mirror of
https://github.com/vincentmli/bpfire.git
synced 2026-04-23 17:32:57 +02:00
Alle Restartskripte umbenannt in CTRL Skripte
git-svn-id: http://svn.ipfire.org/svn/ipfire/trunk@812 ea5c0bd1-69bd-2848-81d8-4f18e57aeed8
This commit is contained in:
maniacikarus
@@ -42,7 +42,7 @@ init_networking() {
|
||||
|
||||
if [ "$CONFIG_TYPE" = "3" -o "$CONFIG_TYPE" = "4" ]; then
|
||||
boot_mesg "Setting up wireless firewall rules"
|
||||
/usr/local/bin/restartwireless; evaluate_retval
|
||||
/usr/local/bin/wirelessctrl; evaluate_retval
|
||||
fi
|
||||
|
||||
/etc/rc.d/init.d/dnsmasq start
|
||||
|
||||
@@ -5,12 +5,12 @@ COMPILE=$(CC) $(CFLAGS)
|
||||
|
||||
PROGS = iowrap
|
||||
SUID_PROGS = setdmzholes setportfw setxtaccess \
|
||||
squidctrl restartssh ipfirereboot \
|
||||
squidctrl sshctrl ipfirereboot \
|
||||
ipsecctrl timectrl dhcpctrl snortctrl \
|
||||
applejuicectrl rebuildhosts backupctrl \
|
||||
logwatch openvpnctrl outgoingfwctrl \
|
||||
restartwireless getipstat qosctrl launch-ether-wake \
|
||||
redctrl restartsyslogd extrahdctrl sambactrl upnpctrl tripwirectrl \
|
||||
wirelessctrl getipstat qosctrl launch-ether-wake \
|
||||
redctrl syslogdctrl extrahdctrl sambactrl upnpctrl tripwirectrl \
|
||||
smartctrl clamavctrl pakfire mpfirectrl
|
||||
|
||||
install : all
|
||||
@@ -88,8 +88,8 @@ applejuicectrl: applejuicectrl.c setuid.o ../install+setup/libsmooth/varval.o
|
||||
dhcpctrl: dhcpctrl.c setuid.o ../install+setup/libsmooth/varval.o
|
||||
$(COMPILE) -I../install+setup/libsmooth/ dhcpctrl.c setuid.o ../install+setup/libsmooth/varval.o -o $@
|
||||
|
||||
restartssh: restartssh.c setuid.o ../install+setup/libsmooth/varval.o
|
||||
$(COMPILE) -I../install+setup/libsmooth/ restartssh.c setuid.o ../install+setup/libsmooth/varval.o -o $@
|
||||
sshctrl: sshctrl.c setuid.o ../install+setup/libsmooth/varval.o
|
||||
$(COMPILE) -I../install+setup/libsmooth/ sshctrl.c setuid.o ../install+setup/libsmooth/varval.o -o $@
|
||||
|
||||
squidctrl: squidctrl.c setuid.o ../install+setup/libsmooth/varval.o
|
||||
$(COMPILE) -I../install+setup/libsmooth/ squidctrl.c setuid.o ../install+setup/libsmooth/varval.o -o $@
|
||||
@@ -97,8 +97,8 @@ squidctrl: squidctrl.c setuid.o ../install+setup/libsmooth/varval.o
|
||||
snortctrl: snortctrl.c setuid.o ../install+setup/libsmooth/varval.o
|
||||
$(COMPILE) -I../install+setup/libsmooth/ snortctrl.c setuid.o ../install+setup/libsmooth/varval.o -o $@
|
||||
|
||||
restartwireless: restartwireless.c setuid.o ../install+setup/libsmooth/varval.o
|
||||
$(COMPILE) -I../install+setup/libsmooth/ restartwireless.c setuid.o ../install+setup/libsmooth/varval.o -o $@
|
||||
wirelessctrl: wirelessctrl.c setuid.o ../install+setup/libsmooth/varval.o
|
||||
$(COMPILE) -I../install+setup/libsmooth/ wirelessctrl.c setuid.o ../install+setup/libsmooth/varval.o -o $@
|
||||
|
||||
ipsecctrl: ipsecctrl.c setuid.o ../install+setup/libsmooth/varval.o
|
||||
$(COMPILE) -I../install+setup/libsmooth/ ipsecctrl.c setuid.o ../install+setup/libsmooth/varval.o -o $@
|
||||
@@ -115,5 +115,5 @@ mpfirectrl: mpfirectrl.c setuid.o ../install+setup/libsmooth/varval.o
|
||||
backupctrl: backupctrl.c setuid.o ../install+setup/libsmooth/varval.o
|
||||
$(COMPILE) -I../install+setup/libsmooth/ backupctrl.c setuid.o ../install+setup/libsmooth/varval.o -o $@
|
||||
|
||||
restartsyslogd: restartsyslogd.c setuid.o ../install+setup/libsmooth/varval.o
|
||||
$(COMPILE) -I../install+setup/libsmooth/ restartsyslogd.c setuid.o ../install+setup/libsmooth/varval.o -o $@
|
||||
syslogdctrl: syslogdctrl.c setuid.o ../install+setup/libsmooth/varval.o
|
||||
$(COMPILE) -I../install+setup/libsmooth/ syslogdctrl.c setuid.o ../install+setup/libsmooth/varval.o -o $@
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
/* SmoothWall helper program - restartssh
|
||||
/* SmoothWall helper program - sshctrl
|
||||
*
|
||||
* This program is distributed under the terms of the GNU General Public
|
||||
* Licence. See the file COPYING for details.
|
||||
@@ -7,7 +7,7 @@
|
||||
* Simple program intended to be installed setuid(0) that can be used for
|
||||
* restarting SSHd.
|
||||
*
|
||||
* $Id: restartssh.c,v 1.3 2003/12/11 10:57:34 riddles Exp $
|
||||
* $Id: sshctrl.c,v 1.3 2003/12/11 10:57:34 riddles Exp $
|
||||
*
|
||||
*/
|
||||
|
||||
@@ -25,18 +25,18 @@
|
||||
int main(int argc, char *argv[])
|
||||
{
|
||||
if (strcmp(argv[1], "tempstart15") == 0) {
|
||||
safe_system("/usr/local/bin/restartssh");
|
||||
safe_system("/usr/local/bin/sshctrl");
|
||||
sleep(5);
|
||||
unlink("/var/ipfire/remote/enablessh");
|
||||
safe_system("cat /var/ipfire/remote/settings | sed 's/ENABLE_SSH=on/ENABLE_SSH=off/' > /var/ipfire/remote/settings2 && mv /var/ipfire/remote/settings2 /var/ipfire/remote/settings");
|
||||
safe_system("sleep 900 && /usr/local/bin/restartssh &");
|
||||
safe_system("sleep 900 && /usr/local/bin/sshctrl &");
|
||||
}
|
||||
else if (strcmp(argv[1], "tempstart30") == 0) {
|
||||
safe_system("/usr/local/bin/restartssh");
|
||||
safe_system("/usr/local/bin/sshctrl");
|
||||
sleep(5);
|
||||
unlink("/var/ipfire/remote/enablessh");
|
||||
safe_system("cat /var/ipfire/remote/settings | sed 's/ENABLE_SSH=on/ENABLE_SSH=off/' > /var/ipfire/remote/settings2 && mv /var/ipfire/remote/settings2 /var/ipfire/remote/settings");
|
||||
safe_system("sleep 1800 && /usr/local/bin/restartssh &");
|
||||
safe_system("sleep 1800 && /usr/local/bin/sshctrl &");
|
||||
} else {
|
||||
int fd, config_fd, rc, pid;
|
||||
char buffer[STRING_SIZE], command[STRING_SIZE] = "/bin/sed -e '";
|
||||
@@ -53,7 +53,7 @@ int main(int argc, char *argv[])
|
||||
}
|
||||
|
||||
/* By using O_CREAT with O_EXCL open() will fail if the file already exists,
|
||||
* this prevents 2 copies of restartssh both trying to edit the config file
|
||||
* this prevents 2 copies of sshctrl both trying to edit the config file
|
||||
* at once. It also prevents race conditions, but these shouldn't be
|
||||
* possible as /etc/ssh/ should only be writable by root anyhow
|
||||
*/
|
||||
@@ -1,147 +1,147 @@
|
||||
/* IPCop helper program - restartwireless
|
||||
*
|
||||
* This program is distributed under the terms of the GNU General Public
|
||||
* Licence. See the file COPYING for details.
|
||||
*
|
||||
* (c) Alan Hourihane, 2003
|
||||
*
|
||||
* $Id: restartwireless.c,v 1.2.2.5 2005/07/11 10:56:47 franck78 Exp $
|
||||
*
|
||||
*/
|
||||
|
||||
#include "libsmooth.h"
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <unistd.h>
|
||||
#include <fcntl.h>
|
||||
#include <string.h>
|
||||
#include <sys/types.h>
|
||||
#include <sys/stat.h>
|
||||
#include <signal.h>
|
||||
#include "setuid.h"
|
||||
|
||||
FILE *fd = NULL;
|
||||
char blue_dev[STRING_SIZE] = "";
|
||||
char command[STRING_SIZE];
|
||||
|
||||
void exithandler(void)
|
||||
{
|
||||
if(strlen(blue_dev))
|
||||
{
|
||||
snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSINPUT -i %s -j LOG_DROP", blue_dev);
|
||||
safe_system(command);
|
||||
snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -i %s -j LOG_DROP", blue_dev);
|
||||
safe_system(command);
|
||||
}
|
||||
|
||||
if (fd)
|
||||
fclose(fd);
|
||||
}
|
||||
|
||||
int main(void)
|
||||
{
|
||||
char green_dev[STRING_SIZE] = "";
|
||||
char buffer[STRING_SIZE];
|
||||
char *index, *ipaddress, *macaddress, *enabled;
|
||||
struct keyvalue *kv = NULL;
|
||||
|
||||
if (!(initsetuid()))
|
||||
exit(1);
|
||||
|
||||
/* flush wireless iptables */
|
||||
safe_system("/sbin/iptables -F WIRELESSINPUT > /dev/null 2> /dev/null");
|
||||
safe_system("/sbin/iptables -F WIRELESSFORWARD > /dev/null 2> /dev/null");
|
||||
|
||||
memset(buffer, 0, STRING_SIZE);
|
||||
|
||||
/* Init the keyvalue structure */
|
||||
kv=initkeyvalues();
|
||||
|
||||
/* Read in the current values */
|
||||
if (!readkeyvalues(kv, CONFIG_ROOT "/ethernet/settings"))
|
||||
{
|
||||
fprintf(stderr, "Cannot read ethernet settings\n");
|
||||
exit(1);
|
||||
}
|
||||
|
||||
/* Get the GREEN interface details */
|
||||
if(!findkey(kv, "GREEN_DEV", green_dev))
|
||||
{
|
||||
fprintf(stderr, "Cannot read GREEN_DEV\n");
|
||||
exit(1);
|
||||
}
|
||||
if (!VALID_DEVICE(green_dev))
|
||||
{
|
||||
fprintf(stderr, "Bad GREEN_DEV: %s\n", green_dev);
|
||||
exit(1);
|
||||
}
|
||||
/* Get the BLUE interface details */
|
||||
if(!findkey(kv, "BLUE_DEV", blue_dev))
|
||||
{
|
||||
fprintf(stderr, "Cannot read BLUE_DEV\n");
|
||||
exit(1);
|
||||
}
|
||||
if (strlen(blue_dev) && !VALID_DEVICE(blue_dev))
|
||||
{
|
||||
fprintf(stderr, "Bad BLUE_DEV: %s\n", blue_dev);
|
||||
exit(1);
|
||||
}
|
||||
if(! strlen(blue_dev) > 0)
|
||||
{
|
||||
fprintf(stderr, "No BLUE interface\n");
|
||||
exit(0);
|
||||
}
|
||||
|
||||
/* register exit handler to ensure the block rule is always present */
|
||||
atexit(exithandler);
|
||||
|
||||
if (!(fd = fopen(CONFIG_ROOT "/wireless/config", "r")))
|
||||
{
|
||||
exit(0);
|
||||
}
|
||||
while (fgets(buffer, STRING_SIZE, fd))
|
||||
{
|
||||
buffer[strlen(buffer) - 1] = 0;
|
||||
|
||||
index = strtok(buffer, ",");
|
||||
ipaddress = strtok(NULL, ",");
|
||||
macaddress = strtok(NULL, ",");
|
||||
enabled = strtok(NULL, ",");
|
||||
|
||||
if (!strncmp(enabled, "on", 2)) {
|
||||
|
||||
/* both specified, added security */
|
||||
if ((strlen(macaddress) == 17) &&
|
||||
(VALID_IP(ipaddress))) {
|
||||
snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSINPUT -m mac --mac-source %s -s %s -i %s -j ACCEPT", macaddress, ipaddress, blue_dev);
|
||||
safe_system(command);
|
||||
snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -m mac --mac-source %s -s %s -i %s -o ! %s -j ACCEPT", macaddress, ipaddress, blue_dev, green_dev);
|
||||
safe_system(command);
|
||||
snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -m mac --mac-source %s -s %s -i %s -j DMZHOLES", macaddress, ipaddress, blue_dev);
|
||||
safe_system(command);
|
||||
} else {
|
||||
|
||||
/* correctly formed mac address is 17 chars */
|
||||
if (strlen(macaddress) == 17) {
|
||||
snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSINPUT -m mac --mac-source %s -i %s -j ACCEPT", macaddress, blue_dev);
|
||||
safe_system(command);
|
||||
snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -m mac --mac-source %s -i %s -o ! %s -j ACCEPT", macaddress, blue_dev, green_dev);
|
||||
safe_system(command);
|
||||
snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -m mac --mac-source %s -i %s -j DMZHOLES", macaddress, blue_dev);
|
||||
safe_system(command);
|
||||
}
|
||||
|
||||
if (VALID_IP(ipaddress)) {
|
||||
snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSINPUT -s %s -i %s -j ACCEPT", ipaddress, blue_dev);
|
||||
safe_system(command);
|
||||
snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -s %s -i %s -o ! %s -j ACCEPT", ipaddress, blue_dev, green_dev);
|
||||
safe_system(command);
|
||||
snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -s %s -i %s -j DMZHOLES", ipaddress, blue_dev);
|
||||
safe_system(command);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
/* IPCop helper program - wirelessctrl
|
||||
*
|
||||
* This program is distributed under the terms of the GNU General Public
|
||||
* Licence. See the file COPYING for details.
|
||||
*
|
||||
* (c) Alan Hourihane, 2003
|
||||
*
|
||||
* $Id: wirelessctrl.c,v 1.2.2.5 2005/07/11 10:56:47 franck78 Exp $
|
||||
*
|
||||
*/
|
||||
|
||||
#include "libsmooth.h"
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <unistd.h>
|
||||
#include <fcntl.h>
|
||||
#include <string.h>
|
||||
#include <sys/types.h>
|
||||
#include <sys/stat.h>
|
||||
#include <signal.h>
|
||||
#include "setuid.h"
|
||||
|
||||
FILE *fd = NULL;
|
||||
char blue_dev[STRING_SIZE] = "";
|
||||
char command[STRING_SIZE];
|
||||
|
||||
void exithandler(void)
|
||||
{
|
||||
if(strlen(blue_dev))
|
||||
{
|
||||
snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSINPUT -i %s -j LOG_DROP", blue_dev);
|
||||
safe_system(command);
|
||||
snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -i %s -j LOG_DROP", blue_dev);
|
||||
safe_system(command);
|
||||
}
|
||||
|
||||
if (fd)
|
||||
fclose(fd);
|
||||
}
|
||||
|
||||
int main(void)
|
||||
{
|
||||
char green_dev[STRING_SIZE] = "";
|
||||
char buffer[STRING_SIZE];
|
||||
char *index, *ipaddress, *macaddress, *enabled;
|
||||
struct keyvalue *kv = NULL;
|
||||
|
||||
if (!(initsetuid()))
|
||||
exit(1);
|
||||
|
||||
/* flush wireless iptables */
|
||||
safe_system("/sbin/iptables -F WIRELESSINPUT > /dev/null 2> /dev/null");
|
||||
safe_system("/sbin/iptables -F WIRELESSFORWARD > /dev/null 2> /dev/null");
|
||||
|
||||
memset(buffer, 0, STRING_SIZE);
|
||||
|
||||
/* Init the keyvalue structure */
|
||||
kv=initkeyvalues();
|
||||
|
||||
/* Read in the current values */
|
||||
if (!readkeyvalues(kv, CONFIG_ROOT "/ethernet/settings"))
|
||||
{
|
||||
fprintf(stderr, "Cannot read ethernet settings\n");
|
||||
exit(1);
|
||||
}
|
||||
|
||||
/* Get the GREEN interface details */
|
||||
if(!findkey(kv, "GREEN_DEV", green_dev))
|
||||
{
|
||||
fprintf(stderr, "Cannot read GREEN_DEV\n");
|
||||
exit(1);
|
||||
}
|
||||
if (!VALID_DEVICE(green_dev))
|
||||
{
|
||||
fprintf(stderr, "Bad GREEN_DEV: %s\n", green_dev);
|
||||
exit(1);
|
||||
}
|
||||
/* Get the BLUE interface details */
|
||||
if(!findkey(kv, "BLUE_DEV", blue_dev))
|
||||
{
|
||||
fprintf(stderr, "Cannot read BLUE_DEV\n");
|
||||
exit(1);
|
||||
}
|
||||
if (strlen(blue_dev) && !VALID_DEVICE(blue_dev))
|
||||
{
|
||||
fprintf(stderr, "Bad BLUE_DEV: %s\n", blue_dev);
|
||||
exit(1);
|
||||
}
|
||||
if(! strlen(blue_dev) > 0)
|
||||
{
|
||||
fprintf(stderr, "No BLUE interface\n");
|
||||
exit(0);
|
||||
}
|
||||
|
||||
/* register exit handler to ensure the block rule is always present */
|
||||
atexit(exithandler);
|
||||
|
||||
if (!(fd = fopen(CONFIG_ROOT "/wireless/config", "r")))
|
||||
{
|
||||
exit(0);
|
||||
}
|
||||
while (fgets(buffer, STRING_SIZE, fd))
|
||||
{
|
||||
buffer[strlen(buffer) - 1] = 0;
|
||||
|
||||
index = strtok(buffer, ",");
|
||||
ipaddress = strtok(NULL, ",");
|
||||
macaddress = strtok(NULL, ",");
|
||||
enabled = strtok(NULL, ",");
|
||||
|
||||
if (!strncmp(enabled, "on", 2)) {
|
||||
|
||||
/* both specified, added security */
|
||||
if ((strlen(macaddress) == 17) &&
|
||||
(VALID_IP(ipaddress))) {
|
||||
snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSINPUT -m mac --mac-source %s -s %s -i %s -j ACCEPT", macaddress, ipaddress, blue_dev);
|
||||
safe_system(command);
|
||||
snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -m mac --mac-source %s -s %s -i %s -o ! %s -j ACCEPT", macaddress, ipaddress, blue_dev, green_dev);
|
||||
safe_system(command);
|
||||
snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -m mac --mac-source %s -s %s -i %s -j DMZHOLES", macaddress, ipaddress, blue_dev);
|
||||
safe_system(command);
|
||||
} else {
|
||||
|
||||
/* correctly formed mac address is 17 chars */
|
||||
if (strlen(macaddress) == 17) {
|
||||
snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSINPUT -m mac --mac-source %s -i %s -j ACCEPT", macaddress, blue_dev);
|
||||
safe_system(command);
|
||||
snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -m mac --mac-source %s -i %s -o ! %s -j ACCEPT", macaddress, blue_dev, green_dev);
|
||||
safe_system(command);
|
||||
snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -m mac --mac-source %s -i %s -j DMZHOLES", macaddress, blue_dev);
|
||||
safe_system(command);
|
||||
}
|
||||
|
||||
if (VALID_IP(ipaddress)) {
|
||||
snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSINPUT -s %s -i %s -j ACCEPT", ipaddress, blue_dev);
|
||||
safe_system(command);
|
||||
snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -s %s -i %s -o ! %s -j ACCEPT", ipaddress, blue_dev, green_dev);
|
||||
safe_system(command);
|
||||
snprintf(command, STRING_SIZE-1, "/sbin/iptables -A WIRELESSFORWARD -s %s -i %s -j DMZHOLES", ipaddress, blue_dev);
|
||||
safe_system(command);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
Reference in New Issue
Block a user