Skip to content

Commit 05d0a7c

Browse files
myreveryjaapmarcus
myrevery
and
jaapmarcus
authored
[Bug fix] The potential issue of loading firewall rules (hestiacp#2064)
* Add 1.4.11.sh for update firewall loading script * Fix the potential issue of loading firewall rules * Fix the potential issue of loading firewall rules * Loading firewall rules by Systemd instead * Loading firewall rules by Systemd instead * Delete the old version loading script * Update changelog Co-authored-by: Jaap Marcus <9754650+jaapmarcus@users.noreply.github.com>
1 parent 0bdfb3e commit 05d0a7c

5 files changed

Lines changed: 64 additions & 47 deletions

File tree

‎CHANGELOG.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ All notable changes to this project will be documented in this file.
55

66
### Features
77

8+
- Replace old firewall system with systemd service / startup script #2064 @myrevery
89
- Add Quick installers for GravCMS, Docuwiki and Mediawiki (#2002) @PsychotherapistSam
910

1011
### Bugfixes

‎bin/v-stop-firewall‎

Lines changed: 18 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -76,29 +76,25 @@ if [ -d "/etc/sysconfig" ]; then
7676
fi
7777
else
7878
/sbin/iptables-save > /etc/iptables.rules
79-
routable="/usr/lib/networkd-dispatcher/routable.d/10-hestia-iptables"
80-
preup="/etc/network/if-pre-up.d/hestia-iptables"
81-
# Recreate the Hestia iptables rules loading script
82-
rm -f $routable $preup
83-
if dpkg-query -W -f'${Status}' "netplan*" 2>/dev/null | grep -q "ok installed" && [ -d /etc/netplan ] && [ -n "$(ls -A /etc/netplan 2>/dev/null)" ]; then
84-
echo '#!/bin/sh' > $routable
85-
echo '' >> $routable
86-
echo 'if [ "$IFACE" = "'$(ip route list | awk '/default .+/ {print $5}' | uniq)'" ]; then' >> $routable
87-
echo ' /sbin/iptables-restore < /etc/iptables.rules' >> $routable
88-
echo 'fi' >> $routable
89-
echo '' >> $routable
90-
echo "exit 0" >> $routable
91-
chmod +x $routable
92-
else
93-
echo '#!/bin/sh' > $preup
94-
echo '' >> $preup
95-
echo 'if [ "$IFACE" = "'$(ip route list | awk '/default .+/ {print $5}' | uniq)'" ]; then' >> $preup
96-
echo ' /sbin/iptables-restore < /etc/iptables.rules' >> $preup
97-
echo 'fi' >> $preup
98-
echo '' >> $preup
99-
echo "exit 0" >> $preup
100-
chmod +x $preup
79+
sd_unit="/lib/systemd/system/hestia-iptables.service"
80+
if [ ! -e "$sd_unit" ]; then
81+
echo "[Unit]" >> $sd_unit
82+
echo "Description=Loading Hestia firewall rules" >> $sd_unit
83+
echo "DefaultDependencies=no" >> $sd_unit
84+
echo "Wants=network-pre.target local-fs.target" >> $sd_unit
85+
echo "Before=network-pre.target" >> $sd_unit
86+
echo "After=local-fs.target" >> $sd_unit
87+
echo "" >> $sd_unit
88+
echo "[Service]" >> $sd_unit
89+
echo "Type=oneshot" >> $sd_unit
90+
echo "RemainAfterExit=yes" >> $sd_unit
91+
echo "ExecStartPre=-${HESTIA}/bin/v-update-firewall-ipset" >> $sd_unit
92+
echo "ExecStart=/sbin/iptables-restore /etc/iptables.rules" >> $sd_unit
93+
echo "" >> $sd_unit
94+
echo "[Install]" >> $sd_unit
95+
echo "WantedBy=multi-user.target" >> $sd_unit
10196
fi
97+
systemctl is-enabled hestia-iptables >/dev/null 2>&1 && systemctl disable hestia-iptables >/dev/null 2>&1
10298
fi
10399

104100

‎bin/v-update-firewall‎

Lines changed: 19 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,7 @@ if [[ "$sshport" =~ ^[0-9]+$ ]] && [ "$sshport" -ne "22" ]; then
6969
fi
7070

7171
# Load ipset lists before adding Hestia iptables rules
72-
[ -x "$(which ipset)" ] && $BIN/v-update-firewall-ipset
72+
$BIN/v-update-firewall-ipset
7373

7474
# Creating temporary file
7575
tmp=$(mktemp)
@@ -185,31 +185,25 @@ if [ -d "/etc/sysconfig" ]; then
185185
fi
186186
else
187187
/sbin/iptables-save > /etc/iptables.rules
188-
routable="/usr/lib/networkd-dispatcher/routable.d/10-hestia-iptables"
189-
preup="/etc/network/if-pre-up.d/hestia-iptables"
190-
# Recreate the Hestia iptables rules loading script
191-
rm -f $routable $preup
192-
if dpkg-query -W -f'${Status}' "netplan*" 2>/dev/null | grep -q "ok installed" && [ -d /etc/netplan ] && [ -n "$(ls -A /etc/netplan 2>/dev/null)" ]; then
193-
echo '#!/bin/sh' > $routable
194-
echo '' >> $routable
195-
echo 'if [ "$IFACE" = "'$(ip route list | awk '/default .+/ {print $5}' | uniq)'" ]; then' >> $routable
196-
echo ' [ -x "'$(which ipset)'" ] && '"${HESTIA}/bin/v-update-firewall-ipset" >> $routable
197-
echo ' /sbin/iptables-restore < /etc/iptables.rules' >> $routable
198-
echo 'fi' >> $routable
199-
echo '' >> $routable
200-
echo "exit 0" >> $routable
201-
chmod +x $routable
202-
else
203-
echo '#!/bin/sh' > $preup
204-
echo '' >> $preup
205-
echo 'if [ "$IFACE" = "'$(ip route list | awk '/default .+/ {print $5}' | uniq)'" ]; then' >> $preup
206-
echo ' [ -x "'$(which ipset)'" ] && '"${HESTIA}/bin/v-update-firewall-ipset" >> $preup
207-
echo ' /sbin/iptables-restore < /etc/iptables.rules' >> $preup
208-
echo 'fi' >> $preup
209-
echo '' >> $preup
210-
echo "exit 0" >> $preup
211-
chmod +x $preup
188+
sd_unit="/lib/systemd/system/hestia-iptables.service"
189+
if [ ! -e "$sd_unit" ]; then
190+
echo "[Unit]" >> $sd_unit
191+
echo "Description=Loading Hestia firewall rules" >> $sd_unit
192+
echo "DefaultDependencies=no" >> $sd_unit
193+
echo "Wants=network-pre.target local-fs.target" >> $sd_unit
194+
echo "Before=network-pre.target" >> $sd_unit
195+
echo "After=local-fs.target" >> $sd_unit
196+
echo "" >> $sd_unit
197+
echo "[Service]" >> $sd_unit
198+
echo "Type=oneshot" >> $sd_unit
199+
echo "RemainAfterExit=yes" >> $sd_unit
200+
echo "ExecStartPre=-${HESTIA}/bin/v-update-firewall-ipset" >> $sd_unit
201+
echo "ExecStart=/sbin/iptables-restore /etc/iptables.rules" >> $sd_unit
202+
echo "" >> $sd_unit
203+
echo "[Install]" >> $sd_unit
204+
echo "WantedBy=multi-user.target" >> $sd_unit
212205
fi
206+
systemctl is-enabled hestia-iptables >/dev/null 2>&1 || systemctl enable hestia-iptables >/dev/null 2>&1
213207
fi
214208

215209

‎install/upgrade/versions/1.4.10.sh‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
#!/bin/bash
2+
3+
# Hestia Control Panel upgrade script for target version 1.4.10
4+
5+
#######################################################################################
6+
####### Place additional commands below. #######
7+
#######################################################################################
8+
9+

‎install/upgrade/versions/1.4.11.sh‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
#!/bin/bash
2+
3+
# Hestia Control Panel upgrade script for target version 1.4.11
4+
5+
#######################################################################################
6+
####### Place additional commands below. #######
7+
#######################################################################################
8+
9+
# Fix the potential issue of loading firewall rules
10+
if [ "$FIREWALL_SYSTEM" = "iptables" ]; then
11+
echo "[ * ] Fix the potential issue of loading firewall rules..."
12+
# Just in case, delete the legacy version loading script again to prevent any residue
13+
rm -f /usr/lib/networkd-dispatcher/routable.d/50-ifup-hooks /etc/network/if-pre-up.d/iptables
14+
# The firewall rules are loading by Systemd, the old loading script is no longer needed
15+
rm -f /usr/lib/networkd-dispatcher/routable.d/10-hestia-iptables /etc/network/if-pre-up.d/hestia-iptables
16+
$BIN/v-update-firewall
17+
fi

0 commit comments

Comments
 (0)