Skip to content

Commit b7a05ee

Browse files
asmccasmcc
asmcc
and
asmcc
authored
Bugfixing in firewall scripts (hestiacp#3938)
Co-authored-by: asmcc <root@7-www.tk>
1 parent d0ee134 commit b7a05ee

File tree

3 files changed

+80
-66
lines changed

3 files changed

+80
-66
lines changed

‎bin/v-add-firewall-chain‎

Lines changed: 16 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
#!/bin/bash
22
# info: add firewall chain
3-
# options: CHAIN [PORT] [PROTOCOL] [PROTOCOL]
3+
# options: CHAIN [PORT] [PROTOCOL]
44
#
55
# example: v-add-firewall-chain CRM 5678 TCP
66
#
@@ -11,11 +11,12 @@
1111
#----------------------------------------------------------#
1212

1313
# Argument definition
14-
chain=$(echo $1 | tr '[:lower:]' '[:upper:]')
15-
port=$2
16-
port_ext=$2
17-
protocol=${4-TCP}
18-
protocol=$(echo $protocol | tr '[:lower:]' '[:upper:]')
14+
chain=$(echo "$1" | tr '[:lower:]' '[:upper:]')
15+
port="$2"
16+
port_ext="$2"
17+
protocol="$3"
18+
[ -z "$protocol" ] && protocol='TCP'
19+
protocol=$(echo "$protocol" | tr '[:lower:]' '[:upper:]')
1920

2021
# Defining absolute path to iptables
2122
iptables="/sbin/iptables"
@@ -24,9 +25,9 @@ iptables="/sbin/iptables"
2425
# shellcheck source=/etc/hestiacp/hestia.conf
2526
source /etc/hestiacp/hestia.conf
2627
# shellcheck source=/usr/local/hestia/func/main.sh
27-
source $HESTIA/func/main.sh
28+
source "$HESTIA/func/main.sh"
2829
# shellcheck source=/usr/local/hestia/func/firewall.sh
29-
source $HESTIA/func/firewall.sh
30+
source "$HESTIA/func/firewall.sh"
3031
# load config file
3132
source_conf "$HESTIA/conf/hestia.conf"
3233

@@ -56,8 +57,8 @@ heal_iptables_links
5657

5758
# Checking known chains
5859
case $chain in
59-
SSH) # Get ssh port (or ports) using v-list-sys-sshd-port.
60-
sshport="$($BIN/v-list-sys-sshd-port plain | sed ':a;N;$!ba;s/\n/,/g')"
60+
SSH) # Get ssh port (or ports) using v-list-sys-sshd-port.
61+
sshport="$($BIN/v-list-sys-sshd-port plain | sed ':a;N;$!ba;s/\n/,/g')"
6162
if [ -z "$sshport" ]; then
6263
sshport=22
6364
fi
@@ -110,14 +111,15 @@ if [ $? -eq 0 ]; then
110111
fi
111112

112113
# Preserving chain
113-
chains=$HESTIA/data/firewall/chains.conf
114-
check_chain=$(grep "CHAIN='$chain'" $chains 2> /dev/null)
114+
chains="$HESTIA/data/firewall/chains.conf"
115+
check_chain=""
116+
[ -f "$chains" ] && check_chain=$(grep "CHAIN='$chain'" "$chains")
115117
if [ -z "$check_chain" ]; then
116-
echo "CHAIN='$chain' PORT='$port' PROTOCOL='$protocol'" >> $chains
118+
echo "CHAIN='$chain' PORT='$port' PROTOCOL='$protocol'" >> "$chains"
117119
fi
118120

119121
# Changing permissions
120-
chmod 660 $chains
122+
[ -f "$chains" ] && chmod 660 "$chains"
121123

122124
#----------------------------------------------------------#
123125
# Hestia #

‎bin/v-delete-firewall-chain‎

Lines changed: 10 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -11,16 +11,16 @@
1111
#----------------------------------------------------------#
1212

1313
# Argument definition
14-
chain=$(echo $1 | tr '[:lower:]' '[:upper:]')
14+
chain=$(echo "$1" | tr '[:lower:]' '[:upper:]')
1515

1616
iptables='/sbin/iptables'
1717
# Includes
1818
# shellcheck source=/etc/hestiacp/hestia.conf
1919
source /etc/hestiacp/hestia.conf
2020
# shellcheck source=/usr/local/hestia/func/main.sh
21-
source $HESTIA/func/main.sh
21+
source "$HESTIA/func/main.sh"
2222
# shellcheck source=/usr/local/hestia/func/firewall.sh
23-
source $HESTIA/func/firewall.sh
23+
source "$HESTIA/func/firewall.sh"
2424
# load config file
2525
source_conf "$HESTIA/conf/hestia.conf"
2626

@@ -43,13 +43,14 @@ check_hestia_demo_mode
4343
heal_iptables_links
4444

4545
# Deleting chain
46-
chains=$HESTIA/data/firewall/chains.conf
47-
banlist=$HESTIA/data/firewall/banlist.conf
48-
chain_param=$(grep "CHAIN='$chain'" $chains 2> /dev/null)
46+
chains="$HESTIA/data/firewall/chains.conf"
47+
banlist="$HESTIA/data/firewall/banlist.conf"
48+
chain_param=""
49+
[ -f "$chains" ] && chain_param=$(grep "CHAIN='$chain'" "$chains")
4950
if [ -n "$chain_param" ]; then
5051
parse_object_kv_list "$chain_param"
51-
sed -i "/CHAIN='$chain'/d" $chains
52-
sed -i "/CHAIN='$chain'/d" $banlist
52+
sed -i "/CHAIN='$chain'/d" "$chains"
53+
sed -i "/CHAIN='$chain'/d" "$banlist"
5354
$iptables -D INPUT -p $PROTOCOL \
5455
--dport $PORT -j fail2ban-$CHAIN 2> /dev/null
5556
fi
@@ -59,7 +60,7 @@ $iptables -F fail2ban-$CHAIN 2> /dev/null
5960
$iptables -X fail2ban-$CHAIN 2> /dev/null
6061

6162
# Changing permissions
62-
chmod 660 $chains
63+
[ -f "$chains" ] && chmod 660 "$chains"
6364

6465
#----------------------------------------------------------#
6566
# Hestia #

‎bin/v-update-firewall‎

Lines changed: 54 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -20,9 +20,9 @@ source /etc/profile.d/hestia.sh
2020
# shellcheck source=/etc/hestiacp/hestia.conf
2121
source /etc/hestiacp/hestia.conf
2222
# shellcheck source=/usr/local/hestia/func/main.sh
23-
source $HESTIA/func/main.sh
23+
source "$HESTIA/func/main.sh"
2424
# shellcheck source=/usr/local/hestia/func/firewall.sh
25-
source $HESTIA/func/firewall.sh
25+
source "$HESTIA/func/firewall.sh"
2626
# load config file
2727
source_conf "$HESTIA/conf/hestia.conf"
2828

@@ -47,49 +47,56 @@ if [ ! -e "$rules" ]; then
4747
fi
4848

4949
# Checking conntrack module avaiabilty
50-
$modprobe nf_conntrack > /dev/null 2>&1
50+
"$modprobe" nf_conntrack > /dev/null 2>&1
5151
if [ $? -ne 0 ]; then
52-
$sysctl net.netfilter.nf_conntrack_max > /dev/null 2>&1
52+
"$sysctl" net.netfilter.nf_conntrack_max > /dev/null 2>&1
5353
if [ $? -ne 0 ]; then
5454
conntrack='no'
5555
fi
5656
fi
5757

58-
$modprobe nf_conntrack_ftp > /dev/null 2>&1
58+
"$modprobe" nf_conntrack_ftp > /dev/null 2>&1
5959
if [ $? -ne 0 ]; then
6060
conntrack_ftp='no'
6161
fi
6262

63+
chains="$HESTIA/data/firewall/chains.conf"
64+
banlist="$HESTIA/data/firewall/banlist.conf"
65+
6366
# Checking custom OpenSSH port (or ports)
6467
sshport="$($BIN/v-list-sys-sshd-port plain | sed ':a;N;$!ba;s/\n/,/g')"
65-
if echo "$sshport" | grep -E '^[0-9]+(,[0-9]+)*$' &>/dev/null; then
66-
sed -i -E "s/(PORT=')[0-9]+(,[0-9]+)*('.*COMMENT='SSH')/\1$sshport\3/" $rules
67-
sed -i "/CHAIN='SSH'/c\CHAIN='SSH' PORT='$sshport' PROTOCOL='TCP'" "$HESTIA/data/firewall/chains.conf"
68+
if echo "$sshport" | grep -E '^[0-9]+(,[0-9]+)*$' &> /dev/null; then
69+
sed -i -E "s/(PORT=')[0-9]+(,[0-9]+)*('.*COMMENT='SSH')/\1$sshport\3/" "$rules"
70+
if [ -f "$chains" ]; then
71+
sed -i "/CHAIN='SSH'/c\CHAIN='SSH' PORT='$sshport' PROTOCOL='TCP'" "$chains"
72+
else
73+
"$BIN/v-add-firewall-chain" 'SSH' "$sshport" 'TCP'
74+
fi
6875
fi
6976

7077
# Load ipset lists before adding Hestia iptables rules
71-
$BIN/v-update-firewall-ipset load
78+
"$BIN/v-update-firewall-ipset" load
7279

7380
# Creating temporary file
7481
tmp="$(mktemp)"
7582

7683
# Flushing INPUT chain
77-
echo "$iptables -P INPUT ACCEPT" >> $tmp
78-
echo "$iptables -F INPUT" >> $tmp
84+
echo "$iptables -P INPUT ACCEPT" >> "$tmp"
85+
echo "$iptables -F INPUT" >> "$tmp"
7986

8087
# Enabling stateful support
8188
if [ "$conntrack" != 'no' ] || grep --quiet container=lxc /proc/1/environ; then
8289
str="$iptables -A INPUT -m state"
8390
str="$str --state ESTABLISHED,RELATED -j ACCEPT"
84-
echo "$str" >> $tmp
91+
echo "$str" >> "$tmp"
8592
fi
8693

8794
ips="$(ls $HESTIA/data/ips)"
8895
# Handling local traffic
8996
for ip in $ips; do
90-
echo "$iptables -A INPUT -s $ip -j ACCEPT" >> $tmp
97+
echo "$iptables -A INPUT -s $ip -j ACCEPT" >> "$tmp"
9198
done
92-
echo "$iptables -A INPUT -s 127.0.0.1 -j ACCEPT" >> $tmp
99+
echo "$iptables -A INPUT -s 127.0.0.1 -j ACCEPT" >> "$tmp"
93100

94101
# Pasring iptables rules
95102
IFS=$'\n'
@@ -103,7 +110,7 @@ for line in $(sort -r -n -k 2 -t \' $rules); do
103110

104111
if [[ "$IP" =~ ^ipset: ]]; then
105112
ipset_name="${IP#ipset:}"
106-
$(v-list-firewall-ipset plain | grep "^$ipset_name\s" > /dev/null) || log_event $E_NOTEXIST "IPset IP list ($ipset_name) not found"
113+
$("$BIN/v-list-firewall-ipset" plain | grep "^$ipset_name\s" > /dev/null) || log_event $E_NOTEXIST "IPset IP list ($ipset_name) not found"
107114
ip="-m set --match-set '${ipset_name}' src"
108115
else
109116
ip="-s $IP"
@@ -130,51 +137,55 @@ for line in $(sort -r -n -k 2 -t \' $rules); do
130137
fi
131138

132139
# Adding firewall rule
133-
echo "$iptables -A INPUT $proto $port $ip $state $action" >> $tmp
140+
echo "$iptables -A INPUT $proto $port $ip $state $action" >> "$tmp"
134141
fi
135142
done
136143

137144
# Switching chain policy to DROP
138-
echo "$iptables -P INPUT DROP" >> $tmp
145+
echo "$iptables -P INPUT DROP" >> "$tmp"
139146

140147
# Adding hestia chain
141-
echo "$iptables -N hestia" >> $tmp
148+
echo "$iptables -N hestia" >> "$tmp"
142149

143150
# Applying rules
144-
bash $tmp 2> /dev/null
151+
bash "$tmp" 2> /dev/null
145152

146153
# Deleting temporary file
147-
rm -f $tmp
154+
rm -f "$tmp"
148155

149156
# Checking custom trigger
150157
if [ -x "$HESTIA/data/firewall/custom.sh" ]; then
151-
bash $HESTIA/data/firewall/custom.sh
158+
bash "$HESTIA/data/firewall/custom.sh"
152159
fi
153160

154161
# Checking fail2ban support
155162
if [ -n "$FIREWALL_EXTENSION" ]; then
156-
for chain in $(cat $HESTIA/data/firewall/chains.conf 2> /dev/null); do
157-
parse_object_kv_list "$chain"
158-
if [[ "$PORT" =~ ,|-|: ]]; then
159-
port="-m multiport --dports $PORT"
160-
else
161-
port="--dport $PORT"
162-
fi
163-
echo "$iptables -N fail2ban-$CHAIN" >> $tmp
164-
echo "$iptables -F fail2ban-$CHAIN" >> $tmp
165-
echo "$iptables -I fail2ban-$CHAIN -s 0.0.0.0/0 -j RETURN" >> $tmp
166-
echo "$iptables -I INPUT -p $PROTOCOL $port -j fail2ban-$CHAIN" >> $tmp
167-
done
168-
bash $tmp 2> /dev/null
169-
rm -f $tmp
170-
171-
for ban in $(cat $HESTIA/data/firewall/banlist.conf 2> /dev/null); do
172-
parse_object_kv_list "$ban"
173-
echo -n "$iptables -I fail2ban-$CHAIN 1 -s $IP" >> $tmp
174-
echo " -j REJECT --reject-with icmp-port-unreachable" >> $tmp
175-
done
176-
bash $tmp 2> /dev/null
177-
rm -f $tmp
163+
if [ -f "$chains" ]; then
164+
for chain in $(cat "$chains"); do
165+
parse_object_kv_list "$chain"
166+
if [[ "$PORT" =~ ,|-|: ]]; then
167+
port="-m multiport --dports $PORT"
168+
else
169+
port="--dport $PORT"
170+
fi
171+
echo "$iptables -N fail2ban-$CHAIN" >> "$tmp"
172+
echo "$iptables -F fail2ban-$CHAIN" >> "$tmp"
173+
echo "$iptables -I fail2ban-$CHAIN -s 0.0.0.0/0 -j RETURN" >> "$tmp"
174+
echo "$iptables -I INPUT -p $PROTOCOL $port -j fail2ban-$CHAIN" >> "$tmp"
175+
done
176+
bash "$tmp" 2> /dev/null
177+
rm -f "$tmp"
178+
fi
179+
180+
if [ -f "$banlist" ]; then
181+
for ban in $(cat "$banlist"); do
182+
parse_object_kv_list "$ban"
183+
echo -n "$iptables -I fail2ban-$CHAIN 1 -s $IP" >> "$tmp"
184+
echo " -j REJECT --reject-with icmp-port-unreachable" >> "$tmp"
185+
done
186+
bash "$tmp" 2> /dev/null
187+
rm -f "$tmp"
188+
fi
178189
fi
179190

180191
# Clean up and saving rules to the master iptables file

0 commit comments

Comments
 (0)