blob: 00b4d3afff34c8f0d6c14e48ff25de24de53fa6d (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
|
#!/bin/rc
# fwstart [cfg] - start a firewall for each card named in /lib/ndb/fw.
#
# Run this after the network is configured and before anything dials.
# fw reads each card's address from the card itself, so the addresses
# have to be there already; and a program that connects before fw is up
# is a program that was never filtered.
rfork e
cfg=/lib/ndb/fw
if(! ~ $#* 0)
cfg=$1
if(! test -f $cfg){
echo fwstart: no $cfg, nothing to do >[1=2]
exit
}
# the cards named in the config
fn cards {
awk '
/^[ \t]*#/ { next }
{ for(i = 1; i <= NF; i++) if($i ~ /^fw=/) print substr($i, 4) }
' $cfg
}
# the rule file for one card
fn rulesfor {
awk -v 'want='^$1 '
/^[ \t]*#/ { next }
{
dev = ""; rules = ""
for(i = 1; i <= NF; i++){
if($i ~ /^fw=/) dev = substr($i, 4)
if($i ~ /^rules=/) rules = substr($i, 7)
}
if(dev == want && rules != ""){ print rules; exit }
}
' $cfg
}
# each card gets its own control directory; mntgen makes them appear
if(! test -d /mnt/fw)
mntgen /mnt/fw
for(name in `{cards}){
dev=/net/$name
rules=`{rulesfor $name}
if(! test -e $dev)
echo fwstart: no $dev, skipped >[1=2]
if not if(~ $#rules 0)
echo fwstart: no rules given for $name, skipped >[1=2]
if not if(! test -f $rules)
echo fwstart: $rules missing, $name skipped >[1=2]
if not {
fw -m /mnt/fw/$name -e $dev $rules
if(~ $status '')
echo fwstart: $name filtered by $rules
if not
echo fwstart: $name failed to start >[1=2]
}
}
|
