From: Stefan Schantl <stefan.schantl@ipfire.org>
Date: Tue, 19 Jan 2016 13:41:57 +0000 (+0100)
Subject: Allow to configure the firewall action which will be performed.
X-Git-Tag: 2.0~44
X-Git-Url: http://git.ipfire.org/?p=people%2Fstevee%2Fguardian.git;a=commitdiff_plain;h=e9c558fec0c7abed46ea56d712686af37b735b12

Allow to configure the firewall action which will be performed.

This commit adds the posibility to configure which action will be
passed to the firewall engine when blocking an IP address.

To prevent from any missconfiguration, the requested action will be
validated by the responsible firewall engine module before it get
executed.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
---

diff --git a/modules/Events.pm b/modules/Events.pm
index 7e0b687..2f4b561 100644
--- a/modules/Events.pm
+++ b/modules/Events.pm
@@ -194,9 +194,8 @@ sub CallBlock ($@) {
 	# not been blocked yet, call the responisible
 	# function to do this now.
 	unless (exists($blockhash{$address})) {
-		# XXX
-		# Add posibility to use a configure-able action.
-		my $action;
+		# Obtain the configured FirewallAction.
+		my $action = $self->{FirewallAction};
 
 		# Block the given address.
 		my $error = &DoBlock($address, $action);
diff --git a/modules/IPtables.pm b/modules/IPtables.pm
index e3c3d1b..7395d3e 100644
--- a/modules/IPtables.pm
+++ b/modules/IPtables.pm
@@ -6,6 +6,9 @@ use Exporter qw(import);
 
 our @EXPORT = qw(DoBlock DoUnblock DoFlush);
 
+# Array of supported block actions.
+my @supported_actions = ("DROP", "REJECT");
+
 # The path to the iptables executeable.
 my $iptables = "/usr/sbin/iptables";
 
@@ -30,6 +33,14 @@ sub DoBlock (@) {
 		$action = "DROP";
 	}
 
+	# Check if the given action is supported.
+	my $error = &_check_action($action);
+
+	# Abort and return the recieved error.
+	if ($error) {
+		return $error;
+	}
+
 	# Call iptables to block the given address.
 	system("$iptables --wait -A $chain -s $address -j $action");
 }
@@ -114,4 +125,26 @@ sub _get_rules_positions_by_address ($) {
 	return @reversed_rules;
 }
 
+#
+## The _check_action function.
+#
+## This private function is used to check if the given action is supported by
+## the firewall engine.
+#
+sub _check_action ($) {
+	my $action = $_[0];
+
+	# Check if the recieved action is part of the supported_actions array.
+	foreach my $item (@supported_actions) {
+		# Exit the loop and return "nothing" if we found a match.
+		if($item eq $action) {
+			return;
+		}
+	}
+
+	# If we got here, the given action is not part of the array of supported
+	# actions. Return an error message.
+	return "Unsupported action: $action";
+}
+
 1;