You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
110 lines
3.1 KiB
110 lines
3.1 KiB
#!/bin/bash
|
|
# info: add firewall rule
|
|
# options: ACTION IP PORT [PROTOCOL] [COMMENT] [RULE]
|
|
#
|
|
# example: v-add-firewall-rule DROP 185.137.111.77 25
|
|
#
|
|
# This function adds new rule to system firewall
|
|
|
|
#----------------------------------------------------------#
|
|
# Variables & Functions #
|
|
#----------------------------------------------------------#
|
|
|
|
# Argument definition
|
|
action=$(echo $1 | tr '[:lower:]' '[:upper:]')
|
|
ip=$2
|
|
port_ext=$3
|
|
protocol=${4-TCP}
|
|
protocol=$(echo $protocol | tr '[:lower:]' '[:upper:]')
|
|
comment=$5
|
|
rule=$6
|
|
|
|
# Includes
|
|
# shellcheck source=/etc/hestiacp/hestia.conf
|
|
source /etc/hestiacp/hestia.conf
|
|
# shellcheck source=/usr/local/hestia/func/main.sh
|
|
source $HESTIA/func/main.sh
|
|
# load config file
|
|
source_conf "$HESTIA/conf/hestia.conf"
|
|
|
|
# Get next firewall rule id
|
|
get_next_fw_rule() {
|
|
if [ -z "$rule" ]; then
|
|
curr_str=$(grep "RULE=" $HESTIA/data/firewall/rules.conf \
|
|
| cut -f 2 -d \' | sort -n | tail -n1)
|
|
rule="$((curr_str + 1))"
|
|
fi
|
|
}
|
|
|
|
sort_fw_rules() {
|
|
cat $HESTIA/data/firewall/rules.conf \
|
|
| sort -n -k 2 -t \' > $HESTIA/data/firewall/rules.conf.tmp
|
|
mv -f $HESTIA/data/firewall/rules.conf.tmp \
|
|
$HESTIA/data/firewall/rules.conf
|
|
}
|
|
|
|
#----------------------------------------------------------#
|
|
# Verifications #
|
|
#----------------------------------------------------------#
|
|
|
|
check_args '3' "$#" 'ACTION IP PORT [PROTOCOL] [COMMENT] [RULE]'
|
|
is_format_valid 'action' 'protocol' 'port_ext'
|
|
is_system_enabled "$FIREWALL_SYSTEM" 'FIREWALL_SYSTEM'
|
|
get_next_fw_rule
|
|
is_format_valid 'rule'
|
|
is_object_new '../../data/firewall/rules' 'RULE' "$rule"
|
|
if [ -n "$comment" ]; then
|
|
is_format_valid 'comment'
|
|
fi
|
|
if [[ "$ip" =~ ^ipset: ]]; then
|
|
ipset_name="${ip#ipset:}"
|
|
$BIN/v-list-firewall-ipset plain | grep "^$ipset_name\s" > /dev/null
|
|
check_result $? 'ipset object not found' "$E_NOTEXIST"
|
|
else
|
|
is_format_valid 'ip'
|
|
fi
|
|
|
|
# Perform verification if read-only mode is enabled
|
|
check_hestia_demo_mode
|
|
|
|
#----------------------------------------------------------#
|
|
# Action #
|
|
#----------------------------------------------------------#
|
|
|
|
# Generating timestamp
|
|
time_n_date=$(date +'%T %F')
|
|
time=$(echo "$time_n_date" | cut -f 1 -d \ )
|
|
date=$(echo "$time_n_date" | cut -f 2 -d \ )
|
|
|
|
# Concatenating rule
|
|
str="RULE='$rule' ACTION='$action' PROTOCOL='$protocol' PORT='$port_ext'"
|
|
str="$str IP='$ip' COMMENT='$comment' SUSPENDED='no'"
|
|
str="$str TIME='$time' DATE='$date'"
|
|
|
|
# Adding to config
|
|
echo "$str" >> $HESTIA/data/firewall/rules.conf
|
|
|
|
# Changing permissions
|
|
chmod 660 $HESTIA/data/firewall/rules.conf
|
|
|
|
# Sorting firewall rules by id number
|
|
sort_fw_rules
|
|
|
|
# Updating system firewall
|
|
$BIN/v-update-firewall
|
|
|
|
#----------------------------------------------------------#
|
|
# Hestia #
|
|
#----------------------------------------------------------#
|
|
|
|
# Fix missing port value in log if zero
|
|
if [ -z "$port" ]; then
|
|
port="0"
|
|
fi
|
|
|
|
# Logging
|
|
$BIN/v-log-action "system" "Info" "Firewall" "Added firewall rule (Action: $action, Port: $port, Protocol: $protocol)."
|
|
log_event "$OK" "$ARGUMENTS"
|
|
|
|
exit
|