saswall


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152

#!/bin/bash -e
#
# saswall
#
# saswall is a simple and safe firewall loader. After reloading a
# new ruleset it asks for a confirmation and reverts all changes if
# this confirmation times out.
#
# Copyright (C) 2013 Christian Pointner <equinox@spreadspace.org>
#
# This file is part of saswall.
#
# saswall is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 2 of the License, or
# any later version.
#
# saswall is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with saswall. If not, see <http://www.gnu.org/licenses/>.
#
##
## !! Don't add any firewall rules here !!
##  edit /etc/saswall/rules.sh instead
##
##

SASWALL_CONFIRM_TIMEOUT=20 # may get overwritten by rules.sh!!

if [ ! -x /etc/saswall/rules.sh ]; then
  echo "no rules file found or script is not executeable - firewall is disabled!!"
  exit 0
fi

trap saswall_signal INT TERM
trap saswall_exit EXIT

. /etc/saswall/rules.sh

saswall_signal()
{
  echo ""
  echo "saswall terminates after signal"
  saswall_restore
  exit 1
}

saswall_exit()
{
  if [ -n "$SASWALL_BACKUP" ] || [ -n "$SASWALL_BACKUP6" ]; then
    echo ""
    echo "saswall terminates after error"
    saswall_restore
    exit 1
  fi
}

saswall_up()
{
  echo -n "IPv4("
    ipv4_up
  echo -n ") "
  echo -n "IPv6("
    ipv6_up
  echo -n ") "
}

saswall_down()
{
  echo -n "IPv4("
    ipv4_down
  echo -n ") "
  echo -n "IPv6("
    ipv6_down
  echo -n ") "
}

saswall_backup()
{
  SASWALL_BACKUP=`/bin/mktemp /tmp/saswall-rules.XXXXXXXXXX`
  echo "storing current IPv4 ruleset to $SASWALL_BACKUP"
  /sbin/iptables-save -c > $SASWALL_BACKUP

  SASWALL_BACKUP6=`/bin/mktemp /tmp/saswall-rules.XXXXXXXXXX`
  echo "storing current IPv6 ruleset to $SASWALL_BACKUP6"
  /sbin/ip6tables-save -c > $SASWALL_BACKUP6
}

saswall_restore()
{
  if [ -n "$SASWALL_BACKUP" ]; then
    echo "restoring IPv4 ruleset from $SASWALL_BACKUP"
    /sbin/iptables-restore -c < $SASWALL_BACKUP
    rm -f $SASWALL_BACKUP
    SASWALL_BACKUP=""
  fi
  if [ -n "$SASWALL_BACKUP6" ]; then
    echo "restoring IPv6 ruleset from $SASWALL_BACKUP6"
    /sbin/ip6tables-restore -c < $SASWALL_BACKUP6
    rm -f $SASWALL_BACKUP6
    SASWALL_BACKUP6=""
  fi
}

saswall_check_or_fallback()
{
  set +e
  if [ -z "$SASWALL_USE_SYSTEM_ASK_PASSWD" ]; then
    read -t $SASWALL_CONFIRM_TIMEOUT -p "To confirm changes type yes [ENTER]: " saswall_confirmation
  else
    saswall_confirmation=`systemd-ask-password --timeout=$SASWALL_CONFIRM_TIMEOUT "To confirm saswall changes type yes [ENTER]: "`
  fi
  if [ "$saswall_confirmation" != "yes" ]; then
    echo "no or wrong confirmation received"
    saswall_restore
    exit 1
  else
    echo "ruleset reloaded successfully"
    rm -f $SASWALL_BACKUP
    SASWALL_BACKUP=""
    rm -f $SASWALL_BACKUP6
    SASWALL_BACKUP6=""
  fi
}

case "$1" in
up)
  saswall_up
  ;;
down)
  saswall_down
  ;;
reload)
  saswall_backup
  echo -n "down: "
  saswall_down
  echo -n " ... up: "
  saswall_up
  echo ""
  saswall_check_or_fallback
  ;;
*)
  echo "Usage: $0 {up|down|reload}"
  exit 1
  ;;
esac

exit 0