summaryrefslogtreecommitdiff
path: root/pkg/linux/bitmask-root
diff options
context:
space:
mode:
Diffstat (limited to 'pkg/linux/bitmask-root')
-rwxr-xr-xpkg/linux/bitmask-root41
1 files changed, 31 insertions, 10 deletions
diff --git a/pkg/linux/bitmask-root b/pkg/linux/bitmask-root
index d1bf656e..1929b51b 100755
--- a/pkg/linux/bitmask-root
+++ b/pkg/linux/bitmask-root
@@ -51,6 +51,7 @@ cmdcheck = subprocess.check_output
## CONSTANTS
##
+VERSION = "1"
SCRIPT = "bitmask-root"
NAMESERVER = "10.42.0.1"
BITMASK_CHAIN = "bitmask"
@@ -764,11 +765,13 @@ def firewall_start(args):
"--jump", "ACCEPT")
# allow multicast Simple Service Discovery Protocol
ip4tables("--append", BITMASK_CHAIN,
- "--protocol", "udp", "--destination", "239.255.255.250", "--dport", "1900",
+ "--protocol", "udp",
+ "--destination", "239.255.255.250", "--dport", "1900",
"-o", default_device, "--jump", "RETURN")
# allow multicast Bonjour/mDNS
ip4tables("--append", BITMASK_CHAIN,
- "--protocol", "udp", "--destination", "224.0.0.251", "--dport", "5353",
+ "--protocol", "udp",
+ "--destination", "224.0.0.251", "--dport", "5353",
"-o", default_device, "--jump", "RETURN")
if local_network_ipv6:
ip6tables("--append", BITMASK_CHAIN,
@@ -776,11 +779,13 @@ def firewall_start(args):
"--jump", "ACCEPT")
# allow multicast Simple Service Discovery Protocol
ip6tables("--append", BITMASK_CHAIN,
- "--protocol", "udp", "--destination", "FF05::C", "--dport", "1900",
+ "--protocol", "udp",
+ "--destination", "FF05::C", "--dport", "1900",
"-o", default_device, "--jump", "RETURN")
# allow multicast Bonjour/mDNS
ip6tables("--append", BITMASK_CHAIN,
- "--protocol", "udp", "--destination", "FF02::FB", "--dport", "5353",
+ "--protocol", "udp",
+ "--destination", "FF02::FB", "--dport", "5353",
"-o", default_device, "--jump", "RETURN")
# allow ipv4 traffic to gateways
@@ -791,15 +796,19 @@ def firewall_start(args):
# log rejected packets to syslog
if DEBUG:
iptables("--append", BITMASK_CHAIN, "-o", default_device,
- "--jump", "LOG", "--log-prefix", "iptables denied: ", "--log-level", "7")
+ "--jump", "LOG", "--log-prefix", "iptables denied: ",
+ "--log-level", "7")
- # for now, ensure all other ipv6 packets get rejected (regardless of device)
+ # for now, ensure all other ipv6 packets get rejected (regardless of
+ # device)
# (not sure why, but "-p any" doesn't work)
ip6tables("--append", BITMASK_CHAIN, "-p", "tcp", "--jump", "REJECT")
ip6tables("--append", BITMASK_CHAIN, "-p", "udp", "--jump", "REJECT")
# reject all other ipv4 sent over the default device
- ip4tables("--append", BITMASK_CHAIN, "-o", default_device, "--jump", "REJECT")
+ ip4tables("--append", BITMASK_CHAIN, "-o",
+ default_device, "--jump", "REJECT")
+
def firewall_stop():
"""
@@ -819,7 +828,12 @@ def firewall_stop():
def main():
- if len(sys.argv) >= 3:
+ """
+ Entry point for cmdline execution.
+ """
+ # TODO use argparse instead.
+
+ if len(sys.argv) >= 2:
command = "_".join(sys.argv[1:3])
args = sys.argv[3:]
@@ -828,6 +842,13 @@ def main():
is_restart = True
args.remove('restart')
+ if command == "version":
+ print(VERSION)
+ exit(0)
+
+ if os.getuid() != 0:
+ bail("ERROR: must be run as root")
+
if command == "openvpn_start":
openvpn_start(args)
@@ -840,8 +861,8 @@ def main():
nameserver_setter.start(NAMESERVER)
except Exception as ex:
if not is_restart:
- nameserver_restorer.start()
- firewall_stop()
+ nameserver_restorer.start()
+ firewall_stop()
bail("ERROR: could not start firewall", ex)
elif command == "firewall_stop":