File:
[LON-CAPA] /
loncom /
lciptables
Revision
1.9:
download - view:
text,
annotated -
select for diffs
Sun Jun 9 02:35:37 2019 UTC (5 years, 2 months ago) by
raeburn
Branches:
MAIN
CVS tags:
version_2_12_X,
version_2_11_X,
version_2_11_5_msu,
version_2_11_5,
version_2_11_4_uiuc,
version_2_11_4_msu,
version_2_11_4,
version_2_11_3_uiuc,
version_2_11_3_msu,
version_2_11_3,
HEAD
- Dynamic management of LON-CAPA port 5663 compatible with firewalld
- &get_default_zone(() provides default zone
- Revert changes in rev. 1.17 to &uses_firewalld() -- now returns
1 if firewalld in use, but not the default zone.
- Additional arg, value = 1 if firewalld in use is passed to
&firewall_open_port(), &firewall_close_port(),
&firewall_is_port_open(), &firewall_close_anywhere()
#!/usr/bin/perl
#
# The Learning Online Network with CAPA
#
# $Id: lciptables,v 1.9 2019/06/09 02:35:37 raeburn Exp $
#
# Copyright Michigan State University Board of Trustees
#
# This file is part of the LearningOnline Network with CAPA (LON-CAPA).
#
# LON-CAPA is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# LON-CAPA is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with LON-CAPA; if not, write to the Free Software
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
#
# /home/httpd/html/adm/gpl.txt
#
# http://www.lon-capa.org/
#
# lciptables - LONC-CAPA setuid script to:
# o use iptables commands to update Firewall rules for current
# list of IPs for LON-CAPA hosts in server's cluster.
#
use strict;
use lib '/home/httpd/lib/perl/';
use LONCAPA::Firewall;
# ------------------------------------------------------------------ Exit codes
# Exit codes.
# ( (0,"ok"),
# (1,"User ID mismatch. This program must be run as user 'www'"),
# (2,"Missing argument: Usage: this script takes one argument - ".
# " the name of a file in /home/httpd/perl/tmp containing IP addresses."),
# (3,"Missing IP addresses file. The file containing IP addresses is missing."),
# (4,"Error. Only one lciptables script can run at any time."),
#
# ------------------------------------------------------------- Initializations
# Security
$ENV{'PATH'}='/bin/:/usr/bin:/usr/local/sbin:/home/httpd/perl'; # Nullify path
# information
delete @ENV{qw(IFS CDPATH ENV BASH_ENV)}; # nullify potential taints
# Do not print error messages.
my $noprint=1;
print "In lciptables\n" unless $noprint;
# ----------------------------- Make sure this process is running from user=www
my $wwwid=getpwnam('www');
if ($wwwid!=$<) {
print("User ID mismatch. This program must be run as user 'www'\n")
unless $noprint;
&Exit(1);
}
# ----------------------------------- Retrieve IP addreses for hosts in cluster
my %iphost;
if (@ARGV != 1) {
print("Error. this script takes one argument - the name of a file in /home/httpd/perl/tmp containing IP addresses.\n") unless $noprint;
&Exit(2);
}
my $tmpfile = $ARGV[0];
if ($tmpfile =~ m{^\Q/home/httpd/perl/tmp/lciptables_iphost_\E\d+$}) {
if (-e $tmpfile) {
if (open(my $fh,"<$tmpfile")) {
while(<$fh>) {
chomp();
if (/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/) {
if (($1<=255) && ($2<=255) && ($3<=255) && ($4<=255)) {
$iphost{$_} = 1;
}
}
}
close($fh);
} else {
&Exit(3);
}
} else {
print "Error. File containing IP addresses of hosts in cluster does not exist\n" unless $noprint;
&Exit(3);
}
} else {
print "Error. Invalid filename for file containing IP addresses\n" unless $noprint;
&Exit(3);
}
my ($opened,$closed);
my $lond_port = &LONCAPA::Firewall::get_lond_port();
if (($lond_port eq '') || ($lond_port =~ /\D/)) {
print "Error. Invalid lond port\n" unless $noprint;
&Exit(3);
}
my $iptables = &LONCAPA::Firewall::get_pathto_iptables();
if ($iptables eq '') {
print "Error. No path to iptables\n" unless $noprint;
&Exit(3);
}
my ($firewalld) = &LONCAPA::Firewall::uses_firewalld();
&EnableRoot();
my @fw_chains = &LONCAPA::Firewall::get_fw_chains();
if ($firewalld) {
$<=0;
}
$opened =
&LONCAPA::Firewall::firewall_close_port($iptables,\@fw_chains,$lond_port,\%iphost,[$lond_port],$firewalld);
$closed =
&LONCAPA::Firewall::firewall_open_port($iptables,\@fw_chains,$lond_port,\%iphost,[$lond_port],$firewalld);
if ($firewalld) {
$<=$wwwid;
}
&DisableRoot();
# -------------------------------------------------------- Exit script
if ($opened) {
print "$opened\n";
}
if ($closed) {
print "$closed\n";
}
print "lciptables Exiting\n" unless $noprint;
&Exit(0);
sub EnableRoot {
if ($wwwid==$>) {
($<,$>)=($>,$<);
($(,$))=($),$();
}
else {
# root capability is already enabled
}
return $>;
}
sub DisableRoot {
if ($wwwid==$<) {
($<,$>)=($>,$<);
($(,$))=($),$();
}
else {
# root capability is already disabled
}
}
sub Exit {
my ($code) = @_;
&DisableRoot();
print "Exiting with status $code\n" unless $noprint;
exit $code;
}
FreeBSD-CVSweb <freebsd-cvsweb@FreeBSD.org>