gluon-ebtables 1.4 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273
  1. #!/bin/sh /etc/rc.common
  2. # Copyright (C) 2013 Project Gluon
  3. #
  4. # Firewall script for inserting and removing ebtables rules.
  5. #
  6. # Example format, for filtering any IPv4 multicast packets to the SSDP UDP port:
  7. # rule FORWARD --logical-out br-client -d Multicast -p IPv4 --ip-protocol udp --ip-destination-port 5355 -j DROP
  8. #
  9. # Removing all rules:
  10. # $ ./firewall-ebtables stop
  11. # Inserting all rules:
  12. # $ ./firewall-ebtables start
  13. # Inserting a specific rule file:
  14. # $ ./firewall-ebtables start /lib/gluon/ebtables/100-mcast-chain
  15. # Removing a specific rule file:
  16. # $ ./firewall-ebtables stop /lib/gluon/ebtables/100-mcast-chain
  17. START=19
  18. STOP=91
  19. exec_file() {
  20. local file="$1"
  21. /usr/bin/lua -e "
  22. function rule(command)
  23. os.execute($EBTABLES_RULE)
  24. end
  25. function chain(name, policy)
  26. os.execute($EBTABLES_CHAIN)
  27. end
  28. " "$file"
  29. }
  30. exec_all() {
  31. local sort_arg="$1"
  32. local old_ifs="$IFS"
  33. IFS='
  34. '
  35. for file in `find /lib/gluon/ebtables -type f | sort $sort_arg`; do
  36. exec_file "$file"
  37. done
  38. IFS="$old_ifs"
  39. }
  40. start() {
  41. (
  42. export EBTABLES_RULE='"ebtables -A " .. command'
  43. export EBTABLES_CHAIN='"ebtables -N " .. name .. " -P " .. policy'
  44. if [ -z "$1" ]; then
  45. exec_all ''
  46. else
  47. exec_file "$1"
  48. fi
  49. )
  50. }
  51. stop() {
  52. (
  53. export EBTABLES_RULE='"ebtables -D " .. command'
  54. export EBTABLES_CHAIN='"ebtables -X " .. name'
  55. if [ -z "$1" ]; then
  56. exec_all '-r'
  57. else
  58. exec_file "$1"
  59. fi
  60. )
  61. }