Return to lciptables CVS log

Up to [LON-CAPA] / loncom

- Dynamic management of LON-CAPA port 5663 compatible with firewalld
  - &get_default_zone(() provides default zone
  - Revert changes in rev. 1.17 to &uses_firewalld() -- now returns
    1 if firewalld in use, but not the default zone.
  - Additional arg, value = 1 if firewalld in use  is passed to
    &firewall_open_port(), &firewall_close_port(),
    &firewall_is_port_open(), &firewall_close_anywhere()

#!/usr/bin/perl
#
# The Learning Online Network with CAPA
#
# $Id: lciptables,v 1.9 2019/06/09 02:35:37 raeburn Exp $
#
# Copyright Michigan State University Board of Trustees
#
# This file is part of the LearningOnline Network with CAPA (LON-CAPA).
#
# LON-CAPA is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# LON-CAPA is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with LON-CAPA; if not, write to the Free Software
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
#
# /home/httpd/html/adm/gpl.txt
#
# http://www.lon-capa.org/
#
#  lciptables - LONC-CAPA setuid script to:
#              o use iptables commands to update Firewall rules for current
#                list of IPs for LON-CAPA hosts in server's cluster.
#

use strict;
use lib '/home/httpd/lib/perl/';
use LONCAPA::Firewall;

# ------------------------------------------------------------------ Exit codes
# Exit codes.
# ( (0,"ok"),
# (1,"User ID mismatch.  This program must be run as user 'www'"),
# (2,"Missing argument: Usage: this script takes one argument - ".
# " the name of a file in /home/httpd/perl/tmp containing IP addresses."),
# (3,"Missing IP addresses file. The file containing IP addresses is missing."),
# (4,"Error. Only one lciptables script can run at any time."),
#
# ------------------------------------------------------------- Initializations
# Security
$ENV{'PATH'}='/bin/:/usr/bin:/usr/local/sbin:/home/httpd/perl'; # Nullify path
                                                                # information
delete @ENV{qw(IFS CDPATH ENV BASH_ENV)}; # nullify potential taints

# Do not print error messages.
my $noprint=1;

print "In lciptables\n" unless $noprint;

# ----------------------------- Make sure this process is running from user=www
my $wwwid=getpwnam('www');

if ($wwwid!=$<) {
    print("User ID mismatch.  This program must be run as user 'www'\n")
        unless $noprint;
    &Exit(1);
}

# ----------------------------------- Retrieve IP addreses for hosts in cluster


my %iphost;
if (@ARGV != 1) {
    print("Error. this script takes one argument - the name of a file in /home/httpd/perl/tmp containing IP addresses.\n") unless $noprint;
    &Exit(2);
}
my $tmpfile = $ARGV[0];
if ($tmpfile =~ m{^\Q/home/httpd/perl/tmp/lciptables_iphost_\E\d+$}) {
    if (-e $tmpfile) {
        if (open(my $fh,"<$tmpfile")) {
            while(<$fh>) {
                chomp();
                if (/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/) {
                    if (($1<=255) && ($2<=255) && ($3<=255) && ($4<=255)) {
                        $iphost{$_} = 1;
                    }
                }
            }
            close($fh);
        } else {
            &Exit(3);  
        }
    } else {
        print "Error. File containing IP addresses of hosts in cluster does not exist\n" unless $noprint;
        &Exit(3);
    }
} else {
    print "Error. Invalid filename for file containing IP addresses\n" unless $noprint; 
    &Exit(3);
}

my ($opened,$closed);
my $lond_port = &LONCAPA::Firewall::get_lond_port();
if (($lond_port eq '') || ($lond_port =~ /\D/)) {
    print "Error. Invalid lond port\n" unless $noprint;
    &Exit(3);
}
my $iptables = &LONCAPA::Firewall::get_pathto_iptables();
if ($iptables eq '') {
    print "Error. No path to iptables\n" unless $noprint;
    &Exit(3);
}

my ($firewalld) = &LONCAPA::Firewall::uses_firewalld();

&EnableRoot();
my @fw_chains = &LONCAPA::Firewall::get_fw_chains();
if ($firewalld) {
    $<=0;
}
$opened =
    &LONCAPA::Firewall::firewall_close_port($iptables,\@fw_chains,$lond_port,\%iphost,[$lond_port],$firewalld);
$closed =
    &LONCAPA::Firewall::firewall_open_port($iptables,\@fw_chains,$lond_port,\%iphost,[$lond_port],$firewalld);
if ($firewalld) {
    $<=$wwwid;
}
&DisableRoot();

# -------------------------------------------------------- Exit script
if ($opened) {
    print "$opened\n";
}
if ($closed) {
    print "$closed\n";
}
print "lciptables Exiting\n" unless $noprint;
&Exit(0);

sub EnableRoot {
    if ($wwwid==$>) {
        ($<,$>)=($>,$<);
        ($(,$))=($),$();
    }
    else {
        # root capability is already enabled
    }
    return $>;
}

sub DisableRoot {
    if ($wwwid==$<) {
        ($<,$>)=($>,$<);
        ($(,$))=($),$();
    }
    else {
        # root capability is already disabled
    }
}

sub Exit {
    my ($code) = @_;
    &DisableRoot();
    print "Exiting with status $code\n" unless $noprint;
    exit $code;
}