ -f /mnt/kd/astdb ]; then + ln -s /mnt/kd/astdb /tmp/astdb + fi -if [ -d /mnt/kd/cdr-custom ] -then -ln -s /mnt/kd/cdr-custom /var/log/asterisk/cdr-custom -else -mkdir -p /var/log/asterisk/cdr-custom -fi + if [ -d /mnt/kd/cdr-csv ]; then + ln -s /mnt/kd/cdr-csv /var/log/asterisk/cdr-csv + else + mkdir -p /var/log/asterisk/cdr-csv + fi -if [ "$ASTMANPROXY_USER" ] -then -echo "; Auto generated + if [ -d /mnt/kd/cdr-custom ]; then + ln -s /mnt/kd/cdr-custom /var/log/asterisk/cdr-custom + else + mkdir -p /var/log/asterisk/cdr-custom + fi + + if [ -n "$ASTMANPROXY_USER" ]; then + echo "; Auto generated host = 127.0.0.1, 5038, $ASTMANPROXY_USER, $ASTMANPROXY_PASS, on, off retryinterval = 2 maxretries = 10 @@ -83,66 +73,62 @@ outputformat = standard autofilter = off logfile = /dev/null" > /tmp/etc/astmanproxy.conf -fi + fi -if `which pikacf > /dev/null 2> /dev/null` -then -if [ -r /usr/share/pika/montecarlo/conf/pikaconfig.xml ] -then -echo "PikaInline already configured..." -else -if `cat /proc/cmdline | grep -q asturw` -then -echo "Running initial configuration for PikaInline..." -pikacf -a /dev/null 1>/dev/null & -else -mount -o rw,remount / -echo "Running initial configuration for PikaInline..." -pikacf -a /dev/null 1>/dev/null & -mount -o ro,remount / -fi -fi -fi + if `which pikacf >/dev/null`; then + if [ -r /usr/share/pika/montecarlo/conf/pikaconfig.xml ]; then + echo "PikaInline already configured..." + else + if `cat /proc/cmdline | grep -q asturw`; then + echo "Running initial configuration for PikaInline..." + pikacf -a /dev/null 1>/dev/null & + else + mount -o rw,remount / + echo "Running initial configuration for PikaInline..." + pikacf -a /dev/null 1>/dev/null & + mount -o ro,remount / + fi + fi + fi + } start () { -echo "Starting Asterisk..." -if [ "$ISDN_MODPROBE" -o "$MISDN" ] -then -echo "Starting mISDN" -if [ -d /mnt/kd ] -then -ln -s /mnt/kd/misdn-init.conf /tmp/etc/misdn-init.conf -fi -if [ -r /mnt/kd/misdn-init.conf ] -then -echo "misdn-init.conf already exists on /mnt/kd, skipping config." -else -/usr/sbin/misdn-init scan -/usr/sbin/misdn-init config -fi -/usr/sbin/misdn-init start -# Not needed -#mknod /dev/mISDN c 46 0 -#modprobe mISDN_core -#modprobe mISDN_l1 debug=0 -#modprobe mISDN_l2 debug=0 -#modprobe l3udss1 -#modprobe mISDN_capi -#modprobe mISDN_isac -#modprobe mISDN_dsp debug=0 options=0x0 -#modprobe $ISDN_MODPROBE -if [ "$ISDN_MODPROBE2" ] -then -#modprobe $ISDN_MODPROBE2 -echo "ISDN_MODPROBE and ISDN_MODPROBE2 are deprecated" -fi -sleep 2 -fi -if `grep -A1 "[admin]" /etc/asterisk/manager.conf | grep -q astlinux` -then -echo " + echo "Starting Asterisk..." + if [ -n "$ISDN_MODPROBE" -o -n "$MISDN" ]; then + echo "Starting mISDN" + if [ -d /mnt/kd ]; then + ln -s /mnt/kd/misdn-init.conf /tmp/etc/misdn-init.conf + fi + + if [ -r /mnt/kd/misdn-init.conf ]; then + echo "misdn-init.conf already exists on /mnt/kd, skipping config." + else + /usr/sbin/misdn-init scan + /usr/sbin/misdn-init config + fi + + /usr/sbin/misdn-init start + # Not needed + #mknod /dev/mISDN c 46 0 + #modprobe mISDN_core + #modprobe mISDN_l1 debug=0 + #modprobe mISDN_l2 debug=0 + #modprobe l3udss1 + #modprobe mISDN_capi + #modprobe mISDN_isac + #modprobe mISDN_dsp debug=0 options=0x0 + #modprobe $ISDN_MODPROBE + if [ -n "$ISDN_MODPROBE2" ]; then + #modprobe $ISDN_MODPROBE2 + echo "ISDN_MODPROBE and ISDN_MODPROBE2 are deprecated" + fi + sleep 2 + fi + + if `grep -A1 "[admin]" /etc/asterisk/manager.conf | grep -q astlinux`; then + echo " WARNING WARNING WARNING YOU STILL HAVE NOT CHANGED YOUR ASTERISK MANAGER PASSWORD @@ -152,64 +138,61 @@ WARNING WARNING WARNING " -fi + fi -if [ -r /etc/asterisk/extensions.conf ] -then -# Work around uclibc bug -ulimit -s unlimited -asterisk -p -I -fi + if [ -r /etc/asterisk/extensions.conf ]; then + # Work around uclibc bug + ulimit -s unlimited + asterisk -p -I + fi -if [ "$ASTVERBOSE" ] -then -asterisk -rx "set verbose $ASTVERBOSE" > /dev/null -fi + if [ -n "$ASTVERBOSE" ]; then + asterisk -rx "set verbose $ASTVERBOSE" > /dev/null + fi -if [ -r /tmp/etc/astmanproxy.conf ] -then -echo "Starting astmanproxy..." -/usr/sbin/astmanproxy -fi + if [ -r /tmp/etc/astmanproxy.conf ]; then + echo "Starting astmanproxy..." + /usr/sbin/astmanproxy + fi + } stop () { -if [ -r /var/run/asterisk/asterisk.pid ] -then -echo "Stopping Asterisk..." -kill `cat /var/run/asterisk/asterisk.pid` -fi -if `ps | grep -q astmanproxy` -then -echo "Stopping astmanproxy..." -killall astmanproxy 2> /dev/null -fi + if [ -r /var/run/asterisk/asterisk.pid ]; then + echo "Stopping Asterisk..." + kill `cat /var/run/asterisk/asterisk.pid` + fi + + if `ps | grep -q astmanproxy`; then + echo "Stopping astmanproxy..." + killall astmanproxy 2>/dev/null + fi } case $1 in init) -init -start -;; + init + start + ;; start) -start -;; + start + ;; stop) -stop -;; + stop + ;; restart) -stop -sleep 2 -start -;; + stop + sleep 2 + start + ;; *) -echo "Usage: start|stop|restart" -;; + echo "Usage: start|stop|restart" + ;; esac Modified: trunk/package/iproute2/astshape.init =================================================================== --- trunk/package/iproute2/astshape.init 2008-05-03 22:10:40 UTC (rev 1741) +++ trunk/package/iproute2/astshape.init 2008-05-05 07:59:24 UTC (rev 1742) @@ -4,104 +4,93 @@ start () { -if [ "$FWVERS" = arno ] -then -return -fi + if [ "$FWVERS" = arno ]; then + return + fi -for i in `cat /proc/cmdline` -do -if `echo $i | grep -q "astlinux="` -then -ASTARCH=`echo $i | grep "astlinux="| sed -e 's/astlinux=//'` -fi -done + for i in `cat /proc/cmdline`; do + case $i in + astlinux=*) + ASTARCH=${i:9} + ;; + esac + done -if [ "$INTIF" -o "$INT2IF" -o "$INT3IF" ] -then -RUN=0 -else -RUN=1 -fi + if [ -n "$INTIF" -o -n "$INT2IF" -o -n "$INT3IF" ]; then + RUN=1 + else + RUN= + fi -if [ "$EXTUP" -a "$EXTDOWN" ] -then -RUN=0 -else -RUN=1 -fi + if [ -n "$EXTUP" -a -n "$EXTDOWN" ]; then + RUN=1 + else + RUN= + fi -if [ "$RUN" = "0" ] -then -if [ "$ASTARCH" = "net4801" -o "$ASTARCH" = "wrap" ] -then -if `grep -q "idle=poll" /proc/cmdline` -then -RUN=0 -else -echo "You have enabled astshape on $ASTARCH but you + if [ -n "$RUN" ]; then + if [ "$ASTARCH" = "net4801" -o "$ASTARCH" = "wrap" ]; then + if `grep -q "idle=poll" /proc/cmdline`; then + RUN=1 + else + echo "You have enabled astshape on $ASTARCH but you have not activated the idle=poll workaround - exiting." RUN=1 -fi -fi -fi + fi + fi + fi -if [ "$RUN" = "0" ] -then -echo "Starting astshape..." -if [ -x /mnt/kd/astshape ] -then -/mnt/kd/astshape start -else -/usr/sbin/astshape start -fi -fi + if [ -n "$RUN" ]; then + echo "Starting astshape..." + if [ -x /mnt/kd/astshape ]; then + /mnt/kd/astshape start + else + /usr/sbin/astshape start + fi + fi } stop () { -if [ "$FWVERS" = arno ] -then -return -fi + if [ "$FWVERS" = arno ]; then + return + fi -if [ ! "$EXTUP" -a "$EXTDOWN" ] -then -exit -fi + if [ -z "$EXTUP" -a -n "$EXTDOWN" ]; then + exit + fi -echo "Stopping astshape..." -if [ -x /mnt/kd/astshape ] -then -/mnt/kd/astshape stop -else -/usr/sbin/astshape stop -fi + echo "Stopping astshape..." + if [ -x /mnt/kd/astshape ]; then + /mnt/kd/astshape stop + else + /usr/sbin/astshape stop + fi } case $1 in init) -start -;; + start + ;; start) -start -;; + start + ;; stop) -stop -;; + stop + ;; restart) -stop -sleep 2 -start -;; + stop + sleep 2 + start + ;; *) -echo "Usage: start|stop|restart" -;; + echo "Usage: start|stop|restart" + ;; esac Modified: trunk/package/iptables/astfw =================================================================== --- trunk/package/iptables/astfw 2008-05-03 22:10:40 UTC (rev 1741) +++ trunk/package/iptables/astfw 2008-05-05 07:59:24 UTC (rev 1742) @@ -2,26 +2,22 @@ . /etc/rc.conf -if [ "$DENYACT" ] -then -DACTION=$DENYACT +if [ -n "$DENYACT" ]; then + DACTION=$DENYACT else -DACTION=DROP + DACTION=DROP fi -if [ "$INTIF" -a ! "$INTIF" = "none" ] -then -IPBASE=`echo $INTIP | cut -d. -f1-3` +if [ -n "$INTIF" -a "$INTIF" != "none" ]; then + IPBASE=`echo $INTIP | cut -d. -f1-3` fi -if [ "$INT2IF" -a ! "$INT2IF" = "none" ] -then -IP2BASE=`echo $INT2IP | cut -d. -f1-3` +if [ -n "$INT2IF" -a "$INT2IF" != "none" ]; then + IP2BASE=`echo $INT2IP | cut -d. -f1-3` fi -if [ "$INT3IF" -a ! "$INT3IF" = "none" ] -then -IP3BASE=`echo $INT3IP | cut -d. -f1-3` +if [ -n "$INT3IF" -a "$INT3IF" != "none" ]; then + IP3BASE=`echo $INT3IP | cut -d. -f1-3` fi # some basic setup @@ -37,28 +33,25 @@ echo 1 >/proc/sys/net/ipv4/tcp_syncookies SIPCOMMA="" -for i in $SIP_PORTS -do -SIPCOMMA="$SIPCOMMA${SIPCOMMA:+,}$i" +for i in $SIP_PORTS; do + SIPCOMMA="$SIPCOMMA${SIPCOMMA:+,}$i" done modprobe ip_conntrack_ftp modprobe ip_conntrack_tftp modprobe ip_conntrack_irc -if [ "$SIPCOMMA" ] -then -modprobe ip_conntrack_sip ports="$SIPCOMMA" -modprobe ip_nat_sip +if [ -n "$SIPCOMMA" ]; then + modprobe ip_conntrack_sip ports="$SIPCOMMA" + modprobe ip_nat_sip fi modprobe ip_nat_ftp modprobe ip_nat_tftp modprobe ip_nat_irc -if [ "$EXTIP" -a "$EXT2IP" ] -then -EXTIFS="$EXTIF $EXT2IF" +if [ -n "$EXTIP" -a -n "$EXT2IP" ]; then + EXTIFS="$EXTIF $EXT2IF" else -EXTIFS="$EXTIF" + EXTIFS="$EXTIF" fi #Create USER-INPUT table and send traffic through it @@ -70,26 +63,22 @@ #Allow INPUT from INTIF -if [ "$INTIF" -a ! "$INTIF" = "none" ] -then -iptables -A INPUT -i $INTIF -j ACCEPT +if [ -n "$INTIF" -a "$INTIF" != "none" ]; then + iptables -A INPUT -i $INTIF -j ACCEPT fi -if [ "$INT2IF" -a ! "$INT2IF" = "none" ] -then -iptables -A INPUT -i $INT2IF -j ACCEPT +if [ -n "$INT2IF" -a "$INT2IF" != "none" ]; then + iptables -A INPUT -i $INT2IF -j ACCEPT fi -if [ "$INT3IF" -a ! "$INT3IF" = "none" ] -then -iptables -A INPUT -i $INT3IF -j ACCEPT +if [ -n "$INT3IF" -a "$INT3IF" != "none" ]; then + iptables -A INPUT -i $INT3IF -j ACCEPT fi # Don't filter bridges # If you want to filter bridges, well, you have to do it yourself -if [ "$BRIDGE0" -o "$BRIDGE1" -o "$BRIDGE2" ] -then -iptables -A FORWARD -m physdev --physdev-is-bridged -j ACCEPT +if [ -n "$BRIDGE0" -o -n "$BRIDGE1" -o -n "$BRIDGE2" ]; then + iptables -A FORWARD -m physdev --physdev-is-bridged -j ACCEPT fi #Already established traffic from anywhere @@ -97,106 +86,92 @@ iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT #Do MSS clamping if we are configured for PPPoE -if [ "$EXTIF" = "ppp0" ] -then -# Not sure which one... -# iptables -A FORWARD -o "$EXTIF" -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu -iptables -t mangle -A POSTROUTING -p tcp --tcp-flags SYN,RST SYN -o "$EXTIF" -j TCPMSS --clamp-mss-to-pmtu +if [ "$EXTIF" = "ppp0" ]; then + # Not sure which one... + # iptables -A FORWARD -o "$EXTIF" -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu + iptables -t mangle -A POSTROUTING -p tcp --tcp-flags SYN,RST SYN -o "$EXTIF" -j TCPMSS --clamp-mss-to-pmtu fi #DMZ Support -if [ "$DMZIF" -a ! "$DMZIF" = "none" ] -then +if [ -n "$DMZIF" -a "$DMZIF" != "none" ]; then -for i in $EXTIFS -do -if [ "$DMZTYPE" = "extonly" ] -then -#Pass traffic out EXTIFs -iptables -A FORWARD -i $DMZIF -o $i -j ACCEPT -#DNS, ICMP support to AstLinux machine -iptables -A INPUT -i $DMZIF -m state --state NEW -m udp -p udp --dport 53 -j ACCEPT -iptables -A INPUT -i $DMZIF -p icmp --icmp-type any -j ACCEPT -fi -done + for i in $EXTIFS; do + if [ "$DMZTYPE" = "extonly" ]; then + #Pass traffic out EXTIFs + iptables -A FORWARD -i $DMZIF -o $i -j ACCEPT + #DNS, ICMP support to AstLinux machine + iptables -A INPUT -i $DMZIF -m state --state NEW -m udp -p udp --dport 53 -j ACCEPT + iptables -A INPUT -i $DMZIF -p icmp --icmp-type any -j ACCEPT + fi + done -for i in $EXTIFS -do -if [ "$DMZTYPE" = "extme" ] -then -#Pass traffic out EXTIFs -iptables -A FORWARD -i $DMZIF -o $i -j ACCEPT -# Allow all traffic to AstLinux machine -iptables -A INPUT -i $DMZIF -j ACCEPT -fi -done + for i in $EXTIFS; do + if [ "$DMZTYPE" = "extme" ]; then + #Pass traffic out EXTIFs + iptables -A FORWARD -i $DMZIF -o $i -j ACCEPT + # Allow all traffic to AstLinux machine + iptables -A INPUT -i $DMZIF -j ACCEPT + fi + done -if [ "$DMZTYPE" = "open" ] -then -# Forget it all and open the gates -iptables -A INPUT -i $DMZIF -j ACCEPT -iptables -A FORWARD -i $DMZIF -j ACCEPT -fi + if [ "$DMZTYPE" = "open" ]; then + # Forget it all and open the gates + iptables -A INPUT -i $DMZIF -j ACCEPT + iptables -A FORWARD -i $DMZIF -j ACCEPT + fi -if [ "$DMZTYPE" = "manual" ] -then -echo "Fill in some rules. You are on your own!" -fi + if [ "$DMZTYPE" = "manual" ]; then + echo "Fill in some rules. You are on your own!" + fi fi -if [ "$EXTOPENSRC" ] -then -for i in $EXTOPENSRC -do -for j in $EXTIFS -do -iptables -A INPUT -m state --state NEW -i $j -s $i -j ACCEPT -done -done +if [ -n "$EXTOPENSRC" ]; then + for i in $EXTOPENSRC; do + for j in $EXTIFS; do + iptables -A INPUT -m state --state NEW -i $j -s $i -j ACCEPT + done + done fi # # this is tedious but necessary # EXTPLUS="" -for i in $SIP_PORTS -do -EXTPLUS="$EXTPLUS u$i" +for i in $SIP_PORTS; do + EXTPLUS="$EXTPLUS u$i" done -if [ "$EXTOPEN" -o "$EXTPLUS" ] -then -for i in $EXTOPEN $EXTPLUS -do -if `echo $i | grep -q "u"` -then -PROTOCOL=udp -fi +if [ -n "$EXTOPEN" -o -n "$EXTPLUS" ]; then + for i in $EXTOPEN $EXTPLUS; do + case $i in + u[1-9][0-9]*) + PROTOCOL=udp + ;; -if `echo $i | grep -q "t"` -then -PROTOCOL=tcp -fi + t[1-9][0-9]*) + PROTOCOL=tcp + ;; -if `echo $i | grep -q "i"` -then -PROTOCOL=icmp -fi + i[1-9][0-9]*) + PROTOCOL=icmp + ;; + *) + echo "Unknown port type: $i" 1>&2 + ;; + esac -PORT=`echo $i | tr -d itu` + PORT=${i:1} -for i in $EXTIFS -do -if [ "$PROTOCOL" = "icmp" ] -then -iptables -A INPUT -i $i -m icmp -p icmp --icmp-type $PORT -j ACCEPT -else -iptables -A INPUT -m state --state NEW -i $i -m $PROTOCOL -p $PROTOCOL --dport $PORT -j ACCEPT -fi -done + for i in $EXTIFS; do + if [ "$PROTOCOL" = "icmp" ]; then + iptables -A INPUT -i $i -m icmp -p icmp --icmp-type $PORT -j ACCEPT + else + iptables -A INPUT -m state --state NEW -i $i -m $PROTOCOL -p $PROTOCOL --dport $PORT -j ACCEPT + fi + done -done + done fi #Create USER-FORWARD table and send traffic through it @@ -204,23 +179,19 @@ iptables -A FORWARD -j USER-FORWARD #allow forwarding from each interface to the internet... -for i in $EXTIFS -do +for i in $EXTIFS; do -if [ "$INTIF" -a ! "$INTIF" = "none" ] -then -iptables -A FORWARD -i $INTIF -o $i -j ACCEPT -fi + if [ -n "$INTIF" -a "$INTIF" != "none" ]; then + iptables -A FORWARD -i $INTIF -o $i -j ACCEPT + fi -if [ "$INT2IF" -a ! "$INT2IF" = "none" ] -then -iptables -A FORWARD -i $INT2IF -o $i -j ACCEPT -fi + if [ -n "$INT2IF" -a "$INT2IF" != "none" ]; then + iptables -A FORWARD -i $INT2IF -o $i -j ACCEPT + fi -if [ "$INT3IF" -a ! "$INT3IF" = "none" ] -then -iptables -A FORWARD -i $INT3IF -o $i -j ACCEPT -fi + if [ -n "$INT3IF" -a "$INT3IF" != "none" ]; then + iptables -A FORWARD -i $INT3IF -o $i -j ACCEPT + fi done #Create user NAT table and send everything through it @@ -228,140 +199,137 @@ iptables -t nat -A PREROUTING -j USER-PREROUTING #Setup 1:1 Maps... -if [ "$EXTMAP10" ] -then -echo "The old EXTMAP variables are deprecated. Please see EXTIPMAP in /stat/etc/rc.conf" +if [ -n "$EXTMAP10" ]; then + echo "The old EXTMAP variables are deprecated. Please see EXTIPMAP in /stat/etc/rc.conf" fi -if [ "$EXTIPMAP" ] -then -for i in $EXTIPMAP -do -EIP=`echo $i | cut -d: -f1` -IIP=`echo $i | cut -d: -f2` +if [ -n "$EXTIPMAP" ]; then + for i in $EXTIPMAP; do + EIP=`echo $i | cut -d: -f1` + IIP=`echo $i | cut -d: -f2` -ip addr add $EIP dev $EXTIF -iptables -t nat -A PREROUTING -d $EIP -i $EXTIF -j DNAT --to-destination $IIP -iptables -t nat -A POSTROUTING -s $EIP -o $EXTIF -j SNAT --to-source $IIP -iptables -t nat -A POSTROUTING -s $IIP -o $EXTIF -j SNAT --to-source $EIP -iptables -A FORWARD -i $EXTIF -o $INTIF -d $IIP -j ACCEPT -done + ip addr add $EIP dev $EXTIF + iptables -t nat -A PREROUTING -d $EIP -i $EXTIF -j DNAT --to-destination $IIP + iptables -t nat -A POSTROUTING -s $EIP -o $EXTIF -j SNAT --to-source $IIP + iptables -t nat -A POSTROUTING -s $IIP -o $EXTIF -j SNAT --to-source $EIP + iptables -A FORWARD -i $EXTIF -o $INTIF -d $IIP -j ACCEPT + done fi -if [ "$EXTPORTMAP" ] -then -for i in $EXTPORTMAP -do -EPPORT=`echo $i | cut -d: -f1` -IIP=`echo $i | cut -d: -f2` -IPORT=`echo $i | cut -d: -f3` +if [ -n "$EXTPORTMAP" ]; then + for i in $EXTPORTMAP; do + EPPORT=`echo $i | cut -d: -f1` + IIP=`echo $i | cut -d: -f2` + IPORT=`echo $i | cut -d: -f3` -if `echo $EPPORT | grep -q "u"` -then -PROTOCOL=udp -fi + case $EPPORT in + u[1-9][0-9]*) + PROTOCOL=udp + ;; + t[1-9[0-9]*) + PROTOCOL=tcp + ;; + *) + echo "Unknown port type: $EPPORT" 1>&2 + ;; + esac -if `echo $EPPORT | grep -q "t"` -then -PROTOCOL=tcp -fi + EPORT=${EPPORT:1} -EPORT=`echo $EPPORT | sed 's/^.//'` - -iptables -t nat -A PREROUTING -i $EXTIF -p $PROTOCOL -m $PROTOCOL --dport $EPORT -j DNAT --to-destination "$IIP":"$IPORT" -iptables -A FORWARD -i $EXTIF -o $INTIF -d $IIP -p $PROTOCOL -m $PROTOCOL --dport $EPORT -j ACCEPT + iptables -t nat -A PREROUTING -i $EXTIF -p $PROTOCOL -m $PROTOCOL --dport $EPORT -j DNAT --to-destination "$IIP":"$IPORT" + iptables -A FORWARD -i $EXTIF -o $INTIF -d $IIP -p $PROTOCOL -m $PROTOCOL --dport $EPORT -j ACCEPT done fi # DMZ to IP support -if [ "$DMZIP" ] -then +if [ -n "$DMZIP" ]; then -if [ "$DMZIPIF" ] -then -IF="$DMZIPIF" -else -IF="$INTIF" -fi + if [ -n "$DMZIPIF" ]; then + IF="$DMZIPIF" + else + IF="$INTIF" + fi -if [ "$DMZIP" = "auto" ] -then -DMZIP=`grep $IPBASE /var/db/dnsmasq.leases | head -n1 | cut -d" " -f3` -IF="$INTIF" -fi + if [ "$DMZIP" = "auto" ]; then + DMZIP=`grep $IPBASE /var/db/dnsmasq.leases | head -n1 | cut -d" " -f3` + IF="$INTIF" + fi -if [ "$NODMZPORTS" ] -then -for i in $NODMZPORTS -do +if [ -n "$NODMZPORTS" ]; then + for i in $NODMZPORTS; do -if `echo $i | grep -q "u"` -then -PROTOCOL=udp -fi + case $i in + u[1-9][0-9]*) + PROTOCOL=udp + ;; -if `echo $i | grep -q "t"` -then -PROTOCOL=tcp -fi + t[1-8[0-9]*) + PROTOCOL=tcp + ;; -PORT=`echo $i | tr -d itu` + *) + echo "Unknown port type: $i" 1>&2 + ;; + esac -if [ "$DMZSRC" ] -then -iptables -t nat -A PREROUTING -i $EXTIF -p $PROTOCOL -m $PROTOCOL --dport $PORT -j DNAT --to-destination "$DMZIP":"$PORT" -# iptables -A FORWARD -i $EXTIF -d $DMZIP -p $PROTOCOL -m $PROTOCOL --dport $PORT -j ACCEPT -else -iptables -t nat -A PREROUTING -i $EXTIF -p $PROTOCOL -m $PROTOCOL --dport $PORT -j DNAT --to-destination "$DMZIP":"$PORT" -# iptables -A FORWARD -i $EXTIF -d $DMZIP -p $PROTOCOL -m $PROTOCOL --dport $PORT -j ACCEPT -fi + PORT=${i:1} -done + if [ -n "$DMZSRC" ]; then + iptables -t nat -A PREROUTING -i $EXTIF -p $PROTOCOL -m $PROTOCOL --dport $PORT -j DNAT --to-destination "$DMZIP":"$PORT" + # iptables -A FORWARD -i $EXTIF -d $DMZIP -p $PROTOCOL -m $PROTOCOL --dport $PORT -j ACCEPT + else + iptables -t nat -A PREROUTING -i $EXTIF -p $PROTOCOL -m $PROTOCOL --dport $PORT -j DNAT --to-destination "$DMZIP":"$PORT" + # iptables -A FORWARD -i $EXTIF -d $DMZIP -p $PROTOCOL -m $PROTOCOL --dport $PORT -j ACCEPT + fi + + done fi -if [ "$DMZSRC" ] -then -# Catch the TCP/UDP stuff we need -for i in $EXTOPEN -do +if [ -n "$DMZSRC" ]; then + # Catch the TCP/UDP stuff we need + for i in $EXTOPEN; do -case $i in -u*) PROTOCOL=udp ;; -t*) PROTOCOL=tcp ;; -i*) PROTOCOL=icmp ;; -esac + case $i in + u[1-9][0-9]*) + PROTOCOL=udp + ;; + t[1-9][0-9]*) + PROTOCOL=tcp + ;; + i*) + PROTOCOL=icmp + ;; + esac -PORT=`echo $i | tr -d itu` + PORT=${i:1} -if [ "$PROTOCOL" = "icmp" ] -then -iptables -t nat -A PREROUTING -m $PROTOCOL -p $PROTOCOL --icmp-type $PORT -j ACCEPT -else -iptables -t nat -A PREROUTING -p $PROTOCOL --dport $PORT -i $EXTIF -j ACCEPT -fi -done + if [ "$PROTOCOL" = "icmp" ]; then + iptables -t nat -A PREROUTING -m $PROTOCOL -p $PROTOCOL --icmp-type $PORT -j ACCEPT + else + iptables -t nat -A PREROUTING -p $PROTOCOL --dport $PORT -i $EXTIF -j ACCEPT + fi + done -# Don't nat anything from DMZSRC ips -for i in $DMZSRC -do -iptables -t nat -A PREROUTING -i $EXTIF -s $i -j ACCEPT -done + # Don't nat anything from DMZSRC ips + for i in $DMZSRC; do + iptables -t nat -A PREROUTING -i $EXTIF -s $i -j ACCEPT + done -# DNAT everything else -iptables -t nat -A PREROUTING -i $EXTIF -j DNAT --to-destination $DMZIP + # DNAT everything else + iptables -t nat -A PREROUTING -i $EXTIF -j DNAT --to-destination $DMZIP -# Pass it -iptables -A FORWARD -i $EXTIF -o $IF -d $DMZIP -j ACCEPT + # Pass it + iptables -A FORWARD -i $EXTIF -o $IF -d $DMZIP -j ACCEPT -else -# DNAT everything else -iptables -t nat -A PREROUTING -j DNAT --to-destination $DMZIP + else + # DNAT everything else + iptables -t nat -A PREROUTING -j DNAT --to-destination $DMZIP -# Pass it -iptables -A FORWARD -i $EXTIF -o $IF -d $DMZIP -j ACCEPT + # Pass it + iptables -A FORWARD -i $EXTIF -o $IF -d $DMZIP -j ACCEPT + fi fi -fi #Create user NAT table and send everything through it iptables -t nat -N USER-POSTROUTING @@ -369,82 +337,71 @@ #turn on NAT (PAT) for everything\everyone else... -if [ "$NONAT" ] -then -for i in $NONAT -do +if [ -n "$NONAT" ]; then + for i in $NONAT; do -if [ "$i" = "$INTIF" ] -then -INTIFNAT=off -else -INTIFNAT=on -fi + if [ "$i" = "$INTIF" ]; then + INTIFNAT=off + else + INTIFNAT=on + fi -if [ "$i" = "$INT2IF" ] -then -INT2IFNAT=off -else -INT2IFNAT=on -fi + if [ "$i" = "$INT2IF" ]; then + INT2IFNAT=off + else + INT2IFNAT=on + fi -if [ "$i" = "$INT3IF" ] -then -INT3IFNAT=off -else -INT3IF=on -fi + if [ "$i" = "$INT3IF" ]; then + INT3IFNAT=off + else + INT3IF=on + fi -done + done + else -#default do NAT -INTIFNAT=on -INT2IFNAT=on -INT3IFNAT=on + + #default do NAT + INTIFNAT=on + INT2IFNAT=on + INT3IFNAT=on fi -for i in $EXTIFS -do +for i in $EXTIFS; do -if [ "$INTIF" -a "$INTIFNAT" = "on" -a ! "$INTIF" = "none" ] -then -if [ "$MASQPORTS" ] -then -iptables -t nat -A POSTROUTING -s $IPBASE.0/$INTNM -o $i -p udp -j MASQUERADE --to-ports $MASQPORTS -iptables -t nat -A POSTROUTING -s $IPBASE.0/$INTNM -o $i -p tcp -j MASQUERADE --to-ports $MASQPORTS -fi -iptables -t nat -A POSTROUTING -s $IPBASE.0/$INTNM -o $i -j MASQUERADE -fi + if [ -n "$INTIF" -a "$INTIFNAT" = "on" -a "$INTIF" != "none" ]; then + if [ -n "$MASQPORTS" ]; then + iptables -t nat -A POSTROUTING -s $IPBASE.0/$INTNM -o $i -p udp -j MASQUERADE --to-ports $MASQPORTS + iptables -t nat -A POSTROUTING -s $IPBASE.0/$INTNM -o $i -p tcp -j MASQUERADE --to-ports $MASQPORTS + fi + iptables -t nat -A POSTROUTING -s $IPBASE.0/$INTNM -o $i -j MASQUERADE + fi -if [ "$INT2IF" -a "$INT2IFNAT" = "on" -a ! "$INT2IF" = "none" ] -then -if [ "$MASQPORTS" ] -then -iptables -t nat -A POSTROUTING -s $IP2BASE.0/$INT2NM -o $i -p udp -j MASQUERADE --to-ports $MASQPORTS -iptables -t nat -A POSTROUTING -s $IP2BASE.0/$INT2NM -o $i -p tcp -j MASQUERADE --to-ports $MASQPORTS -fi -iptables -t nat -A POSTROUTING -s $IP2BASE.0/$INT2NM -o $i -j MASQUERADE -fi + if [ -n "$INT2IF" -a "$INT2IFNAT" = "on" -a "$INT2IF" != "none" ]; then + if [ -n "$MASQPORTS" ]; then + iptables -t nat -A POSTROUTING -s $IP2BASE.0/$INT2NM -o $i -p udp -j MASQUERADE --to-ports $MASQPORTS + iptables -t nat -A POSTROUTING -s $IP2BASE.0/$INT2NM -o $i -p tcp -j MASQUERADE --to-ports $MASQPORTS + fi + iptables -t nat -A POSTROUTING -s $IP2BASE.0/$INT2NM -o $i -j MASQUERADE + fi -if [ "$INT3IF" -a "$INT3IFNAT" = "on" -a ! "$INT3IF" = "none" ] -then -if [ "$MASQPORTS" ] -then -iptables -t nat -A POSTROUTING -s $IP3BASE.0/$INT3NM -o $i -p udp -j MASQUERADE --to-ports $MASQPORTS -iptables -t nat -A POSTROUTING -s $IP3BASE.0/$INT3NM -o $i -p tcp -j MASQUERADE --to-ports $MASQPORTS -fi -iptables -t nat -A POSTROUTING -s $IP3BASE.0/$INT3NM -o $i -j MASQUERADE -fi + if [ -n "$INT3IF" -a "$INT3IFNAT" = "on" -a "$INT3IF" != "none" ]; then + if [ -n "$MASQPORTS" ]; then + iptables -t nat -A POSTROUTING -s $IP3BASE.0/$INT3NM -o $i -p udp -j MASQUERADE --to-ports $MASQPORTS + iptables -t nat -A POSTROUTING -s $IP3BASE.0/$INT3NM -o $i -p tcp -j MASQUERADE --to-ports $MASQPORTS + fi + iptables -t nat -A POSTROUTING -s $IP3BASE.0/$INT3NM -o $i -j MASQUERADE + fi done -if [ "$VPN" = "openvpn" ] -then -# Allow TUN interface connections to OpenVPN server -iptables -A INPUT -i tun+ -j ACCEPT +if [ "$VPN" = "openvpn" ]; then + # Allow TUN interface connections to OpenVPN server + iptables -A INPUT -i tun+ -j ACCEPT -# Allow TUN interface connections to be forwarded through other interfaces -iptables -A FORWARD -i tun+ -j ACCEPT + # Allow TUN interface connections to be forwarded through other interfaces + iptables -A FORWARD -i tun+ -j ACCEPT fi #Default Deny FOR ALL REMAINING INTERFACES Modified: trunk/package/iptables/iptables.init =================================================================== --- trunk/package/iptables/iptables.init 2008-05-03 22:10:40 UTC (rev 1741) +++ trunk/package/iptables/iptables.init 2008-05-05 07:59:24 UTC (rev 1742) @@ -3,125 +3,125 @@ . /etc/rc.conf init () { -if [ "$FWVERS" -a "$FWVERS" = "arno" ] -then -if [ ! -e /tmp/etc/arno-iptables-firewall ] -then -ln -s /mnt/kd/arno-iptables-firewall /tmp/etc/arno-iptables-firewall -if [ ! -d /mnt/kd/arno-iptables-firewall ] -then -cp -a /stat/etc/arno-iptables-firewall /mnt/kd -fi -fi -fi + + if [ "$FWVERS" = "arno" ]; then + if [ ! -e /tmp/etc/arno-iptables-firewall ]; then + ln -s /mnt/kd/arno-iptables-firewall /tmp/etc/arno-iptables-firewall + if [ ! -d /mnt/kd/arno-iptables-firewall ]; then + cp -a /stat/etc/arno-iptables-firewall /mnt/kd + fi + fi + fi + } start () { -if [ "$INTIF" -o "$INT2IF" -o "$INT3IF" ] -then -if [ ! -x /usr/sbin/iptables ] -then -echo "You don't have iptables installed." -exit 1 -fi + if [ -n "$INTIF" -o -n "$INT2IF" -o -n "$INT3IF" ]; then -echo "Starting iptables..." + if [ ! -x /usr/sbin/iptables ]; then + echo "You don't have iptables installed." + exit 1 + fi -if [ "$FWVERS" -a "$FWVERS" = "arno" ] -then + echo "Starting iptables..." -if [ -x /usr/sbin/arno-iptables-firewall ] -then -/usr/sbin/arno-iptables-firewall start -else -echo "You don't have arno iptables firewall installed" -echo "I'll use astfw for now" -/usr/sbin/astfw -fi + if [ "$FWVERS" = "arno" ]; then -else + if [ -x /usr/sbin/arno-iptables-firewall ]; then + /usr/sbin/arno-iptables-firewall start + else + echo "You don't have arno iptables firewall installed +I'll use astfw for now" + /usr/sbin/astfw + fi -if [ -x /mnt/kd/astfw ] -then -/mnt/kd/astfw -else -/usr/sbin/astfw -fi + else -fi + if [ -x /mnt/kd/astfw ]; then + /mnt/kd/astfw + else + /usr/sbin/astfw + fi -fi + fi + fi + } stop () { -if [ "$INTIF" -o "$INT2IF" -o "$INT3IF" ] -then -if [ ! -x /usr/sbin/iptables ] -then -echo "You don't have iptables installed." -exit 1 -fi + if [ -n "$INTIF" -o -n "$INT2IF" -o -n "$INT3IF" ]; then -if [ "$FWVERS" = "arno" ] -then -/usr/sbin/arno-iptables-firewall stop -else -echo "Stopping iptables..." -sysctl -w net.ipv4.ip_forward=0 -for a in `cat /proc/net/ip_tables_names`; do -/usr/sbin/iptables -F -t $a -/usr/sbin/iptables -X -t $a + if [ ! -x /usr/sbin/iptables ]; then + echo "You don't have iptables installed." + exit 1 + fi -if [ "$a" = "nat" ]; then -/usr/sbin/iptables -t nat -P PREROUTING ACCEPT -/usr/sbin/iptables -t nat -P POSTROUTING ACCEPT -/usr/sbin/iptables -t nat -P OUTPUT ACCEPT -elif [ "$a" = "mangle" ]; then -if [ "$EXTUP" -a "$EXTDOWN" ] -then -echo "Refusing to clear mangle because QoS is enabled" -else -/usr/sbin/iptables -t mangle -P PREROUTING ACCEPT -/usr/sbin/iptables -t mangle -P INPUT ACCEPT -/usr/sbin/iptables -t mangle -P FORWARD ACCEPT -/usr/sbin/iptables -t mangle -P OUTPUT ACCEPT -/usr/sbin/iptables -t mangle -P POSTROUTING ACCEPT -fi -elif [ "$a" = "filter" ]; then -/usr/sbin/iptables -t filter -P INPUT ACCEPT -/usr/sbin/iptables -t filter -P FORWARD ACCEPT -/usr/sbin/iptables -t filter -P OUTPUT ACCEPT -fi -done -fi -fi + if [ "$FWVERS" = "arno" ]; then + /usr/sbin/arno-iptables-firewall stop + else + echo "Stopping iptables..." + sysctl -w net.ipv4.ip_forward=0 + + for a in `cat /proc/net/ip_tables_names`; do + /usr/sbin/iptables -F -t $a + /usr/sbin/iptables -X -t $a + + case "$a" in + nat) + /usr/sbin/iptables -t nat -P PREROUTING ACCEPT + /usr/sbin/iptables -t nat -P POSTROUTING ACCEPT + /usr/sbin/iptables -t nat -P OUTPUT ACCEPT + ;; + + mangle) + if [ -n "$EXTUP" -a -n "$EXTDOWN" ]; then + echo "Refusing to clear mangle because QoS is enabled" + else + /usr/sbin/iptables -t mangle -P PREROUTING ACCEPT + /usr/sbin/iptables -t mangle -P INPUT ACCEPT + /usr/sbin/iptables -t mangle -P FORWARD ACCEPT + /usr/sbin/iptables -t mangle -P OUTPUT ACCEPT + /usr/sbin/iptables -t mangle -P POSTROUTING ACCEPT + fi + ;; + + filter) + /usr/sbin/iptables -t filter -P INPUT ACCEPT + /usr/sbin/iptables -t filter -P FORWARD ACCEPT + /usr/sbin/iptables -t filter -P OUTPUT ACCEPT + ;; + esac + done + fi + fi + } case $1 in start) -start -;; + start + ;; stop) -stop -;; + stop + ;; init) -init -start -;; + init + start + ;; restart) -stop -sleep 2 -start -;; + stop + sleep 2 + start + ;; *) -echo "Usage: start|stop|restart" -;; + echo "Usage: start|stop|restart" + ;; esac Modified: trunk/target/generic/target_skeleton/etc/init.d/single =================================================================== --- trunk/target/generic/target_skeleton/etc/init.d/single 2008-05-03 22:10:40 UTC (rev 1741) +++ trunk/target/generic/target_skeleton/etc/init.d/single 2008-05-05 07:59:24 UTC (rev 1742) @@ -5,18 +5,16 @@ case $1 in start) -mount -t proc none /proc -hostname FAILSAFE -/bin/sh + mount -t proc none /proc + hostname FAILSAFE + /bin/sh + ;; -;; - stop) -echo -n "" -;; + ;; *) -echo "Usage: start|stop" -;; + echo "Usage: start|stop" + ;; esac This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site. |