contrib/package/freifunk-p2pblock/files/freifunk-p2pblock.init

   1 #!/bin/sh /etc/rc.common
   2
   3 START=82
   4 ME="freifunk-p2pblock"
   5 LOCK='/var/run/p2pblock.lock'
   6
   7 # helper-scripts
   8 ipt_add() {
   9         logger -t "$ME" "set 'iptables -I $1'"
  10         iptables -I $1
  11         echo "iptables -D $1" >> $LOCK
  12 }
  13
  14 start() {
  15         /etc/init.d/freifunk-p2pblock enabled || return
  16
  17         if [ ! -s "$LOCK" ]; then
  18                 logger -s -t "$ME" 'starting p2pblock...'
  19
  20                 config_load network
  21                 config_get wan wan ifname
  22
  23                 if [ -n "$wan" ]; then
  24                         config_load freifunk_p2pblock
  25                         config_get layer7 p2pblock layer7
  26                         config_get ipp2p p2pblock ipp2p
  27                         config_get portrange p2pblock portrange
  28                         config_get blocktime p2pblock blocktime
  29                         config_get whitelist p2pblock whitelist
  30
  31                         # load modules
  32                         insmod ipt_ipp2p 2>&-
  33                         insmod ipt_layer7 2>&-
  34                         insmod ipt_recent ip_list_tot=400 ip_pkt_list_tot=3 2>&-
  35
  36                         # create new p2p-chain
  37                         iptables -N p2pblock
  38                         # pipe all incoming FORWARD with source-/destination-port 1024-65535 throu p2p-chain
  39                         ipt_add "FORWARD -i $wan -p tcp --sport $portrange --dport $portrange -j p2pblock"
  40                         ipt_add "FORWARD -i $wan -p udp --sport $portrange --dport $portrange -j p2pblock"
  41
  42                         # if p2p-traffic blocked 3 packages to a destination ip then block all traffic within the next 180 sec (port 1024-65535)
  43                         ipt_add "p2pblock -m recent --rdest --rcheck --name P2PBLOCK --seconds $blocktime --hitcount 3 -j DROP"
  44                         ipt_add "p2pblock -m recent --rdest --rcheck --name P2PBLOCK --seconds $blocktime --hitcount 3 -m limit --limit 1/minute -j LOG --log-prefix P2PBLOCK-DROP:"
  45
  46                         # create layer7-rules
  47                         for proto in $layer7; do
  48                                 ipt_add "p2pblock -m layer7 --l7proto $proto -m recent --rdest --set --name P2PBLOCK"
  49                                 ipt_add "p2pblock -m layer7 --l7proto $proto -m limit --limit 1/minute -j LOG --log-prefix P2PBLOCK-seen-$proto:"
  50                         done
  51
  52                         # create ipp2p-rules
  53                         for proto in $ipp2p; do
  54                                 ipt_add "p2pblock -m ipp2p --$proto -m recent --rdest --set --name P2PBLOCK"
  55                                 ipt_add "p2pblock -m ipp2p --$proto -m limit --limit 1/minute -j LOG --log-prefix P2PBLOCK-seen-$proto:"
  56                         done
  57
  58                         # insert whitelisted ips
  59                         for ip in $whitelist; do
  60                                 ipt_add "p2pblock -d $ip -j RETURN"
  61                         done
  62
  63                         logger -s -t "$ME" 'Done.'; return 0
  64                 else
  65                         logger -s -t "$ME" 'No wan interface present.'; return 0
  66                 fi
  67         else
  68                 logger -s -t "$ME" 'WARNING! already running - Aborting!'; return 2
  69         fi
  70 }
  71
  72 stop() {
  73         if [ -s "$LOCK" ]; then
  74                 logger -s -t "$ME" 'stopping p2pblock...'
  75
  76                 # unset all rules in $LOCK-file
  77                 cat $LOCK | sed -ne '1!G;h;$p' | while read line; do
  78                         logger -t "$ME" "unset $line"
  79                         while eval $line 2>&-; do :; done
  80                 done; : > "$LOCK"
  81
  82                 # flush and delete the p2p-chain
  83                 iptables -F p2pblock
  84                 iptables -X p2pblock
  85                 logger -s -t "$ME" 'Done.'; return 0
  86
  87         else
  88                 logger -s -t "$ME" 'WARNING! not running - Aborting!'; return 2
  89
  90         fi
  91 }
  92
  93 restart() {
  94         stop; sleep 1; start
  95 }