Skip to content

Commit 09e4c2d

Browse files
serghey-rodinserghey-rodin
committed
firewall cli
1 parent a42619c commit 09e4c2d

File tree

7 files changed

+476
-0
lines changed

7 files changed

+476
-0
lines changed

‎bin/v-add-sys-firewall-rule‎

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
#!/bin/bash
2+
# info: add firewall rule
3+
# options: ACTION PROTOCOL PORT IP [COMMENT] [RULE]
4+
#
5+
# The function adds new rule to system firewall
6+
7+
8+
#----------------------------------------------------------#
9+
# Variable&Function #
10+
#----------------------------------------------------------#
11+
12+
# Argument defenition
13+
action=$(echo $1|tr '[:lower:]' '[:upper:]')
14+
protocol=$(echo $2|tr '[:lower:]' '[:upper:]')
15+
port_ext=$3
16+
ip=$4
17+
comment=$5
18+
rule=$6
19+
20+
# Includes
21+
source $VESTA/func/main.sh
22+
source $VESTA/conf/vesta.conf
23+
24+
# Get next firewall rule id
25+
get_next_fw_rule() {
26+
if [ -z "$rule" ]; then
27+
curr_str=$(grep "RULE=" $VESTA/data/firewall/rules_ipv4.conf |\
28+
cut -f 2 -d \' | sort -n | tail -n1)
29+
rule="$((curr_str +1))"
30+
fi
31+
}
32+
33+
sort_fw_rules() {
34+
cat $VESTA/data/firewall/rules_ipv4.conf |\
35+
sort -n -k 2 -t \' > $VESTA/data/firewall/rules_ipv4.conf.tmp
36+
mv -f $VESTA/data/firewall/rules_ipv4.conf.tmp \
37+
$VESTA/data/firewall/rules_ipv4.conf
38+
}
39+
40+
41+
#----------------------------------------------------------#
42+
# Verifications #
43+
#----------------------------------------------------------#
44+
45+
check_args '4' "$#" 'ACTION PROTOCOL PORT IP [COMMENT] [RULE]'
46+
validate_format 'action' 'protocol' 'port_ext' 'ip'
47+
is_system_enabled "$FIREWALL_SYSTEM" 'FIREWALL_SYSTEM'
48+
get_next_fw_rule
49+
validate_format 'rule'
50+
is_object_new '../../data/firewall/rules_ipv4' 'RULE' "$rule"
51+
if [ ! -z "$comment"]; then
52+
validate_format 'comment'
53+
fi
54+
55+
56+
#----------------------------------------------------------#
57+
# Action #
58+
#----------------------------------------------------------#
59+
60+
# Concatenating cron string
61+
str="RULE='$rule' ACTION='$action' PROTOCOL='$protocol' PORT='$port_ext'"
62+
str="$str IP='$ip' COMMENT='$comment' SUSPENDED='no'"
63+
str="$str TIME='$TIME' DATE='$DATE'"
64+
65+
# Adding to crontab
66+
echo "$str" >> $VESTA/data/firewall/rules_ipv4.conf
67+
68+
# Changing permissions
69+
chmod 660 $VESTA/data/firewall/rules_ipv4.conf
70+
71+
# Sorting firewall rules by id number
72+
sort_fw_rules
73+
74+
# Updating system firewall
75+
$BIN/v-update-sys-firewall
76+
77+
78+
#----------------------------------------------------------#
79+
# Vesta #
80+
#----------------------------------------------------------#
81+
82+
# Logging
83+
log_event "$OK" "$EVENT"
84+
85+
exit

‎bin/v-change-sys-firewall-rule‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
#!/bin/bash
2+
# info: change firewall rule
3+
# options: RULE ACTION PROTOCOL PORT IP [COMMENT]
4+
#
5+
# The function is used for changing existing firewall rule.
6+
# It fully replace rule with new one but keeps same id.
7+
8+
9+
#----------------------------------------------------------#
10+
# Variable&Function #
11+
#----------------------------------------------------------#
12+
13+
# Argument defenition
14+
rule=$1
15+
action=$(echo $2|tr '[:lower:]' '[:upper:]')
16+
protocol=$(echo $3|tr '[:lower:]' '[:upper:]')
17+
port_ext=$4
18+
ip=$5
19+
comment=$6
20+
21+
# Includes
22+
source $VESTA/func/main.sh
23+
source $VESTA/conf/vesta.conf
24+
25+
# Sort function
26+
sort_fw_rules() {
27+
cat $VESTA/data/firewall/rules_ipv4.conf |\
28+
sort -n -k 2 -t \' > $VESTA/data/firewall/rules_ipv4.conf.tmp
29+
mv -f $VESTA/data/firewall/rules_ipv4.conf.tmp \
30+
$VESTA/data/firewall/rules_ipv4.conf
31+
}
32+
33+
34+
#----------------------------------------------------------#
35+
# Verifications #
36+
#----------------------------------------------------------#
37+
38+
check_args '5' "$#" 'RULE ACTION PROTOCOL PORT IP [COMMENT]'
39+
validate_format 'rule' 'action' 'protocol' 'port_ext' 'ip' 'comment'
40+
is_system_enabled "$FIREWALL_SYSTEM" 'FIREWALL_SYSTEM'
41+
is_object_valid '../../data/firewall/rules_ipv4' 'RULE' "$rule"
42+
43+
44+
#----------------------------------------------------------#
45+
# Action #
46+
#----------------------------------------------------------#
47+
48+
# Concatenating firewall rule
49+
str="RULE='$rule' ACTION='$action' PROTOCOL='$protocol' PORT='$port_ext'"
50+
str="$str IP='$ip' COMMENT='$comment' SUSPENDED='no'"
51+
str="$str TIME='$TIME' DATE='$DATE'"
52+
53+
# Deleting old rule
54+
sed -i "/RULE='$rule' /d" $VESTA/data/firewall/rules_ipv4.conf
55+
56+
# Adding new
57+
echo "$str" >> $VESTA/data/firewall/rules_ipv4.conf
58+
59+
# Sorting firewall rules by id number
60+
sort_fw_rules
61+
62+
# Updating system firewall
63+
$BIN/v-update-sys-firewall
64+
65+
66+
#----------------------------------------------------------#
67+
# Vesta #
68+
#----------------------------------------------------------#
69+
70+
# Logging
71+
log_event "$OK" "$EVENT"
72+
73+
exit

‎bin/v-delete-sys-firewall-rule‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
#!/bin/bash
2+
# info: delete firewall rule
3+
# options: RULE
4+
#
5+
# The function deletes firewall rule.
6+
7+
8+
#----------------------------------------------------------#
9+
# Variable&Function #
10+
#----------------------------------------------------------#
11+
12+
# Argument defenition
13+
rule=$1
14+
15+
# Includes
16+
source $VESTA/func/main.sh
17+
source $VESTA/conf/vesta.conf
18+
19+
20+
#----------------------------------------------------------#
21+
# Verifications #
22+
#----------------------------------------------------------#
23+
24+
check_args '1' "$#" 'RULE'
25+
validate_format 'rule'
26+
is_system_enabled "$FIREWALL_SYSTEM" 'FIREWALL_SYSTEM'
27+
is_object_valid '../../data/firewall/rules_ipv4' 'RULE' "$rule"
28+
29+
30+
#----------------------------------------------------------#
31+
# Action #
32+
#----------------------------------------------------------#
33+
34+
# Deleting rule
35+
sed -i "/RULE='$rule' /d" $VESTA/data/firewall/rules_ipv4.conf
36+
37+
# Updating system firewall
38+
$BIN/v-update-sys-firewall
39+
40+
41+
#----------------------------------------------------------#
42+
# Vesta #
43+
#----------------------------------------------------------#
44+
45+
# Logging
46+
log_event "$OK" "$EVENT"
47+
48+
exit

‎bin/v-list-sys-firewall‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
#!/bin/bash
2+
# info: list iptables rules
3+
# options: [FORMAT]
4+
#
5+
# The function of obtaining the list of all iptables rules.
6+
7+
8+
#----------------------------------------------------------#
9+
# Variable&Function #
10+
#----------------------------------------------------------#
11+
12+
# Argument defenition
13+
format=${1-shell}
14+
15+
# Includes
16+
source $VESTA/func/main.sh
17+
18+
19+
#----------------------------------------------------------#
20+
# Action #
21+
#----------------------------------------------------------#
22+
23+
# Defining config
24+
conf=$VESTA/data/firewall/rules_ipv4.conf
25+
26+
# Defining fileds to select
27+
fields="\$RULE \$ACTION \$PROTOCOL \$PORT \$IP \$COMMENT"
28+
fields="$fields \$RULE \$SUSPENDED \$TIME \$DATE"
29+
30+
# Listing domains
31+
case $format in
32+
json) json_list ;;
33+
plain) nohead=1; shell_list ;;
34+
shell) fields="\$ACTION \$PROTOCOL \$PORT \$IP";
35+
shell_list | column -t ;;
36+
*) check_args '1' '0' 'USER [FORMAT]'
37+
esac
38+
39+
40+
#----------------------------------------------------------#
41+
# Vesta #
42+
#----------------------------------------------------------#
43+
44+
exit

‎bin/v-list-sys-firewall-rule‎

Lines changed: 89 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,89 @@
1+
#!/bin/bash
2+
# info: list firewall rule
3+
# options: RULE [FORMAT]
4+
#
5+
# The function of obtaining firewall rule parameters.
6+
7+
8+
#----------------------------------------------------------#
9+
# Variable&Function #
10+
#----------------------------------------------------------#
11+
12+
# Argument defenition
13+
rule=$1
14+
format=${2-shell}
15+
16+
# Includes
17+
source $VESTA/func/main.sh
18+
19+
# Json function
20+
json_list_fw_rule() {
21+
i=1
22+
fileds_count=$(echo "$fields" | wc -w)
23+
line=$(grep "RULE='$rule'" $conf)
24+
echo '{'
25+
eval $line
26+
for field in $fields; do
27+
eval value=$field
28+
if [ "$i" -eq 1 ]; then
29+
echo -e "\t\"$value\": {"
30+
else
31+
if [ "$fileds_count" -eq "$i" ]; then
32+
echo -e "\t\t\"${field//$/}\": \"$value\""
33+
else
34+
echo -e "\t\t\"${field//$/}\": \"$value\","
35+
fi
36+
fi
37+
(( ++i))
38+
done
39+
if [ -n "$value" ]; then
40+
echo -e ' }'
41+
fi
42+
echo -e "}"
43+
}
44+
45+
# Shell function
46+
shell_list_fw_rule() {
47+
line=$(grep "RULE='$rule'" $conf)
48+
eval $line
49+
for field in $fields; do
50+
eval key="$field"
51+
if [ -z "$key" ]; then
52+
key=NULL
53+
fi
54+
echo "${field//$/}: $key "
55+
done
56+
}
57+
58+
59+
#----------------------------------------------------------#
60+
# Verifications #
61+
#----------------------------------------------------------#
62+
63+
check_args '1' "$#" 'RULE [FORMAT]'
64+
is_object_valid '../../data/firewall/rules_ipv4' 'RULE' "$rule"
65+
66+
67+
#----------------------------------------------------------#
68+
# Action #
69+
#----------------------------------------------------------#
70+
71+
# Defining config and fields to select
72+
conf=$VESTA/data/firewall/rules_ipv4.conf
73+
fields="\$RULE \$ACTION \$PROTOCOL \$PORT \$IP \$COMMENT"
74+
fields="$fields \$RULE \$SUSPENDED \$TIME \$DATE"
75+
76+
# Listing fw rule
77+
case $format in
78+
json) json_list_fw_rule ;;
79+
plain) nohead=1; shell_list_fw_rule ;;
80+
shell) shell_list_fw_rule |column -t ;;
81+
*) check_args '2' '0' 'RULE [FORMAT]'
82+
esac
83+
84+
85+
#----------------------------------------------------------#
86+
# Vesta #
87+
#----------------------------------------------------------#
88+
89+
exit

‎bin/v-list-sys-services‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -187,6 +187,18 @@ if [ ! -z "$service" ] && [ "$service" != 'remote' ]; then
187187
str="$str CPU='$cpu' MEM='$mem' RTIME='$rtime'"
188188
fi
189189

190+
# FIREWALL
191+
service=$FIREWALL_SYSTEM
192+
if [ ! -z "$service" ] && [ "$service" != 'remote' ]; then
193+
state="stopped"
194+
/sbin/iptables -L vesta >/dev/null 2>&1
195+
if [ "$?" -eq 0 ]; then
196+
state="running"
197+
fi
198+
str="$str\nNAME='$FIREWALL_SYSTEM' SYSTEM='firewall'"
199+
str="$str STATE='$state' CPU='0' MEM='0' RTIME='0'"
200+
fi
201+
190202
# Defining config
191203
echo -e "$str" > $tmp_file
192204
conf=$tmp_file

0 commit comments

Comments
 (0)