1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
|
#!/bin/rc
# fwstart [cfg] - start a firewall for each card named in /lib/ndb/fw.
#
# Run this after the network is configured and before anything dials.
# fw reads each card's address from the card itself, so the addresses
# have to be there already; and a program that connects before fw is up
# is a program that was never filtered.
rfork e
cfg=/lib/ndb/fw
if(! ~ $#* 0)
cfg=$1
if(! test -f $cfg){
echo fwstart: no $cfg, nothing to do >[1=2]
exit
}
# the cards named in the config
fn cards {
awk '
/^[ \t]*#/ { next }
{ for(i = 1; i <= NF; i++) if($i ~ /^fw=/) print substr($i, 4) }
' $cfg
}
# the rule file for one card
fn rulesfor {
awk -v 'want='^$1 '
/^[ \t]*#/ { next }
{
dev = ""; rules = ""
for(i = 1; i <= NF; i++){
if($i ~ /^fw=/) dev = substr($i, 4)
if($i ~ /^rules=/) rules = substr($i, 7)
}
if(dev == want && rules != ""){ print rules; exit }
}
' $cfg
}
# Each card gets its own control directory; mntgen makes them appear.
#
# mount(2) needs the mount point to exist, so mntgen cannot make /mnt/fw
# and this used to run it only when /mnt/fw was missing - which is the
# one case where it fails. So the directory first, and then mntgen only
# if it is not already there: under mntgen every name exists, which is
# the test.
#
# mntgen and fw both leave a server behind, and a server started from a
# shell keeps that shell's file descriptors. Started from the console -
# or from a serial shell, which is where this gets tried first - that
# means a daemon sitting on the console's input, which looks exactly
# like a wedged terminal. Give them nothing to hold.
if(! test -d /mnt/fw)
mkdir -p /mnt/fw
if(! test -d /mnt/fw/is-mntgen-here)
mntgen /mnt/fw </dev/null >/dev/null >[2]/dev/null
for(name in `{cards}){
dev=/net/$name
rules=`{rulesfor $name}
if(! test -e $dev)
echo fwstart: no $dev, skipped >[1=2]
if not if(~ $#rules 0)
echo fwstart: no rules given for $name, skipped >[1=2]
if not if(! test -f $rules)
echo fwstart: $rules missing, $name skipped >[1=2]
if not {
fw -m /mnt/fw/$name -e $dev $rules </dev/null >/dev/null
if(~ $status '')
echo fwstart: $name filtered by $rules
if not
echo fwstart: $name failed to start >[1=2]
}
}
|
