IPsec: Rename ipsec-block script to ipsec-policy

This is a more general name for a script that will be extended
soon to do more than just add blocking rules.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

diff --git a/config/firewall/ipsec-block b/config/firewall/ipsec-policy
similarity index 88%
rename from config/firewall/ipsec-block
rename to config/firewall/ipsec-policy
index 96682b8943e3c24ed4fd2ef9afee81eca0fd3e26..4544a447d0bb294f62e75df9bfa8c3047df21570 100644 (file)
--- a/config/firewall/ipsec-block
+++ b/config/firewall/ipsec-policy
@@ -21,6 +21,13 @@
 
 VPN_CONFIG="/var/ipfire/vpn/config"
 
 
 VPN_CONFIG="/var/ipfire/vpn/config"
 

+VARS=(
+       id status name lefthost type ctype x1 x2 x3 leftsubnets
+       x4 righthost rightsubnets x5 x6 x7 x8 x9 x10 x11 x12
+       x13 x14 x15 x16 x17 x18 x19 x20 x21 proto x22 x23 x24
+       route rest
+)
+

 block_subnet() {
        local subnet="${1}"
        local action="${2}"
 block_subnet() {
        local subnet="${1}"
        local action="${2}"


@@ -45,21 +52,15 @@ block_subnet() {
        return 0
 }
 
        return 0
 }
 

-block_ipsec() {
+install_policy() {

        # Flush all exists rules
        iptables -F IPSECBLOCK
 
        # Flush all exists rules
        iptables -F IPSECBLOCK
 

-       local action
-
-       local vars="id status name lefthost type ctype x1 x2 x3 leftsubnets"
-       vars="${vars} x4 righthost rightsubnets x5 x6 x7 x8 x9 x10 x11 x12"
-       vars="${vars} x13 x14 x15 x16 x17 x18 x19 x20 x21 proto x22 x23 x24"
-       vars="${vars} route rest"
-

        # Register local variables
        # Register local variables

-       local ${vars}
+       local "${VARS[@]}"
+       local action

 
 

-       while IFS="," read -r ${vars}; do
+       while IFS="," read -r "${VARS[@]}"; do

                # Check if the connection is enabled
                [ "${status}" = "on" ] || continue
 
                # Check if the connection is enabled
                [ "${status}" = "on" ] || continue
 


@@ -85,4 +86,4 @@ block_ipsec() {
        done < "${VPN_CONFIG}"
 }
 
        done < "${VPN_CONFIG}"
 }
 

-block_ipsec || exit $?
+install_policy || exit $?

diff --git a/config/rootfiles/common/aarch64/stage2 b/config/rootfiles/common/aarch64/stage2
index 110114c478482e0dbc4ad67bc1ab2be81e51e165..0c2552f4fe638967455eb1725894478900d4b87f 100644 (file)
--- a/config/rootfiles/common/aarch64/stage2
+++ b/config/rootfiles/common/aarch64/stage2
@@ -76,7 +76,7 @@ usr/bin/captive-cleanup
 #usr/lib
 usr/lib/firewall
 usr/lib/firewall/firewall-lib.pl
 #usr/lib
 usr/lib/firewall
 usr/lib/firewall/firewall-lib.pl

-usr/lib/firewall/ipsec-block
+usr/lib/firewall/ipsec-policy

 usr/lib/firewall/rules.pl
 #usr/lib/libgcc_s.so
 usr/lib/libgcc_s.so.1
 usr/lib/firewall/rules.pl
 #usr/lib/libgcc_s.so
 usr/lib/libgcc_s.so.1

diff --git a/config/rootfiles/common/stage2 b/config/rootfiles/common/stage2
index 5665f230129c36fa2829d266b2f3d44b5b90bc44..7b4dbaa5dd9f4859d3b58c2fa2d89a33d9edd117 100644 (file)
--- a/config/rootfiles/common/stage2
+++ b/config/rootfiles/common/stage2
@@ -75,7 +75,7 @@ usr/bin/captive-cleanup
 #usr/lib
 usr/lib/firewall
 usr/lib/firewall/firewall-lib.pl
 #usr/lib
 usr/lib/firewall
 usr/lib/firewall/firewall-lib.pl

-usr/lib/firewall/ipsec-block
+usr/lib/firewall/ipsec-policy

 usr/lib/firewall/rules.pl
 #usr/lib/libgcc_s.so
 usr/lib/libgcc_s.so.1
 usr/lib/firewall/rules.pl
 #usr/lib/libgcc_s.so
 usr/lib/libgcc_s.so.1

diff --git a/config/rootfiles/common/x86_64/stage2 b/config/rootfiles/common/x86_64/stage2
index 110114c478482e0dbc4ad67bc1ab2be81e51e165..0c2552f4fe638967455eb1725894478900d4b87f 100644 (file)
--- a/config/rootfiles/common/x86_64/stage2
+++ b/config/rootfiles/common/x86_64/stage2
@@ -76,7 +76,7 @@ usr/bin/captive-cleanup
 #usr/lib
 usr/lib/firewall
 usr/lib/firewall/firewall-lib.pl
 #usr/lib
 usr/lib/firewall
 usr/lib/firewall/firewall-lib.pl

-usr/lib/firewall/ipsec-block
+usr/lib/firewall/ipsec-policy

 usr/lib/firewall/rules.pl
 #usr/lib/libgcc_s.so
 usr/lib/libgcc_s.so.1
 usr/lib/firewall/rules.pl
 #usr/lib/libgcc_s.so
 usr/lib/libgcc_s.so.1

diff --git a/lfs/stage2 b/lfs/stage2
index 7e8dfe3169d09cad8763d82e6e7e5ec7e2d3fee7..4b8f0bc811171cf684618d8754c335de1311db92 100644 (file)
--- a/lfs/stage2
+++ b/lfs/stage2
@@ -115,8 +115,8 @@ endif
                /usr/lib/firewall/rules.pl
        install -m 644 $(DIR_SRC)/config/firewall/firewall-lib.pl \
                /usr/lib/firewall/firewall-lib.pl
                /usr/lib/firewall/rules.pl
        install -m 644 $(DIR_SRC)/config/firewall/firewall-lib.pl \
                /usr/lib/firewall/firewall-lib.pl

-       install -m 755 $(DIR_SRC)/config/firewall/ipsec-block \
-               /usr/lib/firewall/ipsec-block
+       install -m 755 $(DIR_SRC)/config/firewall/ipsec-policy \
+               /usr/lib/firewall/ipsec-policy

 
        # Nobody user
        -mkdir -p /home/nobody
 
        # Nobody user
        -mkdir -p /home/nobody

diff --git a/src/initscripts/system/firewall b/src/initscripts/system/firewall
index 707209987e46fee56fcaca2c111a6a2c00f61235..1ffeda993bbd3ee82235c599ddef3bc7089dbe45 100644 (file)
--- a/src/initscripts/system/firewall
+++ b/src/initscripts/system/firewall
@@ -360,8 +360,8 @@ iptables_init() {
        iptables -t nat -N REDNAT
        iptables -t nat -A POSTROUTING -j REDNAT
 
        iptables -t nat -N REDNAT
        iptables -t nat -A POSTROUTING -j REDNAT
 

-       # Populate IPsec block chain
-       /usr/lib/firewall/ipsec-block
+       # Populate IPsec chains
+       /usr/lib/firewall/ipsec-policy

 
        # Apply OpenVPN firewall rules
        /usr/local/bin/openvpnctrl --firewall-rules
 
        # Apply OpenVPN firewall rules
        /usr/local/bin/openvpnctrl --firewall-rules

diff --git a/src/misc-progs/ipsecctrl.c b/src/misc-progs/ipsecctrl.c
index 9afc409ca96c2792a10f6750143f6b58038dd1f7..53c87673af14f8f21c69fcef8674c162836d5b3c 100644 (file)
--- a/src/misc-progs/ipsecctrl.c
+++ b/src/misc-progs/ipsecctrl.c
@@ -152,8 +152,8 @@ void turn_connection_on(char *name, char *type) {
                 "/usr/sbin/ipsec down %s >/dev/null", name);
         safe_system(command);
 
                 "/usr/sbin/ipsec down %s >/dev/null", name);
         safe_system(command);
 

-       // Reload the IPsec block chain
-       safe_system("/usr/lib/firewall/ipsec-block >/dev/null");
+       // Reload the IPsec firewall policy
+       safe_system("/usr/lib/firewall/ipsec-policy >/dev/null");

 
        // Reload the configuration into the daemon (#10339).
        ipsec_reload();
 
        // Reload the configuration into the daemon (#10339).
        ipsec_reload();


@@ -182,8 +182,8 @@ void turn_connection_off (char *name) {
        // Reload, so the connection is dropped.
        ipsec_reload();
 
        // Reload, so the connection is dropped.
        ipsec_reload();
 

-       // Reload the IPsec block chain
-       safe_system("/usr/lib/firewall/ipsec-block >/dev/null");
+       // Reload the IPsec firewall policy
+       safe_system("/usr/lib/firewall/ipsec-policy >/dev/null");

 }
 
 int main(int argc, char *argv[]) {
 }
 
 int main(int argc, char *argv[]) {


@@ -316,7 +316,7 @@ int main(int argc, char *argv[]) {
 
         // start the system
         if ((argc == 2) && strcmp(argv[1], "S") == 0) {
 
         // start the system
         if ((argc == 2) && strcmp(argv[1], "S") == 0) {

-               safe_system("/usr/lib/firewall/ipsec-block >/dev/null");
+               safe_system("/usr/lib/firewall/ipsec-policy >/dev/null");

                safe_system("/usr/sbin/ipsec restart >/dev/null");
                 exit(0);
         }
                safe_system("/usr/sbin/ipsec restart >/dev/null");
                 exit(0);
         }