-
-
Notifications
You must be signed in to change notification settings - Fork 674
/
v-add-firewall-rule
executable file
·113 lines (91 loc) · 3.17 KB
/
v-add-firewall-rule
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
#!/bin/bash
# info: add firewall rule
# options: ACTION IP PORT [PROTOCOL] [COMMENT] [RULE]
# labels:
#
# example: v-add-firewall-rule DROP 185.137.111.77 25
#
# The function adds new rule to system firewall
#----------------------------------------------------------#
# Variable&Function #
#----------------------------------------------------------#
# Argument definition
action=$(echo $1|tr '[:lower:]' '[:upper:]')
ip=$2
port_ext=$3
protocol=${4-TCP}
protocol=$(echo $protocol|tr '[:lower:]' '[:upper:]')
comment=$5
rule=$6
# Includes
# shellcheck source=/etc/hestiacp/hestia.conf
source /etc/hestiacp/hestia.conf
# shellcheck source=/usr/local/hestia/func/main.sh
source $HESTIA/func/main.sh
# load config file
source_conf "$HESTIA/conf/hestia.conf"
# Get next firewall rule id
get_next_fw_rule() {
if [ -z "$rule" ]; then
curr_str=$(grep "RULE=" $HESTIA/data/firewall/rules.conf |\
cut -f 2 -d \' | sort -n | tail -n1)
rule="$((curr_str +1))"
fi
}
sort_fw_rules() {
cat $HESTIA/data/firewall/rules.conf |\
sort -n -k 2 -t \' > $HESTIA/data/firewall/rules.conf.tmp
mv -f $HESTIA/data/firewall/rules.conf.tmp \
$HESTIA/data/firewall/rules.conf
}
#----------------------------------------------------------#
# Verifications #
#----------------------------------------------------------#
check_args '3' "$#" 'ACTION IP PORT [PROTOCOL] [COMMENT] [RULE]'
is_format_valid 'action' 'protocol' 'port_ext'
is_system_enabled "$FIREWALL_SYSTEM" 'FIREWALL_SYSTEM'
get_next_fw_rule
is_format_valid 'rule'
is_object_new '../../data/firewall/rules' 'RULE' "$rule"
if [ -n "$comment" ]; then
is_format_valid 'comment'
fi
if [[ "$ip" =~ ^ipset: ]]; then
ipset_name="${ip#ipset:}"
$BIN/v-list-firewall-ipset plain | grep "^$ipset_name\s" >/dev/null
check_result $? 'ipset object not found' "$E_NOTEXIST"
else
is_format_valid 'ip'
fi
# Perform verification if read-only mode is enabled
check_hestia_demo_mode
#----------------------------------------------------------#
# Action #
#----------------------------------------------------------#
# Generating timestamp
time_n_date=$(date +'%T %F')
time=$(echo "$time_n_date" |cut -f 1 -d \ )
date=$(echo "$time_n_date" |cut -f 2 -d \ )
# Concatenating rule
str="RULE='$rule' ACTION='$action' PROTOCOL='$protocol' PORT='$port_ext'"
str="$str IP='$ip' COMMENT='$comment' SUSPENDED='no'"
str="$str TIME='$time' DATE='$date'"
# Adding to config
echo "$str" >> $HESTIA/data/firewall/rules.conf
# Changing permissions
chmod 660 $HESTIA/data/firewall/rules.conf
# Sorting firewall rules by id number
sort_fw_rules
# Updating system firewall
$BIN/v-update-firewall
#----------------------------------------------------------#
# Hestia #
#----------------------------------------------------------#
# Fix missing port value in log if zero
# Logging
if [ -z "$port" ]; then
port="0"
fi
$BIN/v-log-action "system" "Info" "Firewall" "Added firewall rule (Action: $action, Port: $port, Protocol: $protocol)."
log_event "$OK" "$ARGUMENTS"
exit