Skip to content

Commit ce6945f

Browse files
myreverymyrevery
authored
[Bug fix] Firewall loading failed after reboot (hestiacp#3110)
* Fixed firewall loading failed after reboot * Apply update to hestia-iptables Systemd unit
1 parent 072ba5b commit ce6945f

File tree

7 files changed

+57
-45
lines changed

7 files changed

+57
-45
lines changed

‎bin/v-add-firewall-ipset‎

Lines changed: 15 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
#!/bin/bash
22
# info: add firewall ipset
3-
# options: NAME [SOURCE] [IPVERSION] [AUTOUPDATE] [FORCE]
3+
# options: NAME [SOURCE] [IPVERSION] [AUTOUPDATE] [REFRESH]
44
#
55
# example: v-add-firewall-ipset country-nl 'http://ipverse.net/ipblocks/data/countries/nl.zone'
66
#
@@ -14,7 +14,7 @@ ip_name=${1}
1414
data_source=${2}
1515
ip_version=${3:-v4}
1616
autoupdate=${4:-yes}
17-
force=${5:-no}
17+
refresh=${5:-no}
1818

1919
# Includes
2020
# shellcheck source=/etc/hestiacp/hestia.conf
@@ -30,16 +30,16 @@ source_conf "$HESTIA/conf/hestia.conf"
3030

3131
check_args '1' "$#" 'NAME [SOURCE] [IPVERSION] [AUTOUPDATE] [FORCE]'
3232
is_format_valid 'ip_name'
33-
is_boolean_format_valid "$autoupdate" 'bool (yes/no)'
34-
is_boolean_format_valid "$force" 'bool (yes/no)'
33+
is_boolean_format_valid "$autoupdate" 'Automatically update IP list (yes/no)'
34+
is_boolean_format_valid "$refresh" 'Refresh IP list (yes/no)'
3535
is_system_enabled "$FIREWALL_SYSTEM" 'FIREWALL_SYSTEM'
3636

3737
# Perform verification if read-only mode is enabled
3838
check_hestia_demo_mode
3939

4040
# Define variables for ipset configuration
4141
ipset_hstobject='../../data/firewall/ipset'
42-
IPSET_BIN="$(which ipset)"
42+
IPSET_BIN="$(command -v ipset)"
4343
IPSET_PATH="$HESTIA/data/firewall/ipset"
4444

4545
# Ensure ipset is installed
@@ -49,10 +49,10 @@ if [ -z "$IPSET_BIN" ]; then
4949
else
5050
apt-get --quiet --yes install ipset > /dev/null
5151
fi
52-
check_result $? "Installing ipset package"
52+
check_result $? "Installing IPset package"
5353

5454
IPSET_BIN="$(which ipset)"
55-
check_result $? "ipset binary not found"
55+
check_result $? "IPset binary not found"
5656
fi
5757

5858
# Ensure ipset configuration path and master file exist before attempting to parse
@@ -87,8 +87,8 @@ IPSET_MIN_SIZE=10
8787
# Action #
8888
#----------------------------------------------------------#
8989

90-
# Generate ip lists file if missing or when forced
91-
if [ ! -f "${IPSET_PATH}/${IPSET_FILE}.iplist" ] || [ "$force" = "yes" ]; then
90+
# Generate ip lists file if missing or required refresh
91+
if [ ! -f "${IPSET_PATH}/${IPSET_FILE}.iplist" ] || [ "$refresh" = "yes" ]; then
9292

9393
iplist_tempfile=$(mktemp)
9494

@@ -109,7 +109,6 @@ if [ ! -f "${IPSET_PATH}/${IPSET_FILE}.iplist" ] || [ "$force" = "yes" ]; then
109109

110110
# Generate the ip list file trough a external script
111111
# ex: compiling a ip list from multiple sources on demand
112-
113112
if [ -x "${data_source#script:}" ]; then
114113

115114
setpriv --clear-groups --reuid nobody --regid nogroup -- ${data_source#script:} "$ip_name" > "$iplist_tempfile"
@@ -121,7 +120,6 @@ if [ ! -f "${IPSET_PATH}/${IPSET_FILE}.iplist" ] || [ "$force" = "yes" ]; then
121120

122121
# Use a external ip-list file managed by other apps
123122
# ex: Using a ip list that is continously updated
124-
125123
[ -f "${data_source#file:}" ] && cp -f "${data_source#file:}" "$iplist_tempfile"
126124

127125
fi
@@ -136,7 +134,7 @@ if [ ! -f "${IPSET_PATH}/${IPSET_FILE}.iplist" ] || [ "$force" = "yes" ]; then
136134

137135
# Validate iplist file size
138136
iplist_size=$(sed -r -e '/^#|^$/d' "$iplist_tempfile" | wc -l)
139-
[[ "$iplist_size" -le "$IPSET_MIN_SIZE" ]] && check_result "$E_INVALID" "iplist file too small (<${IPSET_MIN_SIZE}), ignoring"
137+
[[ "$iplist_size" -le "$IPSET_MIN_SIZE" ]] && check_result "$E_INVALID" "IP list file too small (<${IPSET_MIN_SIZE}), ignoring"
140138
mv -f "$iplist_tempfile" "${IPSET_PATH}/${IPSET_FILE}.iplist"
141139

142140
fi
@@ -168,12 +166,14 @@ if [ ! -f "${IPSET_PATH}.conf" ] || [ -z "$(get_object_value "$ipset_hstobject"
168166
str="$str AUTOUPDATE='$autoupdate' SUSPENDED='no'"
169167
str="$str TIME='$time' DATE='$date'"
170168
echo "$str" >> $HESTIA/data/firewall/ipset.conf
169+
log_type="added"
171170

172-
elif [ "$force" = "yes" ]; then
171+
elif [ "$refresh" = "yes" ]; then
173172

174-
# update iplist last regen time
173+
# Update iplist last regen time
175174
update_object_value "$ipset_hstobject" 'LISTNAME' "$ip_name" '$TIME' "$time"
176175
update_object_value "$ipset_hstobject" 'LISTNAME' "$ip_name" '$DATE' "$date"
176+
log_type="refreshed"
177177

178178
fi
179179

@@ -192,7 +192,7 @@ fi
192192
#----------------------------------------------------------#
193193

194194
# Logging
195-
$BIN/v-log-action "system" "Info" "Firewall" "Added new IP list (Name: $ip_name, IP version: $ip_version, Autoupdate: $autoupdate)."
195+
$BIN/v-log-action "system" "Info" "Firewall" "IPset IP list ${log_type:-loaded} (Name: $ip_name, IP version: $ip_version, Autoupdate: $autoupdate)."
196196
log_event "$OK" "$ARGUMENTS"
197197

198198
exit

‎bin/v-delete-firewall-ipset‎

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -24,45 +24,45 @@ source_conf "$HESTIA/conf/hestia.conf"
2424
# Verifications #
2525
#----------------------------------------------------------#
2626

27-
ipset_hstobject='../../data/firewall/ipset'
28-
2927
check_args '1' "$#" 'NAME'
3028
is_format_valid 'ip_name'
3129
is_system_enabled "$FIREWALL_SYSTEM" 'FIREWALL_SYSTEM'
32-
is_object_valid "$ipset_hstobject" 'LISTNAME' "$ip_name"
3330

31+
# Define variables for ipset configuration
32+
ipset_hstobject='../../data/firewall/ipset'
33+
is_object_valid "$ipset_hstobject" 'LISTNAME' "$ip_name"
3434
ip_version="$(get_object_value "$ipset_hstobject" 'LISTNAME' "$ip_name" '$IP_VERSION')"
3535

36-
IPSET_BIN="$(which ipset)"
37-
IPSET_PATH="$HESTIA/data/firewall/ipset"
38-
IPSET_FILE="${ip_name}.${ip_version}"
39-
4036
# Perform verification if read-only mode is enabled
4137
check_hestia_demo_mode
4238

39+
IPSET_BIN="$(command -v ipset)"
40+
IPSET_PATH="$HESTIA/data/firewall/ipset"
41+
IPSET_FILE="${ip_name}.${ip_version}"
42+
4343
# Install ipset package if missing
4444
if [ -z "$IPSET_BIN" ]; then
4545
if [ -f '/etc/redhat-release' ]; then
4646
dnf install -q -y ipset > /dev/null
4747
else
4848
apt-get --quiet --yes install ipset > /dev/null
4949
fi
50-
check_result $? "Installing ipset package"
50+
check_result $? "Installing IPset package"
5151

5252
IPSET_BIN="$(which ipset)"
53-
check_result $? "ipset binary not found"
53+
check_result $? "IPset binary not found"
5454
fi
5555

5656
#----------------------------------------------------------#
5757
# Action #
5858
#----------------------------------------------------------#
5959

60-
if $IPSET_BIN --quiet list "${ip_name}-tmp" > /dev/null; then
61-
$IPSET_BIN --quiet destroy "${ip_name}-tmp"
60+
if $IPSET_BIN -quiet list "${ip_name}-tmp" > /dev/null; then
61+
$IPSET_BIN -quiet destroy "${ip_name}-tmp"
6262
fi
6363

64-
if $IPSET_BIN --quiet list "${ip_name}" > /dev/null; then
65-
$IPSET_BIN --quiet destroy "${ip_name}"
64+
if $IPSET_BIN -quiet list "${ip_name}" > /dev/null; then
65+
$IPSET_BIN -quiet destroy "${ip_name}"
6666
check_result $? "ipset ${ip_name} still used by iptables. Cannot remove"
6767
fi
6868

@@ -74,7 +74,7 @@ rm -f "${IPSET_PATH}/${IPSET_FILE}.iplist"
7474
#----------------------------------------------------------#
7575

7676
# Logging
77-
$BIN/v-log-action "system" "Info" "Firewall" "Deleted IP list (Name: $ip_name)."
77+
$BIN/v-log-action "system" "Info" "Firewall" "IPset IP list deleted (Name: $ip_name)."
7878
log_event "$OK" "$ARGUMENTS"
7979

8080
exit

‎bin/v-stop-firewall‎

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -28,8 +28,6 @@ source_conf "$HESTIA/conf/hestia.conf"
2828
# Verifications #
2929
#----------------------------------------------------------#
3030

31-
#is_system_enabled "$FIREWALL_SYSTEM" 'FIREWALL_SYSTEM'
32-
3331
# Perform verification if read-only mode is enabled
3432
check_hestia_demo_mode
3533

@@ -83,7 +81,7 @@ else
8381
echo "[Service]" >> $sd_unit
8482
echo "Type=oneshot" >> $sd_unit
8583
echo "RemainAfterExit=yes" >> $sd_unit
86-
echo "ExecStartPre=-${HESTIA}/bin/v-update-firewall-ipset" >> $sd_unit
84+
echo "ExecStartPre=-${HESTIA}/bin/v-update-firewall-ipset load" >> $sd_unit
8785
if [ "$iptablesversion" = "v1.6" ]; then
8886
echo "ExecStart=/sbin/iptables-restore /etc/iptables.rules" >> $sd_unit
8987
else
@@ -92,12 +90,12 @@ else
9290
echo "" >> $sd_unit
9391
echo "[Install]" >> $sd_unit
9492
echo "WantedBy=multi-user.target" >> $sd_unit
95-
systemctl daemon-reload
93+
systemctl -q daemon-reload
9694
fi
97-
systemctl is-enabled hestia-iptables > /dev/null 2>&1 && systemctl disable hestia-iptables > /dev/null 2>&1
95+
systemctl -q is-enabled hestia-iptables 2> /dev/null && systemctl -q disable hestia-iptables
9896
if [ -z "$FIREWALL_SYSTEM" ]; then
9997
rm -f $sd_unit
100-
systemctl daemon-reload
98+
systemctl -q daemon-reload
10199
fi
102100
fi
103101

‎bin/v-update-firewall‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -194,7 +194,7 @@ else
194194
echo "[Service]" >> $sd_unit
195195
echo "Type=oneshot" >> $sd_unit
196196
echo "RemainAfterExit=yes" >> $sd_unit
197-
echo "ExecStartPre=-${HESTIA}/bin/v-update-firewall-ipset" >> $sd_unit
197+
echo "ExecStartPre=-${HESTIA}/bin/v-update-firewall-ipset load" >> $sd_unit
198198
if [ "$iptablesversion" = "v1.6" ]; then
199199
echo "ExecStart=/sbin/iptables-restore /etc/iptables.rules" >> $sd_unit
200200
else
@@ -203,9 +203,9 @@ else
203203
echo "" >> $sd_unit
204204
echo "[Install]" >> $sd_unit
205205
echo "WantedBy=multi-user.target" >> $sd_unit
206-
systemctl daemon-reload
206+
systemctl -q daemon-reload
207207
fi
208-
systemctl is-enabled hestia-iptables > /dev/null 2>&1 || systemctl enable hestia-iptables > /dev/null 2>&1
208+
systemctl -q is-enabled hestia-iptables 2> /dev/null || systemctl -q enable hestia-iptables
209209
fi
210210

211211
#----------------------------------------------------------#

‎bin/v-update-firewall-ipset‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -10,8 +10,7 @@
1010
# Variables & Functions #
1111
#----------------------------------------------------------#
1212

13-
# Force refresh
14-
force=${1:-no}
13+
refresh=${1:-no}
1514

1615
# Includes
1716
source /etc/profile.d/hestia.sh
@@ -26,7 +25,7 @@ source_conf "$HESTIA/conf/hestia.conf"
2625
# Verifications #
2726
#----------------------------------------------------------#
2827

29-
is_boolean_format_valid "$force" 'bool (yes/no)'
28+
is_refresh_ipset_format_valid "$refresh" 'Refresh IP lists (load/yes/no)'
3029
is_system_enabled "$FIREWALL_SYSTEM" 'FIREWALL_SYSTEM'
3130

3231
# Perform verification if read-only mode is enabled
@@ -40,8 +39,9 @@ for ipset_name in $(search_objects "$ipset_hstobject" 'SUSPENDED' 'no' 'LISTNAME
4039
ipset_date="$(get_object_value "$ipset_hstobject" 'LISTNAME' "$ipset_name" '$DATE')"
4140
ipset_au="$(get_object_value "$ipset_hstobject" 'LISTNAME' "$ipset_name" '$AUTOUPDATE')"
4241

43-
if [ "$ipset_au" = 'no' ]; then
44-
# load existing ip list files in the kernel but don't auto update them
42+
if [ "$ipset_au" = 'no' ] || [ "$refresh" = 'load' ]; then
43+
# Load existing ip list files in the kernel but don't auto update them
44+
# The "load" refresh option is only used by hestia-iptables systemd service
4545
$BIN/v-add-firewall-ipset "$ipset_name"
4646
continue
4747
fi
@@ -50,8 +50,8 @@ for ipset_name in $(search_objects "$ipset_hstobject" 'SUSPENDED' 'no' 'LISTNAME
5050
now=$(date +%s)
5151
hours_since_update=$(((now - last_updated_ts) / (60 * 60)))
5252

53-
if [[ "$hours_since_update" -lt 24 ]] && [ "$force" = 'no' ]; then
54-
# load existing ip list files in the kernel but don't auto update them
53+
if [[ "$hours_since_update" -lt 24 ]] && [ "$refresh" = 'no' ]; then
54+
# Load existing ip list files in the kernel but don't auto update them
5555
$BIN/v-add-firewall-ipset "$ipset_name"
5656
continue
5757
fi

‎func/main.sh‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -859,6 +859,13 @@ is_boolean_format_valid() {
859859
fi
860860
}
861861

862+
# Refresh IPset format validator
863+
is_refresh_ipset_format_valid() {
864+
if [ "$1" != 'load' ] && [ "$1" != 'yes' ] && [ "$1" != 'no' ]; then
865+
check_result "$E_INVALID" "invalid $2 format :: $1"
866+
fi
867+
}
868+
862869
# Common format validator
863870
is_common_format_valid() {
864871
exclude="[!|#|$|^|&|(|)|+|=|{|}|:|<|>|?|/|\|\"|'|;|%|\`| ]"

‎install/upgrade/versions/1.6.12.sh‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,3 +24,10 @@ upgrade_config_set_value 'UPGRADE_UPDATE_FILEMANAGER_CONFIG' 'false'
2424
if [ -f "/etc/fail2ban/jail.local" ]; then
2525
sed -i "s|/var/log/mysql.log|/var/log/mysql/error.log|g" /etc/fail2ban/jail.local
2626
fi
27+
28+
# Fixed firewall loading failed after reboot, applying update to hestia-iptables Systemd unit.
29+
if [ "$FIREWALL_SYSTEM" = "iptables" ]; then
30+
echo "[ * ] Update loading firewall rules service..."
31+
$BIN/v-delete-sys-firewall
32+
$BIN/v-add-sys-firewall
33+
fi

0 commit comments

Comments
 (0)