--- /dev/null
+# ----------------------------------------------------------------------------
+# GIPTables Firewall v1.1 http://www.giptables.org
+# Copyright (C) 2002 Adrian Pascalau <apascalau@openna.com>
+# NTP module
+#
+# ----------------------------------------------------------------------------
+# This file is part of GIPTables Firewall
+#
+# GIPTables Firewall is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+
+# ----------------------------------------------------------------------------
+# About NTP
+
+# ntp 123/udp # Network Time Protocol
+
+NTP_PORT="123"
+
+# ----------------------------------------------------------------------------
+# accept_ntp_request
+# Usage: accept_ntp_request chain ntp_client_ipaddr ntp_server_ipaddr
+#
+
+accept_ntp_request ()
+{
+ local chain=$1
+ local ntp_client_ipaddr=$2
+ local ntp_server_ipaddr=$3
+
+ $IPTABLES -A $chain -p udp \
+ -s $ntp_client_ipaddr --sport $NTP_PORT \
+ -d $ntp_server_ipaddr --dport $NTP_PORT \
+ -m state --state NEW,ESTABLISHED \
+ -j ACCEPT
+
+ $IPTABLES -A $chain -p udp \
+ -s $ntp_client_ipaddr --sport $UNPRIV_PORTS \
+ -d $ntp_server_ipaddr --dport $NTP_PORT \
+ -m state --state NEW,ESTABLISHED \
+ -j ACCEPT
+ return 0
+}
+
+# ----------------------------------------------------------------------------
+# accept_ntp_reply
+# Usage: accept_ntp_reply chain ntp_server_ipaddr ntp_client_ipaddr
+#
+
+accept_ntp_reply ()
+{
+ local chain=$1
+ local ntp_server_ipaddr=$2
+ local ntp_client_ipaddr=$3
+
+ $IPTABLES -A $chain -p udp \
+ -s $ntp_server_ipaddr --sport $NTP_PORT \
+ -d $ntp_client_ipaddr --dport $NTP_PORT \
+ -m state --state ESTABLISHED \
+ -j ACCEPT
+
+ $IPTABLES -A $chain -p udp \
+ -s $ntp_server_ipaddr --sport $NTP_PORT \
+ -d $ntp_client_ipaddr --dport $UNPRIV_PORTS \
+ -m state --state ESTABLISHED \
+ -j ACCEPT
+
+ return 0
+}
+
+# ----------------------------------------------------------------------------
+# snat_ntp_request
+# Usage: snat_ntp_request interface if_ipaddr ntp_client_ipaddr ntp_server_ipaddr
+#
+
+snat_ntp_request ()
+{
+ local interface=$1
+ local if_ipaddr=$2
+ local ntp_client_ipaddr=$3
+ local ntp_server_ipaddr=$4
+
+ $IPTABLES -t nat -A POSTROUTING -o $interface -p udp \
+ -s $ntp_client_ipaddr --sport $NTP_PORT \
+ -d $ntp_server_ipaddr --dport $NTP_PORT \
+ -j SNAT --to $if_ipaddr
+
+ $IPTABLES -t nat -A POSTROUTING -o $interface -p udp \
+ -s $ntp_client_ipaddr --sport $UNPRIV_PORTS \
+ -d $ntp_server_ipaddr --dport $NTP_PORT \
+ -j SNAT --to $if_ipaddr
+ return 0
+}
+
+# ----------------------------------------------------------------------------
+# dnat_ntp_request
+# Usage: dnat_ntp_request interface if_ipaddr ntp_client_ipaddr ntp_server_ipaddr
+#
+
+dnat_ntp_request ()
+{
+ local interface=$1
+ local if_ipaddr=$2
+ local ntp_client_ipaddr=$3
+ local ntp_server_ipaddr=$4
+
+ $IPTABLES -t nat -A PREROUTING -i $interface -p udp \
+ -s $ntp_client_ipaddr --sport $NTP_PORT \
+ -d $if_ipaddr --dport $NTP_PORT \
+ -j DNAT --to $ntp_server_ipaddr
+
+ $IPTABLES -t nat -A PREROUTING -i $interface -p udp \
+ -s $ntp_client_ipaddr --sport $UNPRIV_PORTS \
+ -d $if_ipaddr --dport $NTP_PORT \
+ -j DNAT --to $ntp_server_ipaddr
+ return 0
+}
+
+# ----------------------------------------------------------------------------
+# NTP outgoing client request
+#
+
+[ "$DEBUG" = "on" ] && echo -e "# NTP outgoing client request"
+
+# Interface 0 NTP outgoing client request
+
+[ "$INTERFACE0_NTP_CLIENT" == "yes" ] && \
+[ "$DEBUG" = "on" ] && echo -e "# Interface 0 NTP outgoing client request"
+
+[ "$INTERFACE0_NTP_CLIENT" == "yes" ] && \
+for (( index = 0; index < "${#INTERFACE0_NTP_OUT_DST_IPADDR[@]}"; index++ ))
+do
+
+ accept_ntp_request interface0_out ${INTERFACE0_NTP_OUT_SRC_IPADDR[$index]} ${INTERFACE0_NTP_OUT_DST_IPADDR[$index]}
+ accept_ntp_reply interface0_in ${INTERFACE0_NTP_OUT_DST_IPADDR[$index]} ${INTERFACE0_NTP_OUT_SRC_IPADDR[$index]}
+
+done
+
+# Interface 1 NTP outgoing client request
+
+[ -n "$INTERFACE1" ] && [ "$INTERFACE1_NTP_CLIENT" == "yes" ] && \
+[ "$DEBUG" = "on" ] && echo -e "# Interface 1 NTP outgoing client request"
+
+[ -n "$INTERFACE1" ] && [ "$INTERFACE1_NTP_CLIENT" == "yes" ] && \
+for (( index = 0; index < "${#INTERFACE1_NTP_OUT_DST_IPADDR[@]}"; index++ ))
+do
+
+ accept_ntp_request interface1_out ${INTERFACE1_NTP_OUT_SRC_IPADDR[$index]} ${INTERFACE1_NTP_OUT_DST_IPADDR[$index]}
+ accept_ntp_reply interface1_in ${INTERFACE1_NTP_OUT_DST_IPADDR[$index]} ${INTERFACE1_NTP_OUT_SRC_IPADDR[$index]}
+
+done
+
+# Network 1 NTP forwarded outgoing client request
+
+[ -n "$INTERFACE1" ] && [ "$NETWORK1_NTP_CLIENT" == "yes" ] && \
+[ "$DEBUG" = "on" ] && echo -e "# Network 1 NTP forwarded outgoing client request"
+
+[ -n "$INTERFACE1" ] && [ "$NETWORK1_NTP_CLIENT" == "yes" ] && \
+for (( index = 0; index < "${#NETWORK1_NTP_OUT_DST_IPADDR[@]}"; index++ ))
+do
+
+ [ "$NETWORK1_NAT" == "yes" ] && \
+ snat_ntp_request $INTERFACE0 $INTERFACE0_IPADDR ${NETWORK1_NTP_OUT_SRC_IPADDR[$index]} ${NETWORK1_NTP_OUT_DST_IPADDR[$index]}
+ accept_ntp_request network1_out ${NETWORK1_NTP_OUT_SRC_IPADDR[$index]} ${NETWORK1_NTP_OUT_DST_IPADDR[$index]}
+ accept_ntp_reply network1_in ${NETWORK1_NTP_OUT_DST_IPADDR[$index]} ${NETWORK1_NTP_OUT_SRC_IPADDR[$index]}
+
+done
+
+# ----------------------------------------------------------------------------
+# NTP incoming client request
+#
+
+[ "$DEBUG" = "on" ] && echo -e "# NTP incoming client request"
+
+# Interface 0 NTP incoming client request
+
+[ "$INTERFACE0_NTP_SERVER" == "yes" ] && \
+[ "$DEBUG" = "on" ] && echo -e "# Interface 0 NTP incoming client request"
+
+[ "$INTERFACE0_NTP_SERVER" == "yes" ] && \
+for (( index = 0; index < "${#INTERFACE0_NTP_IN_SRC_IPADDR[@]}"; index++ ))
+do
+
+ accept_ntp_request interface0_in ${INTERFACE0_NTP_IN_SRC_IPADDR[$index]} ${INTERFACE0_NTP_IN_DST_IPADDR[$index]}
+ accept_ntp_reply interface0_out ${INTERFACE0_NTP_IN_DST_IPADDR[$index]} ${INTERFACE0_NTP_IN_SRC_IPADDR[$index]}
+
+done
+
+# Interface 1 NTP incoming client request
+
+[ -n "$INTERFACE1" ] && [ "$INTERFACE1_NTP_SERVER" == "yes" ] && \
+[ "$DEBUG" = "on" ] && echo -e "# Interface 1 NTP incoming client request"
+
+[ -n "$INTERFACE1" ] && [ "$INTERFACE1_NTP_SERVER" == "yes" ] && \
+for (( index = 0; index < "${#INTERFACE1_NTP_IN_SRC_IPADDR[@]}"; index++ ))
+do
+
+ accept_ntp_request interface1_in ${INTERFACE1_NTP_IN_SRC_IPADDR[$index]} ${INTERFACE1_NTP_IN_DST_IPADDR[$index]}
+ accept_ntp_reply interface1_out ${INTERFACE1_NTP_IN_DST_IPADDR[$index]} ${INTERFACE1_NTP_IN_SRC_IPADDR[$index]}
+
+done
+
+# Network 1 NTP forwarded incoming client request
+
+[ -n "$INTERFACE1" ] && [ "$NETWORK1_NTP_SERVER" == "yes" ] && \
+[ "$DEBUG" = "on" ] && echo -e "# Network 1 NTP forwarded incoming client request"
+
+[ -n "$INTERFACE1" ] && [ "$NETWORK1_NTP_SERVER" == "yes" ] && \
+for (( index = 0; index < "${#NETWORK1_NTP_IN_SRC_IPADDR[@]}"; index++ ))
+do
+
+ [ "$NETWORK1_NAT" == "yes" ] && \
+ dnat_ntp_request $INTERFACE0 $INTERFACE0_IPADDR ${NETWORK1_NTP_IN_SRC_IPADDR[$index]} ${NETWORK1_NTP_IN_DST_IPADDR[$index]}
+ accept_ntp_request network1_in ${NETWORK1_NTP_IN_SRC_IPADDR[$index]} ${NETWORK1_NTP_IN_DST_IPADDR[$index]}
+ accept_ntp_reply network1_out ${NETWORK1_NTP_IN_DST_IPADDR[$index]} ${NETWORK1_NTP_IN_SRC_IPADDR[$index]}
+
+done
+
+# ----------------------------------------------------------------------------
+# End of file
--- /dev/null
+# Copyright 1999-2005 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/net-firewall/giptables/giptables-1.1-r1.ebuild,v 1.1 2005/01/16 08:37:01 dragonheart Exp $
+
+DESCRIPTION="set of shell scripts that help generate iptables rules"
+HOMEPAGE="http://www.giptables.org/"
+SRC_URI="http://www.giptables.org/downloads/${P}.tar.gz"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~x86 ~ppc"
+IUSE=""
+
+DEPEND=""
+RDEPEND="net-firewall/iptables"
+
+src_install() {
+ dodir /etc/{conf.d,init.d}
+
+ # Creating GIPTables home, modules and conf directories
+ dodir /lib/giptables /lib/giptables/modules /lib/giptables/conf
+ chmod -R 700 ${D}/lib/giptables
+
+ # Copying GIPTables main library file /lib/giptables/giptables-main
+ cp -f ${S}/giptables-main ${D}/lib/giptables
+
+ # Copying GIPTables module files /lib/giptables/modules/*
+ cp -f ${S}/modules/* ${D}/lib/giptables/modules
+ # Copying fixed GIPTables NTP module file to /lib/giptables/modules/
+ cp -f ${FILESDIR}/giptables-NTP ${D}/lib/giptables/modules
+ chmod 600 ${D}/lib/giptables/modules/*
+
+ # Copying GIPTables example configuration files /lib/giptables/conf/*
+ cp -f ${S}/conf/* ${D}/lib/giptables/conf
+ chmod 600 ${D}/lib/giptables/conf/*
+
+ # Copying other GIPTables files
+ cp ${S}/if_ipaddr ${D}/lib/giptables
+ chmod 700 ${D}/lib/giptables/if_ipaddr
+
+ cp ${S}/rc.giptables.blocked ${D}/etc/conf.d/giptables.blocked
+ cp ${S}/rc.giptables.custom ${D}/etc/conf.d/giptables.custom
+ chmod 600 ${D}/etc/conf.d/giptables.blocked ${D}/etc/conf.d/giptables.custom
+
+ # Creating docs
+ dodoc AUTHORS COPYING ChangeLog* INSTALL README TODO
+ dodir /usr/share/doc/${PF}/html
+ mv ${S}/documentation/* ${D}/usr/share/doc/${PF}/html
+
+ # Creating init script
+ exeinto /etc/init.d
+ newexe ${FILESDIR}/giptables.init giptables
+}
+
+pkg_preinst() {
+ for conf_file in ${D}/lib/giptables/conf/*
+ do
+ sed -e 's/rc\.d\/rc\.giptables\.custom/conf\.d\/giptables\.custom/g' -e 's/rc\.d\/rc\.giptables\.blocked/conf\.d\/giptables\.blocked/g' $conf_file > $conf_file.orig
+ mv --force $conf_file.orig $conf_file
+ done
+}
+
+pkg_postinst() {
+ einfo
+ einfo "Before running /etc/init.d/giptables or adding it to a runlevel with"
+ einfo "rc-update, be sure to create a config file /etc/giptables.conf"
+ einfo
+ einfo "For sample config files, please, look at /lib/giptables/conf"
+ einfo
+}
projects / gentoo.git / commitdiff