Blame SOURCES/iptables.init

621646
#!/bin/bash
621646
#
621646
# iptables	Start iptables firewall
621646
#
621646
# chkconfig: 2345 08 92
621646
# description:	Starts, stops and saves iptables firewall
621646
#
621646
# config: /etc/sysconfig/iptables
621646
# config: /etc/sysconfig/iptables-config
621646
#
621646
### BEGIN INIT INFO
621646
# Provides: iptables
621646
# Required-Start:
621646
# Required-Stop:
621646
# Default-Start: 2 3 4 5
621646
# Default-Stop: 0 1 6
621646
# Short-Description: start and stop iptables firewall
621646
# Description: Start, stop and save iptables firewall
621646
### END INIT INFO
621646
621646
# Source function library.
621646
. /etc/init.d/functions
621646
621646
IPTABLES=iptables
621646
IPTABLES_DATA=/etc/sysconfig/$IPTABLES
621646
IPTABLES_FALLBACK_DATA=${IPTABLES_DATA}.fallback
621646
IPTABLES_CONFIG=/etc/sysconfig/${IPTABLES}-config
621646
IPV=${IPTABLES%tables} # ip for ipv4 | ip6 for ipv6
621646
[ "$IPV" = "ip" ] && _IPV="ipv4" || _IPV="ipv6"
621646
VAR_SUBSYS_IPTABLES=/var/lock/subsys/$IPTABLES
621646
621646
# only usable for root
621646
if [ $EUID != 0 ]; then
621646
    echo -n $"${IPTABLES}: Only usable by root."; warning; echo
621646
    exit 4
621646
fi
621646
621646
if [ ! -x /sbin/$IPTABLES ]; then
621646
    echo -n $"${IPTABLES}: /sbin/$IPTABLES does not exist."; warning; echo
621646
    exit 5
621646
fi
621646
621646
# Default firewall configuration:
621646
IPTABLES_MODULES=""
621646
IPTABLES_SAVE_ON_STOP="no"
621646
IPTABLES_SAVE_ON_RESTART="no"
621646
IPTABLES_SAVE_COUNTER="no"
621646
IPTABLES_STATUS_NUMERIC="yes"
621646
IPTABLES_STATUS_VERBOSE="no"
621646
IPTABLES_STATUS_LINENUMBERS="yes"
621646
IPTABLES_SYSCTL_LOAD_LIST=""
621646
IPTABLES_RESTORE_WAIT=600
621646
IPTABLES_RESTORE_WAIT_INTERVAL=1000000
621646
621646
# Load firewall configuration.
621646
[ -f "$IPTABLES_CONFIG" ] && . "$IPTABLES_CONFIG"
621646
621646
# explicitly omit security table from this list as
621646
# it should be reserved for SELinux use
621646
NF_TABLES="raw mangle filter nat"
621646
621646
621646
flush_n_delete() {
621646
    # Flush firewall rules and delete chains.
621646
    echo -n $"${IPTABLES}: Flushing firewall rules: "
621646
    ret=0
621646
    # For all tables
621646
    for i in $NF_TABLES; do
621646
        # Flush firewall rules.
621646
	$IPTABLES -t $i -F;
621646
	let ret+=$?;
621646
621646
        # Delete firewall chains.
621646
	$IPTABLES -t $i -X;
621646
	let ret+=$?;
621646
621646
	# Set counter to zero.
621646
	$IPTABLES -t $i -Z;
621646
	let ret+=$?;
621646
    done
621646
621646
    [ $ret -eq 0 ] && success || failure
621646
    echo
621646
    return $ret
621646
}
621646
621646
set_policy() {
621646
    # Set policy for configured tables.
621646
    policy=$1
621646
    echo -n $"${IPTABLES}: Setting chains to policy $policy: "
621646
    ret=0
621646
    for i in $NF_TABLES; do
621646
	echo -n "$i "
621646
	case "$i" in
621646
	    raw)
621646
		$IPTABLES -t raw -P PREROUTING $policy \
621646
		    && $IPTABLES -t raw -P OUTPUT $policy \
621646
		    || let ret+=1
621646
		;;
621646
	    filter)
621646
                $IPTABLES -t filter -P INPUT $policy \
621646
		    && $IPTABLES -t filter -P OUTPUT $policy \
621646
		    && $IPTABLES -t filter -P FORWARD $policy \
621646
		    || let ret+=1
621646
		;;
621646
	    nat)
621646
		$IPTABLES -t nat -P PREROUTING $policy \
621646
		    && $IPTABLES -t nat -P POSTROUTING $policy \
621646
		    && $IPTABLES -t nat -P OUTPUT $policy \
621646
		    || let ret+=1
621646
		;;
621646
	    mangle)
621646
	        $IPTABLES -t mangle -P PREROUTING $policy \
621646
		    && $IPTABLES -t mangle -P POSTROUTING $policy \
621646
		    && $IPTABLES -t mangle -P INPUT $policy \
621646
		    && $IPTABLES -t mangle -P OUTPUT $policy \
621646
		    && $IPTABLES -t mangle -P FORWARD $policy \
621646
		    || let ret+=1
621646
		;;
621646
	    *)
621646
	        let ret+=1
621646
		;;
621646
        esac
621646
    done
621646
621646
    [ $ret -eq 0 ] && success || failure
621646
    echo
621646
    return $ret
621646
}
621646
621646
load_sysctl() {
621646
    # load matched sysctl values
621646
    if [ -n "$IPTABLES_SYSCTL_LOAD_LIST" ]; then
621646
        echo -n $"Loading sysctl settings: "
621646
        ret=0
621646
        for item in $IPTABLES_SYSCTL_LOAD_LIST; do
dddc5d
            fgrep -hs $item /etc/sysctl.d/*.conf | sysctl -p - >/dev/null
621646
            let ret+=$?;
621646
        done
621646
        [ $ret -eq 0 ] && success || failure
621646
        echo
621646
    fi
621646
    return $ret
621646
}
621646
621646
start() {
621646
    # Do not start if there is no config file.
621646
    if [ ! -f "$IPTABLES_DATA" ]; then
621646
	echo -n $"${IPTABLES}: No config file."; warning; echo
621646
	return 6
621646
    fi
621646
621646
    # check if ipv6 module load is deactivated
621646
    if [ "${_IPV}" = "ipv6" ] \
621646
	&& grep -qIsE "^install[[:space:]]+${_IPV}[[:space:]]+/bin/(true|false)" /etc/modprobe.conf /etc/modprobe.d/* ; then
621646
	echo $"${IPTABLES}: ${_IPV} is disabled."
621646
	return 150
621646
    fi
621646
621646
    echo -n $"${IPTABLES}: Applying firewall rules: "
621646
621646
    OPT=
621646
    [ "x$IPTABLES_SAVE_COUNTER" = "xyes" ] && OPT="-c"
621646
    if [ $IPTABLES_RESTORE_WAIT -ne 0 ]; then
621646
       OPT="${OPT} --wait ${IPTABLES_RESTORE_WAIT}"
621646
       if [ $IPTABLES_RESTORE_WAIT_INTERVAL -lt 1000000 ]; then
621646
           OPT="${OPT} --wait-interval ${IPTABLES_RESTORE_WAIT_INTERVAL}"
621646
       fi
621646
    fi
621646
621646
    $IPTABLES-restore $OPT $IPTABLES_DATA
621646
    if [ $? -eq 0 ]; then
621646
	success; echo
621646
    else
621646
	failure; echo;
621646
	if [ -f "$IPTABLES_FALLBACK_DATA" ]; then
621646
	    echo -n $"${IPTABLES}: Applying firewall fallback rules: "
621646
	    $IPTABLES-restore $OPT $IPTABLES_FALLBACK_DATA
621646
	    if [ $? -eq 0 ]; then
621646
		success; echo
621646
	    else
621646
		failure; echo; return 1
621646
	    fi
621646
	else
621646
	    return 1
621646
	fi
621646
    fi
621646
    
621646
    # Load additional modules (helpers)
621646
    if [ -n "$IPTABLES_MODULES" ]; then
621646
	echo -n $"${IPTABLES}: Loading additional modules: "
621646
	ret=0
621646
	for mod in $IPTABLES_MODULES; do
621646
	    echo -n "$mod "
621646
	    modprobe $mod > /dev/null 2>&1
621646
	    let ret+=$?;
621646
	done
621646
	[ $ret -eq 0 ] && success || failure
621646
	echo
621646
    fi
621646
    
621646
    # Load sysctl settings
621646
    load_sysctl
621646
621646
    touch $VAR_SUBSYS_IPTABLES
621646
    return $ret
621646
}
621646
621646
stop() {
621646
    # Set default chain policy to ACCEPT, in order to not break shutdown
621646
    # on systems where the default policy is DROP and root device is
621646
    # network-based (i.e.: iSCSI, NFS)
621646
    set_policy ACCEPT
621646
    # And then, flush the rules and delete chains
621646
    flush_n_delete
621646
    
621646
    rm -f $VAR_SUBSYS_IPTABLES
621646
    return $ret
621646
}
621646
621646
save() {
621646
    echo -n $"${IPTABLES}: Saving firewall rules to $IPTABLES_DATA: "
621646
621646
    OPT=
621646
    [ "x$IPTABLES_SAVE_COUNTER" = "xyes" ] && OPT="-c"
621646
621646
    ret=0
621646
    TMP_FILE=$(/bin/mktemp -q $IPTABLES_DATA.XXXXXX) \
621646
	&& chmod 600 "$TMP_FILE" \
621646
	&& $IPTABLES-save $OPT > $TMP_FILE 2>/dev/null \
621646
	&& size=$(stat -c '%s' $TMP_FILE) && [ $size -gt 0 ] \
621646
	|| ret=1
621646
    if [ $ret -eq 0 ]; then
621646
	if [ -e $IPTABLES_DATA ]; then
621646
	    cp -f $IPTABLES_DATA $IPTABLES_DATA.save \
621646
		&& chmod 600 $IPTABLES_DATA.save \
621646
		&& restorecon $IPTABLES_DATA.save \
621646
		|| ret=1
621646
	fi
621646
	if [ $ret -eq 0 ]; then
621646
	    mv -f $TMP_FILE $IPTABLES_DATA \
621646
		&& chmod 600 $IPTABLES_DATA \
621646
		&& restorecon $IPTABLES_DATA \
621646
	        || ret=1
621646
	fi
621646
    fi
621646
    rm -f $TMP_FILE
621646
    [ $ret -eq 0 ] && success || failure
621646
    echo
621646
    return $ret
621646
}
621646
621646
status() {
621646
    if [ ! -f "$VAR_SUBSYS_IPTABLES" ]; then
621646
	echo $"${IPTABLES}: Firewall is not running."
621646
	return 3
621646
    fi
621646
621646
    NUM=
621646
    [ "x$IPTABLES_STATUS_NUMERIC" = "xyes" ] && NUM="-n"
621646
    VERBOSE= 
621646
    [ "x$IPTABLES_STATUS_VERBOSE" = "xyes" ] && VERBOSE="--verbose"
621646
    COUNT=
621646
    [ "x$IPTABLES_STATUS_LINENUMBERS" = "xyes" ] && COUNT="--line-numbers"
621646
621646
    for table in $NF_TABLES; do
621646
	echo $"Table: $table"
621646
	$IPTABLES -t $table --list $NUM $VERBOSE $COUNT && echo
621646
    done
621646
621646
    return 0
621646
}
621646
621646
reload() {
621646
    # Do not reload if there is no config file.
621646
    if [ ! -f "$IPTABLES_DATA" ]; then
621646
	echo -n $"${IPTABLES}: No config file."; warning; echo
621646
	return 6
621646
    fi
621646
621646
    # check if ipv6 module load is deactivated
621646
    if [ "${_IPV}" = "ipv6" ] \
621646
	&& grep -qIsE "^install[[:space:]]+${_IPV}[[:space:]]+/bin/(true|false)" /etc/modprobe.conf /etc/modprobe.d/* ; then
621646
	echo $"${IPTABLES}: ${_IPV} is disabled."
621646
	return 150
621646
    fi
621646
621646
    echo -n $"${IPTABLES}: Trying to reload firewall rules: "
621646
621646
    OPT=
621646
    [ "x$IPTABLES_SAVE_COUNTER" = "xyes" ] && OPT="-c"
621646
    if [ $IPTABLES_RESTORE_WAIT -ne 0 ]; then
621646
       OPT="${OPT} --wait ${IPTABLES_RESTORE_WAIT}"
621646
       if [ $IPTABLES_RESTORE_WAIT_INTERVAL -lt 1000000 ]; then
621646
           OPT="${OPT} --wait-interval ${IPTABLES_RESTORE_WAIT_INTERVAL}"
621646
       fi
621646
    fi
621646
621646
    $IPTABLES-restore $OPT $IPTABLES_DATA
621646
    if [ $? -eq 0 ]; then
621646
	success; echo
621646
    else
621646
	failure; echo; echo "Firewall rules are not changed."; return 1
621646
    fi
621646
621646
    # Load additional modules (helpers)
621646
    if [ -n "$IPTABLES_MODULES" ]; then
621646
	echo -n $"${IPTABLES}: Loading additional modules: "
621646
	ret=0
621646
	for mod in $IPTABLES_MODULES; do
621646
	    echo -n "$mod "
621646
	    modprobe $mod > /dev/null 2>&1
621646
	    let ret+=$?;
621646
	done
621646
	[ $ret -eq 0 ] && success || failure
621646
	echo
621646
    fi
621646
621646
    # Load sysctl settings
621646
    load_sysctl
621646
621646
    return $ret
621646
}
621646
621646
restart() {
621646
    [ "x$IPTABLES_SAVE_ON_RESTART" = "xyes" ] && save
621646
    stop
621646
    start
621646
}
621646
621646
621646
case "$1" in
621646
    start)
621646
	[ -f "$VAR_SUBSYS_IPTABLES" ] && exit 0
621646
	start
621646
	RETVAL=$?
621646
	;;
621646
    stop)
621646
	[ "x$IPTABLES_SAVE_ON_STOP" = "xyes" ] && save
621646
	stop
621646
	RETVAL=$?
621646
	;;
621646
    restart|force-reload)
621646
	restart
621646
	RETVAL=$?
621646
	;;
621646
    reload)
621646
	[ -e "$VAR_SUBSYS_IPTABLES" ] && reload
621646
	RETVAL=$?
621646
	;;      
621646
    condrestart|try-restart)
621646
	[ ! -e "$VAR_SUBSYS_IPTABLES" ] && exit 0
621646
	restart
621646
	RETVAL=$?
621646
	;;
621646
    status)
621646
	status
621646
	RETVAL=$?
621646
	;;
621646
    panic)
621646
	set_policy DROP
621646
	RETVAL=$?
621646
        ;;
621646
    save)
621646
	save
621646
	RETVAL=$?
621646
	;;
621646
    *)
621646
	echo $"Usage: ${IPTABLES} {start|stop|reload|restart|condrestart|status|panic|save}"
621646
	RETVAL=2
621646
	;;
621646
esac
621646
621646
exit $RETVAL