PC World Komputer 2010 April/PCWorld0410.iso/hity wydania/Ubuntu 9.10 PL/karmelkowy-koliberek-desktop-9.10-i386-PL.iso/casper/filesystem.squashfs/usr/share/ufw/check-requirements

Text File | 2009-09-23 | 5.0 KB | 193 lines

#!/bin/sh
#
# check-requirements: verify all the required iptables functionality is
# available
#
# Copyright 2008-2009 Canonical Ltd.
#
#    This program is free software: you can redistribute it and/or modify
#    it under the terms of the GNU General Public License version 3,
#    as published by the Free Software Foundation.
#
#    This program is distributed in the hope that it will be useful,
#    but WITHOUT ANY WARRANTY; without even the implied warranty of
#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
#    GNU General Public License for more details.
#
#    You should have received a copy of the GNU General Public License
#    along with this program.  If not, see <http://www.gnu.org/licenses/>.
#
set -e

chain="ufw-check-requirements"
error=""

runcmd() {
    if $@ >/dev/null 2>&1 ; then
        echo pass
    else
        echo FAIL
        error="yes"
    fi
}

# check binaries
for i in "" 6; do
    exe="iptables"
    if [ "$i" = "6" ]; then
        exe="ip6tables"
    fi

    echo -n "Has $exe: "
    if ! which $exe >/dev/null 2>&1; then
        echo "ERROR: could not find '$exe'" >&2
        error="yes"
    else
        echo "pass"
    fi
done

if [ -n "$error" ]; then
    exit 1
fi
echo ""

# check modules
for i in "" 6; do
    exe="iptables"
    c="${chain}"
    ipv="4"
    if [ "$i" = "6" ]; then
        exe="ip6tables"
        c="${chain}6"
        ipv="6"
    fi

    if [ "$i" = "6" ]; then
        echo "== IPv6 =="
    else
        echo "== IPv4 =="
    fi

    echo -n "Creating '$c'... "
    $exe -N "$c" || {
        echo "ERROR: could not create '$c'. Aborting" >&2
        error="yes"
        break
    }
    echo "done"

    # set up a RETURN rule right at the top, so we don't open anything up when
    # running the script. Isn't attached to INPUT, but better safe than sorry.
    echo -n "Inserting RETURN at top of '$c'... "
    $exe -I "$c" -j RETURN || {
        echo "ERROR: could insert RETURN rule into '$c'. Aborting" >&2
        error="yes"
        break
    }
    echo "done"

    echo -n "TCP: "
    runcmd $exe -A $c -p tcp -j ACCEPT

    echo -n "UDP: "
    runcmd $exe -A $c -p udp -j ACCEPT

    echo -n "destination port: "
    runcmd $exe -A $c -p tcp --dport 22 -j ACCEPT

    echo -n "source port: "
    runcmd $exe -A $c -p tcp --sport 22 -j ACCEPT

    for j in ACCEPT DROP REJECT LOG; do
        echo -n "$j: "
        runcmd $exe -A $c -p tcp --sport 23 -j $j
    done

    echo -n "hashlimit: "
    runcmd $exe -A $c -m hashlimit -m tcp -p tcp --dport 22 --hashlimit 1/min --hashlimit-mode srcip --hashlimit-name ssh -m state --state NEW -j ACCEPT

    echo -n "limit: "
    runcmd $exe -A $c -m limit --limit 3/min --limit-burst 10 -j ACCEPT

    for j in NEW RELATED ESTABLISHED INVALID; do
        echo -n "state ($j): "
        runcmd $exe -A $c -m state --state $j
    done

    echo -n "state (new, recent set): "
    runcmd $exe -A $c -m state --state NEW -m recent --set

    echo -n "state (new, recent update): "
    runcmd $exe -A $c -m state --state NEW -m recent --update --seconds 30 --hitcount 6 -j ACCEPT

    echo -n "state (new, limit): "
    runcmd $exe -A $c -m state --state NEW -m limit --limit 3/min --limit-burst 10 -j ACCEPT

    echo -n "interface (input): "
    runcmd $exe -A $c -i eth0 -j ACCEPT

    echo -n "interface (output): "
    runcmd $exe -A $c -o eth0 -j ACCEPT

    echo -n "multiport: "
    runcmd $exe -A $c -p tcp -m multiport --dports 80,443,8080:8090 -j ACCEPT

    echo -n "comment: "
    runcmd $exe -A $c -m comment --comment 'dapp_Samba'

    if [ -z "$i" ]; then
        for j in LOCAL MULTICAST BROADCAST; do
            echo -n "addrtype ($j): "
            runcmd $exe -A $c -m addrtype --dst-type $j -j RETURN
        done

        for j in destination-unreachable source-quench time-exceeded parameter-problem echo-request; do
            echo -n "icmp ($j): "
            runcmd $exe -A $c -p icmp --icmp-type $j -j ACCEPT
        done
    else
        for j in destination-unreachable packet-too-big time-exceeded parameter-problem echo-request; do
            echo -n "icmpv6 ($j): "
            runcmd $exe -A $c -p icmpv6 --icmpv6-type $j -j ACCEPT
        done

        for j in neighbor-solicitation neighbor-advertisement router-solicitation router-advertisement; do
            echo -n "icmpv6 with hl ($j): "
            runcmd $exe -A $c -p icmpv6 --icmpv6-type $j -m hl --hl-eq 255 -j ACCEPT
        done
    fi

    echo ""
done

# cleanup
for i in "" 6; do
    exe="iptables"
    c="${chain}"
    if [ "$i" = "6" ]; then
        exe="ip6tables"
        c="${chain}6"
    fi
    $exe -F $c >/dev/null 2>&1 || {
        if [ -z "$error" ]; then
            echo "ERROR: could not flush '$c'" >&2
            error="yes"
        fi
    }
    $exe -X $c >/dev/null 2>&1 || {
        if [ -z "$error" ]; then
            error="yes"
            echo "ERROR: could not remove '$c'" >&2
        fi
    }
done

if [ -n "$error" ]; then
    echo "FAIL: check your kernel and that you have iptables >= 1.4.0"
    exit 1
fi
echo "All tests passed"
exit 0