Move all packages to root.

[people/arne_f/ipfire-3.x.git] / firewall / src / functions.iptables

#!/bin/bash
###############################################################################
#                                                                             #
# IPFire.org - A linux based firewall                                         #
# Copyright (C) 2009  Michael Tremer & Christian Schmidt                      #
#                                                                             #
# This program is free software: you can redistribute it and/or modify        #
# it under the terms of the GNU General Public License as published by        #
# the Free Software Foundation, either version 3 of the License, or           #
# (at your option) any later version.                                         #
#                                                                             #
# This program is distributed in the hope that it will be useful,             #
# but WITHOUT ANY WARRANTY; without even the implied warranty of              #
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
# GNU General Public License for more details.                                #
#                                                                             #
# You should have received a copy of the GNU General Public License           #
# along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
#                                                                             #
###############################################################################

IPTABLES_FILE=$TMPDIR/iptables

function iptables() {
	local arg
	local args
	local table

	table=filter

	# Parsing arguments
	while [ $# -gt 0 ]; do
		arg=${1}
		shift
		case "${arg}" in
			-t)
				table=${1}
				shift
				;;
			-A)
				args="${args} -A $(uppercase ${1})"
				shift
				;;
			*)
				args="${args} ${arg}"
				;;
		esac
	done
	echo "${args:1:${#args}}" >> ${IPTABLES_FILE}-${table}
}

function iptables_flush() {
	decho "Flushing iptables"
	iptables "* filter"
	chain_create INPUT ACCEPT
	chain_create OUTPUT ACCEPT
	chain_create FORWARD ACCEPT
}

function iptables_init() {
	iptables "* filter"
	chain_create -t filter INPUT       DROP
	chain_create -t filter OUTPUT      DROP
	chain_create -t filter FORWARD     DROP

	iptables -t mangle "* mangle"
	chain_create -t mangle PREROUTING  ACCEPT
	chain_create -t mangle INPUT       ACCEPT
	chain_create -t mangle OUTPUT      ACCEPT
	chain_create -t mangle FORWARD     ACCEPT
	chain_create -t mangle POSTROUTING ACCEPT

	iptables -t nat "* nat"
	chain_create -t nat    PREROUTING  ACCEPT
	chain_create -t nat    OUTPUT      ACCEPT
	chain_create -t nat    POSTROUTING ACCEPT
}

function iptables_commit() {
	local chain

	vecho "Committing firewall configuration."
	iptables -t filter "COMMIT"
	iptables -t mangle "COMMIT"
	iptables -t nat    "COMMIT"

	for table in filter mangle nat; do
		[ -e ${IPTABLES_FILE}-${table} ] || continue
		cat ${IPTABLES_FILE}-${table} >> $IPTABLES_FILE
	done

	decho "Dumping iptables output"
	if debug; then
		counter=1
		cat $IPTABLES_FILE | while read LINE; do
			printf "%4d | %s\n" "$counter" "$LINE"
			counter=$(( $counter + 1 ))
		done
	fi

	iptables-restore $(debug && echo "-v") < $IPTABLES_FILE
}

function chain_create() {
	local args
	if [ "${1}" = "-t" ]; then
		args="${1} ${2}"
		shift 2
	fi
	iptables ${args} ":$1 ${2--} [0:0]"
}

function iptables_LOG() {
	local prefix
	prefix=$1

	if [ "$LOG_FACILITY" = "syslog" ]; then
		echo -n "LOG"
		[ -n "$prefix" ] && echo -n " --log-prefix \"$prefix\""
	else
		echo -n "NFLOG"
		[ -n "$prefix" ] && echo -n " --nflog-prefix \"$prefix\""
		echo -n " --nflog-threshold 30"
	fi
	echo
}

function iptables_protocol() {
	local PROTO
	PROTO=$1
	for proto in tcp udp esp ah; do
		if [ "$PROTO" = "$proto" ]; then
			echo "-p $PROTO"
			break
		fi
	done
}

IPTABLES_PORT=0
IPTABLES_MULTIPORT=1
IPTABLES_PORTRANGE=2

function _iptables_port_range() {
	grep -q ":" <<< $@
}

function _iptables_port_multiport() {
	grep -q "," <<< $@
}

function _iptables_port() {
	if _iptables_port_range "$@"; then
		echo $IPTABLES_PORTRANGE
	elif _iptables_port_multiport "$@"; then
		echo $IPTABLES_MULTIPORT
	else
		echo $IPTABLES_PORT
	fi
}

function iptables_source_port() {
	[ -z "$@" ] && return
	local type
	type=$(_iptables_port $@)
	if [ "$type" = "$IPTABLES_MULTIPORT" ]; then
		echo "-m multiport --source-ports $@"
	else
		echo "--sport $@"
	fi
}

function iptables_destination_port() {
	[ -z "$@" ] && return
	local type
	type=$(_iptables_port $@)
	if [ "$type" = "$IPTABLES_MULTIPORT" ]; then
		echo "-m multiport --destination-ports $@"
	else
		echo "--dport $@"
	fi
}