aa8b1c8bcbf3d16b678d5d87634b79fcec03bc6f
[project/luci.git] / contrib / package / freifunk-p2pblock / files / freifunk-p2pblock.init
1 #!/bin/sh /etc/rc.common
2
3 START=82
4 ME="freifunk-p2pblock"
5 LOCK='/var/run/p2pblock.lock'
6
7 # helper-scripts
8 ipt_add() {
9 logger -t "$ME" "set 'iptables -I $1'"
10 iptables -I $1
11 echo "iptables -D $1" >> $LOCK
12 }
13
14 start() {
15 /etc/init.d/freifunk-p2pblock enabled || return
16
17 if [ ! -s "$LOCK" ]; then
18 logger -s -t "$ME" 'starting p2pblock...'
19
20 config_load network
21 config_get wan wan ifname
22
23 if [ -n "$wan" ]; then
24 config_load freifunk_p2pblock
25 config_get layer7 p2pblock layer7
26 config_get ipp2p p2pblock ipp2p
27 config_get portrange p2pblock portrange
28 config_get blocktime p2pblock blocktime
29
30 # load modules
31 insmod ipt_ipp2p 2>&-
32 insmod ipt_layer7 2>&-
33 insmod ipt_recent ip_list_tot=400 ip_pkt_list_tot=3 2>&-
34
35 # create new p2p-chain
36 iptables -N p2pblock
37 # pipe all incoming FORWARD with source-/destination-port 1024-65535 throu p2p-chain
38 ipt_add "FORWARD -i $wan -p tcp --sport $portrange --dport $portrange -j p2pblock"
39 ipt_add "FORWARD -i $wan -p udp --sport $portrange --dport $portrange -j p2pblock"
40
41 # if p2p-traffic blocked 3 packages to a destination ip then block all traffic within the next 180 sec (port 1024-65535)
42 ipt_add "p2pblock -m recent --rdest --rcheck --name P2PBLOCK --seconds $blocktime --hitcount 3 -j DROP"
43 ipt_add "p2pblock -m recent --rdest --rcheck --name P2PBLOCK --seconds $blocktime --hitcount 3 -m limit --limit 1/minute -j LOG --log-prefix P2PBLOCK-DROP:"
44
45 # create layer7-rules
46 for proto in $layer7; do
47 ipt_add "p2pblock -m layer7 --l7proto $proto -m recent --rdest --set --name P2PBLOCK"
48 ipt_add "p2pblock -m layer7 --l7proto $proto -m limit --limit 1/minute -j LOG --log-prefix P2PBLOCK-seen-$proto:"
49 done
50
51 # create ipp2p-rules
52 for proto in $ipp2p; do
53 ipt_add "p2pblock -m ipp2p --$proto -m recent --rdest --set --name P2PBLOCK"
54 ipt_add "p2pblock -m ipp2p --$proto -m limit --limit 1/minute -j LOG --log-prefix P2PBLOCK-seen-$proto:"
55 done
56
57 # insert whitelisted ips
58 for ip in $whitelist; do
59 ipt_add "p2pblock -d $ip -j RETURN"
60 done
61
62 logger -s -t "$ME" 'Done.'; return 0
63 else
64 logger -s -t "$ME" 'No wan interface present.'; return 0
65 fi
66 else
67 logger -s -t "$ME" 'WARNING! already running - Aborting!'; return 2
68 fi
69 }
70
71 stop() {
72 if [ -s "$LOCK" ]; then
73 logger -s -t "$ME" 'stopping p2pblock...'
74
75 # unset all rules in $LOCK-file
76 cat $LOCK | sed -ne '1!G;h;$p' | while read line; do
77 logger -t "$ME" "unset $line"
78 while eval $line 2>&-; do :; done
79 done; : > "$LOCK"
80
81 # flush and delete the p2p-chain
82 iptables -F p2pblock
83 iptables -X p2pblock
84 logger -s -t "$ME" 'Done.'; return 0
85
86 else
87 logger -s -t "$ME" 'WARNING! not running - Aborting!'; return 2
88
89 fi
90 }
91
92 restart() {
93 stop; sleep 1; start
94 }