Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Added ipset support for shield-trigger-iptables
- Loading branch information
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,180 +1,145 @@ | ||
| #!/bin/sh | ||
| # | ||
| # shield-trigger-iptables | ||
| # | ||
| # Copyright (C) 2007-2024 | ||
| # Walter de Jong <[email protected]> | ||
| # Jonathan Niehof <[email protected]> | ||
| # Jeffrey Clark <[email protected]> | ||
| # | ||
| # This program is free software; you can redistribute it and/or modify | ||
| # it under the terms of the GNU General Public License as published by | ||
| # the Free Software Foundation; either version 2 of the License, or | ||
| # (at your option) any later version. | ||
| # | ||
| # This program is distributed in the hope that it will be useful, | ||
| # but WITHOUT ANY WARRANTY; without even the implied warranty of | ||
| # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | ||
| # GNU General Public License for more details. | ||
| # | ||
| # You should have received a copy of the GNU General Public License | ||
| # along with this program; if not, write to the Free Software | ||
| # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA | ||
|
|
||
| run_iptables() { | ||
|
|
||
| # IPT is the iptable command to use depending on ip or ipv6 address | ||
| # IPSF is the ip family name to use in ipset commands | ||
|
|
||
| IPT="iptables" | ||
| IPSF="inet" | ||
| if [ "${2#*:}" != "$2" ]; then IPT="ip6tables"; IPSF="inet6"; fi | ||
|
|
||
| # Base name of blacklist (will be used in the (ip)set name) | ||
| SETN='pamshield_blacklist' | ||
|
|
||
| TASK=$1 | ||
|
|
||
| # switch -A for iptables to -I (ipset not used) | ||
| # Or directly use add/del verbs if ipset is used | ||
|
|
||
| if [ "$TASK" = "-A" ]; then TASK="-I"; fi | ||
|
|
||
|
|
||
| # Init : in case we add an ip, check to see if pam_shield chain exists and create if necessary | ||
| # Common for "plain" iptables and ipset flavors | ||
| if echo $TASK | egrep -q "(add|-[CIA]|test)"; then | ||
|
Check warning on line 46 in scripts/shield-trigger-iptables
|
||
| if [ -z "$($IPT -L pam_shield 2>/dev/null)" ]; then | ||
| "$IPT" -N pam_shield | ||
| "$IPT" -I pam_shield -j DROP | ||
| fi | ||
| fi | ||
|
|
||
| ### Init : ipset flavor | ||
| if echo $TASK | egrep -q "(add|test)"; then | ||
|
Check warning on line 54 in scripts/shield-trigger-iptables
|
||
|
|
||
| # Test if ipset (set and rule) exist | ||
| # If not create them as needed | ||
|
|
||
| "$IPT" -C INPUT -p tcp -m set --match-set "${SETN}_$IPSF" src -j pam_shield 2>/dev/null | ||
| IPSR=$? | ||
|
|
||
| if [ -z "$(ipset list -name "${SETN}_$IPSF" 2>/dev/null)" ]; then | ||
| ipset create "${SETN}_$IPSF" hash:ip family "$IPSF" | ||
| fi | ||
|
|
||
| if [ "$IPSR" -gt 0 ]; then | ||
| "$IPT" -I INPUT -p tcp -m set --match-set "${SETN}_$IPSF" src -j pam_shield | ||
| fi | ||
| fi | ||
|
|
||
|
|
||
| # Sync action | ||
| # | ||
|
|
||
| if [ "$TASK" = "-C" ]; then | ||
| ! "$IPT" "$TASK" INPUT -p tcp -s "$2" -j pam_shield 2>/dev/null && run_iptables "-I" "$2" | ||
| return | ||
| elif [ "$TASK" = "test" ]; then | ||
| ! ipset $TASK "${SETN}_$IPSF" $2 2>/dev/null && run_iptables "add" "$2" | ||
|
Check warning on line 79 in scripts/shield-trigger-iptables
|
||
| return | ||
| fi | ||
|
|
||
|
|
||
| # CUSTOMIZE THIS RULE if you want toIn | ||
| # | ||
| # $TASK is the iptables command: -A/-I or -D | ||
| # $2 is the IP number | ||
| # | ||
| # * put in the correct chain name (pam_shield or INPUT) | ||
| # * put in the correct network interface name (e.g. -i eth0) | ||
| # Currently blocks on all interfaces | ||
| # * put in a port number (e.g.--destination-port 22 for ssh only) | ||
| # Currently blocks all ports | ||
| # * add additional rules for additional services as needed | ||
|
|
||
| if echo $TASK | egrep -q "(-[IAD])"; then | ||
|
Check warning on line 96 in scripts/shield-trigger-iptables
|
||
| "$IPT" "$TASK" INPUT -p tcp -s "$2" -j pam_shield | ||
| elif echo $TASK | egrep -q "(add|del)"; then | ||
|
Check warning on line 98 in scripts/shield-trigger-iptables
|
||
| ipset "$TASK" "${SETN}_$IPSF" "$2" | ||
| fi | ||
| } | ||
|
|
||
| ### usually no editing is needed beyond this point ### | ||
|
|
||
| log() { | ||
| logger -i -t shield-trigger -p authpriv.info "$*" | ||
| } | ||
|
|
||
| usage() { | ||
| echo "shield-trigger-iptables" | ||
| echo "usage: ${0##*/} [add|del|sync] <IP number>" | ||
| echo | ||
| echo "shield-trigger-iptables is normally called by the pam_shield PAM module" | ||
| exit 1 | ||
| } | ||
|
|
||
| PATH=/sbin:/usr/sbin:/bin:/usr/bin | ||
|
|
||
| if [ -z "$2" ]; then usage; fi | ||
|
|
||
| # Check if ipset is installed | ||
| IPSI=$(which ipset 2>/dev/null) | ||
|
|
||
|
|
||
| case "$1" in | ||
| add) | ||
| log "blocking $2" | ||
| if [ -n "$IPSI" ]; then CMD="add"; else CMD="-A"; fi | ||
| ;; | ||
|
|
||
| del) | ||
| log "unblocking $2" | ||
| if [ -n "$IPSI" ]; then CMD="del"; else CMD="-D"; fi | ||
| ;; | ||
|
|
||
| sync) | ||
| log "sync $2" | ||
| if [ -n "$IPSI" ]; then CMD="test"; else CMD="-C"; fi | ||
| ;; | ||
| *) | ||
| usage | ||
| ;; | ||
| esac | ||
|
|
||
| run_iptables "$CMD" "$2" | ||
