X-Git-Url: http://git.squeep.com/?p=firewall-squeep;a=blobdiff_plain;f=common.sh;h=5c2ed1a56e052dc5b53a08e20dfeb4e4099e49d0;hp=f8860fcb1adf50868d549a147cfeb5f57ef23ea9;hb=HEAD;hpb=26febd7376e8c1679d5d088d71d73bc64585ec1e

diff --git a/common.sh b/common.sh
index f8860fc..5c2ed1a 100644
--- a/common.sh
+++ b/common.sh
@@ -5,9 +5,21 @@ set -e
 IPTABLES=$(which iptables)
 IP6TABLES=$(which ip6tables)
 IPSET=$(which ipset)
+TC=$(which tc)
+
+err(){
+	echo "$@" 1>&2
+}
+
+die(){
+	local status=$1
+	shift
+	err "$@"
+	exit ${status}
+}
 
 function decommentcat(){
-	sed 's/\s*#.*$//;/^\s*$/d' "$@"
+	cat "$@" | sed 's/\s*#.*$//;/^\s*$/d'
 }
 
 function create_set(){
@@ -20,6 +32,28 @@ function create_set(){
 	fi
 }
 
+function create_drop_chain(){
+	local chain="$1"
+
+	if ! $IPTABLES -L "${chain}" >/dev/null 2>&1
+	then
+		echo "initializing chain '${chain}'"
+		$IPTABLES -N "${chain}" || $IPTABLES -F "${chain}"
+		$IPTABLES -A "${chain}" -m conntrack --ctstate ESTABLISHED,RELATED -j RETURN
+		$IPTABLES -A "${chain}" -j REJECT --reject-with icmp-port-unreachable
+		$IPTABLES -v -L "${chain}"
+	fi
+
+	if ! $IP6TABLES -L "${chain}" >/dev/null 2>&1
+	then
+		echo "initializing chain '${chain}' ipv6"
+		$IP6TABLES -N "${chain}" || $IP6TABLES -F "${chain}"
+		$IP6TABLES -A "${chain}" -m conntrack --ctstate ESTABLISHED,RELATED -j RETURN
+		$IP6TABLES -A "${chain}" -j REJECT --reject-with icmp6-port-unreachable
+		$IP6TABLES -v -L "${chain}"
+	fi
+}
+
 function insert_setmatch_rules(){
 	local single=0
 	if [ "x$1" = "x-single-set" ]
@@ -44,14 +78,48 @@ function insert_setmatch_rules(){
 	done
 }
 
+# try to recreate sets faster than one-at-a-time by generating restore rules
+function ipset_restore_from_cidr(){
+	local vmatch
+	local set_name="$1"
+
+	for v in '' '6'
+	do
+		case "$v" in
+		6) vmatch=':';;
+		*) vmatch='\.';;
+		esac
+		# extract existing set configuration to create temporary set
+		(set -o pipefail; $IPSET save "${set_name}${v}" 2>/dev/null | grep -m 1 '^create ' | sed "s/\(create ${set_name}${v}\)/\1-tmp/") || continue
+		# populate with new data
+		decommentcat "${set_name}.cidr" "${set_name}.cidr.$(hostname -s)" 2>/dev/null | sed -n 's/\(.*'"${vmatch}"'.*\)/add '"${set_name}${v}-tmp"' \1/p' | sort -n | uniq
+	done
+}
+
 function reload_cidr_sets(){
+	local v n
+	local set_name="$1"
+
+	ipset_restore_from_cidr "${set_name}" | ipset restore
+        for v in '' 6
+        do
+                n="${set_name}${v}"
+                $IPSET swap "${n}-tmp" "${n}"
+                $IPSET destroy "${n}-tmp"
+                $IPSET list -t "${n}"
+        done
+}
+
+function _old_reload_cidr_sets(){
+	local sfx n s v
 	local set_name="$1"
+	shift
 
 	# init new temporary sets
 	echo "updating set '${set_name}'"
 
-	create_set "${set_name}-tmp" hash:net
-	create_set "${set_name}6-tmp" hash:net family inet6
+	create_set "${set_name}-tmp" hash:net "$@"
+	create_set "${set_name}6-tmp" hash:net "$@" family inet6
 
 	# populate them
 	for sfx in '' .$(hostname -s)
@@ -85,20 +153,20 @@ function reload_cidr_sets(){
 }
 
 function add_service_entry(){
-	local port/proto
-	port=$(echo "${s}" | cut -d/ -f1)
-	proto=$(echo "${s}" | cut -d/ -f2)
+	local port proto
+	port=$(echo "$1" | cut -d/ -f1)
+	proto=$(echo "$1" | cut -d/ -f2)
 	$IPSET -exist add allowed_${proto} ${port}
 }
 
 function allow_services(){
-	local s proto port
+	local s
 	for s in "$@"
 	do
 		case "${s}" in
 		*/*)	add_service_entry "${s}"
 			;;
-		*)	for svc in $(getent services "${s}" | awk '{print $2}')
+		*)	for svc in $(egrep "^${s}\s+" /etc/services | decommentcat | awk '{print $2}')
 			do
 				add_service_entry "${svc}"
 			done