suricata: Change midstream policy to "pass-flow"

[people/pmueller/ipfire-2.x.git] / tools / checkrootfiles

diff --git a/tools/checkrootfiles b/tools/checkrootfiles
index 74fab3e02310b6bce11bf37e8375f9bd02e7dea5..9437de6f14503b7b191774db2e734ba0535baa5c 100755 (executable)
--- a/tools/checkrootfiles
+++ b/tools/checkrootfiles
@@ -2,7 +2,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2007-2015  IPFire Team  info@ipfire.org                       #
+# Copyright (C) 2007-2023  IPFire Team  info@ipfire.org                       #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -19,30 +19,96 @@
 #                                                                             #
 ###############################################################################
 
-grep -r "^etc/init.d//*" ./config/rootfiles/ >/dev/null 2>&1
-if [ "${?}" == "0" ]; then
-       echo "Error! 'etc/init.d/...' in rootfiles files found!"
-       grep -r "^etc/init.d//*" ./config/rootfiles/
-       echo "Change this to 'etc/rc.d/init.d/...' !"
-fi
-
-grep -r "^var/run//*" ./config/rootfiles/ >/dev/null 2>&1
-if [ "${?}" == "0" ]; then
-       echo "Error! 'var/run/...' in rootfiles files found!"
-       grep -r "^var/run//*" ./config/rootfiles/
-       echo "Comment this and create it at initskript if needed !"
-fi
-
-grep -r "/i586" ./config/rootfiles/ --exclude gcc --exclude-dir oldcore >/dev/null 2>&1
-if [ "${?}" == "0" ]; then
-       echo "Error! '/i586' in rootfiles files found!"
-       grep -r "/i586" ./config/rootfiles/ --exclude gcc --exclude-dir oldcore
-       echo "Replace by MACHINE !"
-fi
-
-grep -r "/armv5tel" ./config/rootfiles/ --exclude gcc --exclude-dir oldcore >/dev/null 2>&1
-if [ "${?}" == "0" ]; then
-       echo "Error! '/armv5tel' in rootfiles files found!"
-       grep -r "/armv5tel" ./config/rootfiles/ --exclude gcc --exclude-dir oldcore
-       echo "Replace by MACHINE !"
-fi
+# All supported architectures
+ARCHES=(
+       aarch64
+       riscv64
+       x86_64
+)
+
+# A list of files that are not scanned
+# because they probably cause some false positives.
+EXCLUDED_FILES=(
+       qemu
+)
+
+ARGS=(
+       # Search path
+       "config/rootfiles"
+
+       # Exclude old core updates
+       "--exclude-dir" "oldcore"
+
+       # Ignore the update scripts
+       "--exclude" "update.sh"
+)
+
+check_for_arch() {
+       local arch="${1}"
+
+       local args=(
+               "${ARGS[@]}"
+       )
+
+       # Exclude any architecture-specific directories
+       local a
+       for a in ${ARCHES[@]}; do
+               args+=( "--exclude-dir" "${a}" )
+       done
+
+       # Exclude all excluded files
+       local x
+       for x in ${EXCLUDED_FILES[@]}; do
+               args+=( "--exclude" "${x}" )
+       done
+
+       # Search for all lines that contain the architecture, but exclude commented lines
+       grep -r "^[^#].*${arch}" "${args[@]}"
+}
+
+check_for_pattern() {
+       local pattern="${1}"
+       local message="${2}"
+
+       local args=(
+               "${ARGS[@]}"
+       )
+
+       if grep -r "${pattern}" "${args[@]}"; then
+               if [ -n "${message}" ]; then
+                       echo "ERROR: ${message}"
+               else
+                       echo "ERROR: Files matching '${pattern}' have been found in the rootfiles"
+               fi
+               return 1
+       fi
+
+       return 0
+}
+
+main() {
+       local failed=0
+
+       # Check for /etc/init.d
+       if ! check_for_pattern "^etc/init\.d/" \
+                       "/etc/init.d/* has been found. Please replace by /etc/rc.d/init.d"; then
+               failed=1
+       fi
+
+       # Check for /var/run
+       if ! check_for_pattern "^var/run/.*" \
+                       "You cannot ship files in /var/run as it is a ramdisk"; then
+               failed=1
+       fi
+
+       # Check architectures
+       local arch
+       for arch in ${ARCHES[@]}; do
+               check_for_arch "${arch}" || failed=$?
+       done
+
+       # Return the error
+       return ${failed}
+}
+
+main "$@" || exit $?