openship 0.4.5 → 0.4.7

package/dist/server/engine/samples/firewall/iptables/ip6tables.init.debian

@@ -0,0 +1,362 @@
+#!/usr/bin/env bash
+
+#---------------------------------------------------------------------
+# This file is part of iRedMail, which is an open source mail server
+# solution for Red Hat(R) Enterprise Linux, CentOS, Debian and Ubuntu.
+#
+# iRedMail is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# iRedMail is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with iRedMail.  If not, see <http://www.gnu.org/licenses/>.
+#---------------------------------------------------------------------
+
+#
+### BEGIN INIT INFO
+# Provides:          ip6tables
+# Required-Start:    $network $syslog
+# Required-Stop:     $network $syslog
+# Default-Start:     2 3 4 5
+# Default-Stop:      0 1 6
+# Short-Description: Control ip6tables firewall.
+### END INIT INFO
+#
+# This init.d script is used to control ip6tables, based on
+# /etc/init.d/ip6tables on Red Hat Enterprise Linux 5.3, modified
+# by Zhang Huangbin (zhb _at_ iredmail.org), iRedMail project
+# (http://www.iredmail.org/).
+#
+
+#
+# config: /etc/default/ip6tables
+
+# Source function library.
+. /lib/lsb/init-functions
+
+IPTABLES='ip6tables'
+IPTABLES_DATA="/etc/default/$IPTABLES"
+IPTABLES_CONFIG="/etc/default/${IPTABLES}-config"
+IPV="${IPTABLES%tables}" # ip for ipv4 | ip6 for ipv6
+PROC_IPTABLES_NAMES="/proc/net/${IPV}_tables_names"
+VAR_SUBSYS_IPTABLES="/var/lock/subsys/$IPTABLES"
+[ -d $(dirname ${VAR_SUBSYS_IPTABLES}) ] || mkdir -p $(dirname ${VAR_SUBSYS_IPTABLES})
+
+if [ ! -x /sbin/$IPTABLES ]; then
+    log_daemon_msg "/sbin/$IPTABLES does not exist." "ip6tables"
+    exit 0
+fi
+
+if lsmod 2>/dev/null | grep -q ipchains ; then
+    log_daemon_msg  "ipchains and $IPTABLES can not be used together." "ip6tables"
+    exit 0
+fi
+
+# Old or new modutils
+/sbin/modprobe --version 2>&1 | grep -q module-init-tools \
+    && NEW_MODUTILS=1 \
+    || NEW_MODUTILS=0
+
+# Default firewall configuration:
+IPTABLES_MODULES=""
+IPTABLES_MODULES_UNLOAD="no"
+IPTABLES_SAVE_ON_STOP="no"
+IPTABLES_SAVE_ON_RESTART="no"
+IPTABLES_SAVE_COUNTER="no"
+IPTABLES_STATUS_NUMERIC="yes"
+
+# Load firewall configuration.
+[ -f "$IPTABLES_CONFIG" ] && . "$IPTABLES_CONFIG"
+
+rmmod_r() {
+    # Unload module with all referring modules.
+    # At first all referring modules will be unloaded, then the module itself.
+    local mod=$1
+    local ret=0
+    local ref=
+
+    # Get referring modules.
+    # New modutils have another output format.
+    [ $NEW_MODUTILS = 1 ] \
+	&& ref=`lsmod | awk "/^${mod}/ { print \\\$4; }" | tr ',' ' '` \
+	|| ref=`lsmod | grep ^${mod} | cut -d "[" -s -f 2 | cut -d "]" -s -f 1`
+
+    # recursive call for all referring modules
+    for i in $ref; do
+	rmmod_r $i
+	let ret+=$?;
+    done
+
+    # Unload module.
+    # The extra test is for 2.6: The module might have autocleaned,
+    # after all referring modules are unloaded.
+    if grep -q "^${mod}" /proc/modules ; then
+	modprobe -r $mod > /dev/null 2>&1
+	let ret+=$?;
+    fi
+
+    return $ret
+}
+
+flush_n_delete() {
+    # Flush firewall rules and delete chains.
+    [ -e "$PROC_IPTABLES_NAMES" ] || return 1
+
+    # Check if firewall is configured (has tables)
+    tables=`cat $PROC_IPTABLES_NAMES 2>/dev/null`
+    [ -z "$tables" ] && return 1
+
+    log_daemon_msg "Flushing firewall rules" "ip6tables"
+    ret=0
+    # For all tables
+    for i in $tables; do
+        # Flush firewall rules.
+	$IPTABLES -t $i -F;
+	let ret+=$?;
+
+        # Delete firewall chains.
+	$IPTABLES -t $i -X;
+	let ret+=$?;
+
+	# Set counter to zero.
+	$IPTABLES -t $i -Z;
+	let ret+=$?;
+    done
+
+    [ $ret -eq 0 ] && log_end_msg 0 || log_end_msg 1
+    return $ret
+}
+
+set_policy() {
+    # Set policy for configured tables.
+    policy=$1
+
+    # Check if iptable module is loaded
+    [ ! -e "$PROC_IPTABLES_NAMES" ] && return 1
+
+    # Check if firewall is configured (has tables)
+    tables=`cat $PROC_IPTABLES_NAMES 2>/dev/null`
+    [ -z "$tables" ] && return 1
+
+    log_daemon_msg "Setting chains to policy $policy"
+    ret=0
+    for i in $tables; do
+        echo -n " $i"
+        case "$i" in
+           security)
+               $IPTABLES -t filter -P INPUT $policy \
+                   && $IPTABLES -t filter -P OUTPUT $policy \
+                   && $IPTABLES -t filter -P FORWARD $policy \
+                   || let ret+=1
+               ;;
+            raw)
+                $IPTABLES -t raw -P PREROUTING $policy \
+                && $IPTABLES -t raw -P OUTPUT $policy \
+                || let ret+=1
+            ;;
+            filter)
+                $IPTABLES -t filter -P INPUT $policy \
+                && $IPTABLES -t filter -P OUTPUT $policy \
+                && $IPTABLES -t filter -P FORWARD $policy \
+                || let ret+=1
+            ;;
+            nat)
+            $IPTABLES -t nat -P PREROUTING $policy \
+                && $IPTABLES -t nat -P POSTROUTING $policy \
+                && $IPTABLES -t nat -P OUTPUT $policy \
+                || let ret+=1
+            ;;
+            mangle)
+                $IPTABLES -t mangle -P PREROUTING $policy \
+                && $IPTABLES -t mangle -P POSTROUTING $policy \
+                && $IPTABLES -t mangle -P INPUT $policy \
+                && $IPTABLES -t mangle -P OUTPUT $policy \
+                && $IPTABLES -t mangle -P FORWARD $policy \
+                || let ret+=1
+            ;;
+            *)
+                let ret+=1
+            ;;
+        esac
+    done
+
+    [ $ret -eq 0 ] && log_end_msg 0 || log_end_msg 1
+    return $ret
+}
+
+start() {
+    # Do not start if there is no config file.
+    [ -f "$IPTABLES_DATA" ] || return 1
+
+    log_daemon_msg "Applying $IPTABLES firewall rules"
+
+    OPT=
+    [ "x$IPTABLES_SAVE_COUNTER" = "xyes" ] && OPT="-c"
+
+    $IPTABLES-restore $OPT $IPTABLES_DATA
+    if [ $? -eq 0 ]; then
+        log_end_msg 0
+    else
+        log_end_msg 1; return 1
+    fi
+
+    # Load additional modules (helpers)
+    if [ -n "$IPTABLES_MODULES" ]; then
+	echo -n "Loading additional $IPTABLES modules"
+	ret=0
+	for mod in $IPTABLES_MODULES; do
+	    echo -n "$mod "
+	    modprobe $mod > /dev/null 2>&1
+	    let ret+=$?;
+	done
+	[ $ret -eq 0 ] && log_end_msg 0 || log_end_msg 1
+    fi
+
+    touch $VAR_SUBSYS_IPTABLES
+    return $ret
+}
+
+stop() {
+    # Do not stop if iptables module is not loaded.
+    [ -e "$PROC_IPTABLES_NAMES" ] || return 1
+
+    flush_n_delete
+    set_policy ACCEPT
+
+    if [ "x$IPTABLES_MODULES_UNLOAD" = "xyes" ]; then
+	echo -n "Unloading $IPTABLES modules"
+	ret=0
+	rmmod_r ${IPV}_tables
+	let ret+=$?;
+	rmmod_r ${IPV}_conntrack
+	let ret+=$?;
+	[ $ret -eq 0 ] && log_end_msg 0 || log_end_msg 1
+    fi
+
+    rm -f $VAR_SUBSYS_IPTABLES
+    return $ret
+}
+
+save() {
+    # Check if iptable module is loaded
+    [ ! -e "$PROC_IPTABLES_NAMES" ] && return 1
+
+    # Check if firewall is configured (has tables)
+    tables=`cat $PROC_IPTABLES_NAMES 2>/dev/null`
+    [ -z "$tables" ] && return 1
+
+    echo -n "Saving firewall rules to $IPTABLES_DATA"
+
+    OPT=
+    [ "x$IPTABLES_SAVE_COUNTER" = "xyes" ] && OPT="-c"
+
+    ret=0
+    TMP_FILE=`/bin/mktemp -q /tmp/$IPTABLES.XXXXXX` \
+	&& chmod 600 "$TMP_FILE" \
+	&& $IPTABLES-save $OPT > $TMP_FILE 2>/dev/null \
+	&& size=`stat -c '%s' $TMP_FILE` && [ $size -gt 0 ] \
+	|| ret=1
+    if [ $ret -eq 0 ]; then
+	if [ -e $IPTABLES_DATA ]; then
+	    cp -f $IPTABLES_DATA $IPTABLES_DATA.save \
+		&& chmod 600 $IPTABLES_DATA.save \
+		|| ret=1
+	fi
+	if [ $ret -eq 0 ]; then
+	    cp -f $TMP_FILE $IPTABLES_DATA \
+		&& chmod 600 $IPTABLES_DATA \
+	        || ret=1
+	fi
+    fi
+    [ $ret -eq 0 ] && log_end_msg 0 || log_end_msg 1
+    echo
+    rm -f $TMP_FILE
+    return $ret
+}
+
+status() {
+    tables=`cat $PROC_IPTABLES_NAMES 2>/dev/null`
+
+    # Do not print status if lockfile is missing and iptables modules are not
+    # loaded.
+    # Check if iptable module is loaded
+    if [ ! -f "$VAR_SUBSYS_IPTABLES" -a -z "$tables" ]; then
+	echo "Firewall is stopped."
+	return 1
+    fi
+
+    # Check if firewall is configured (has tables)
+    if [ ! -e "$PROC_IPTABLES_NAMES" ]; then
+	echo "Firewall is not configured. "
+	return 1
+    fi
+    if [ -z "$tables" ]; then
+	echo "Firewall is not configured. "
+	return 1
+    fi
+
+    NUM=
+    [ "x$IPTABLES_STATUS_NUMERIC" = "xyes" ] && NUM="-n"
+    VERBOSE=
+    [ "x$IPTABLES_STATUS_VERBOSE" = "xyes" ] && VERBOSE="--verbose"
+    COUNT=
+    [ "x$IPTABLES_STATUS_LINENUMBERS" = "xyes" ] && COUNT="--line-numbers"
+
+    for table in $tables; do
+	echo "Table: $table"
+	$IPTABLES -t $table --list $NUM $VERBOSE $COUNT && echo
+    done
+
+    return 0
+}
+
+restart() {
+    [ "x$IPTABLES_SAVE_ON_RESTART" = "xyes" ] && save
+    stop
+    start
+}
+
+case "$1" in
+    start)
+	stop
+	start
+	RETVAL=$?
+	;;
+    stop)
+	[ "x$IPTABLES_SAVE_ON_STOP" = "xyes" ] && save
+	stop
+	RETVAL=$?
+	;;
+    restart)
+	restart
+	RETVAL=$?
+	;;
+    condrestart)
+	[ -e "$VAR_SUBSYS_IPTABLES" ] && restart
+	;;
+    status)
+	status
+	RETVAL=$?
+	;;
+    panic)
+	flush_n_delete
+	set_policy DROP
+	RETVAL=$?
+        ;;
+    save)
+	save
+	RETVAL=$?
+	;;
+    *)
+	echo "Usage: $0 {start|stop|restart|condrestart|status|panic|save}"
+	exit 1
+	;;
+esac
+
+exit $RETVAL

package/dist/server/engine/samples/firewall/iptables/ip6tables.rules

@@ -0,0 +1,53 @@
+#---------------------------------------------------------------------
+# This file is part of iRedMail, which is an open source mail server
+# solution for Red Hat(R) Enterprise Linux, CentOS, Debian and Ubuntu.
+#
+# iRedMail is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# iRedMail is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with iRedMail.  If not, see <http://www.gnu.org/licenses/>.
+#---------------------------------------------------------------------
+
+*filter
+:INPUT DROP [0:0]
+:FORWARD DROP [0:0]
+:OUTPUT ACCEPT [0:0]
+
+# Keep state.
+-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
+
+# Loop device.
+-A INPUT -i lo -j ACCEPT
+
+-A INPUT -p ipv6-icmp -j ACCEPT
+
+# ssh
+-A INPUT -p tcp --dport 22 -j ACCEPT
+
+# http, https
+-A INPUT -p tcp --dport 80 -j ACCEPT
+-A INPUT -p tcp --dport 443 -j ACCEPT
+
+# smtp, submission, smtps
+-A INPUT -p tcp --dport 25 -j ACCEPT
+-A INPUT -p tcp --dport 587 -j ACCEPT
+-A INPUT -p tcp --dport 465 -j ACCEPT
+
+# pop3, pop3s
+-A INPUT -p tcp --dport 110 -j ACCEPT
+-A INPUT -p tcp --dport 995 -j ACCEPT
+#-A INPUT -p tcp --dport 10110 -j ACCEPT
+
+# imap, imaps
+-A INPUT -p tcp --dport 143 -j ACCEPT
+-A INPUT -p tcp --dport 993 -j ACCEPT
+
+COMMIT