Update vyatta-cfg-firewall package.

6 files changed, 82 insertions, 108 deletions

diff --git a/ChangeLog b/ChangeLog
index e69de29..dac045a 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -0,0 +1,5 @@
+2007-12-10  Bob Gilligan <gilligan@sydney.vyatta.com>
+
+	* Initial setup of vyatta-cfg-firewall package.
+
+/home/gilligan/sydney_work/glendale_bugs/vyatta-cfg-firewall/vyatta-cfg-firewall#master-a6d5039d
diff --git a/Makefile.am b/Makefile.am
index a155f70..d5a6b95 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -8,6 +8,7 @@ share_perl5_DATA =
 
 sbin_SCRIPTS += scripts/firewall/vyatta-firewall.pl
 sbin_SCRIPTS += scripts/firewall/vyatta-show-firewall.pl
+sbin_SCRIPTS += scripts/firewall/firewall.init
 
 share_perl5_DATA += scripts/firewall/VyattaIpTablesAddressFilter.pm
 share_perl5_DATA += scripts/firewall/VyattaIpTablesRule.pm
diff --git a/configure.ac b/configure.ac
index cf40e61..befa0aa 100644
--- a/configure.ac
+++ b/configure.ac
@@ -22,7 +22,8 @@ AC_ARG_ENABLE([nostrip],
 
 AC_CONFIG_FILES(
   [Makefile]
-  [debian/vyatta-cfg-firewall.postinst])
+  [debian/vyatta-cfg-firewall.postinst]
+  [scripts/firewall/firewall.init])
 
 AC_SUBST(NOSTRIP)
 
diff --git a/debian/vyatta-cfg-firewall.postinst.in b/debian/vyatta-cfg-firewall.postinst.in
index 4208536..d0326b3 100644
--- a/debian/vyatta-cfg-firewall.postinst.in
+++ b/debian/vyatta-cfg-firewall.postinst.in
@@ -6,65 +6,4 @@ sysconfdir=@sysconfdir@
 bindir=@bindir@
 sbindir=@sbindir@
 
-# remove init of daemons that we start/stop
-for init in ntp ssh snmpd keepalived ipvsadm; do
-  update-rc.d -f ${init} remove >/dev/null
-done
-
-# create symlinks
-for bb in telnetd telnet tftp ftpget ftpput; do
-  ln -sf /bin/busybox ${sbindir}/${bb}
-done
-ln -sf ${bindir}/progress-indicator /usr/bin/progress-indicator
-
-if [ "$sysconfdir" != "/etc" ]; then
-  # remove the config files and replace with blank ones
-  for conf in motd.tail ntp.conf syslog.conf logrotate.d/messages \
-              default/ssh ssh/ssh_host_key quagga/daemons quagga/zebra.conf \
-              quagga/bgpd.conf quagga/ospfd.conf quagga/ospf6d.conf \
-              quagga/ripd.conf quagga/ripngd.conf quagga/isisd.conf \
-              snmp/snmpd.conf snmp/snmptrapd.conf keepalived/keepalived.conf \
-              ipvsadm.rules default/ipvsadm
-  do
-    [ -f /etc/$conf ] && mv -f /etc/$conf /etc/$conf.vyatta-save
-    touch /etc/$conf
-  done
-
-  # use our config files
-  for conf in motd.tail syslog.conf; do
-    cp $sysconfdir/$conf /etc/$conf
-  done
-  cp $sysconfdir/logrotate_messages /etc/logrotate.d/messages
-  cp $sysconfdir/default_ssh /etc/default/ssh
-
-  # sudoers
-  [ -f /etc/sudoers ] && cp -pf /etc/sudoers /etc/sudoers.vyatta-save
-  if ! grep -q '%quaggavty ALL=NOPASSWD: ALL' /etc/sudoers; then
-    echo -e "\n%quaggavty ALL=NOPASSWD: ALL" >> /etc/sudoers
-  fi
-  echo "Defaults env_keep+=VYATTA_*" >> /etc/sudoers
-
-  # ssh v1. remove the empty key file
-  rm /etc/ssh/ssh_host_key
-
-  # remove unnecessary files
-  rm /etc/logrotate.d/*.vyatta-save >& /dev/null
-
-  # quagga/daemons
-  sed 's/=no/=yes/' /etc/quagga/daemons.vyatta-save > /etc/quagga/daemons
-  echo "log syslog warnings" >> /etc/quagga/zebra.conf
-fi
-
-# update crontab for logrotate
-grep -v logrotate /etc/crontab>/etc/crontab.$$
-echo "*/10 * * * * /usr/sbin/logrotate /etc/logrotate.conf" >> /etc/crontab.$$
-rm /etc/crontab
-mv /etc/crontab.$$ /etc/crontab
-crontab /etc/crontab
-
-# create needed directories
-mkdir -p /etc/raddb
-mkdir -p /var/log/{user,vrrpd}
-
-touch /etc/environment
-
+# Don't do anything for now.
\ No newline at end of file
diff --git a/scripts/firewall/firewall.init b/scripts/firewall/firewall.init
deleted file mode 100755
index b58d4d5..0000000
--- a/scripts/firewall/firewall.init
+++ /dev/null
@@ -1,45 +0,0 @@
-#!/bin/sh
-
-# source the shared functions                                                                                                       
-. /etc/init.d/vyatta-functions 
-
-ACTION=$1
-
-start() {
-	echo -n "Initializing firewall:  "
-	# progress_indicator "start" $INIT_PID
-	
-	OUTPUT=`/opt/vyatta/sbin/vyatta-firewall.pl --setup 2>&1`;
-	# progress_indicator "stop" $INIT_PID
-	
-	echo "OK"
-}
-
-stop() {
-	echo -n "Reseting firewall:  "                                      
-	# progress_indicator "start" $INIT_PID
-	OUTPUT=`/opt/vyatta/sbin/vyatta-firewall.pl --setup 2>&1`;
-	
-	# progress_indicator "stop" $INIT_PID
-	echo "OK"
-}
-
-case "$ACTION" in
-	start)
-		start
-		;;
-	stop)
-		stop
-		;;
-	restart)
-		stop
-		start
-		;;
-	*)
-		echo "usage: $0 {start|stop|restart}"
-		exit 1
-		;;
-esac
-
-exit 0
-
diff --git a/scripts/firewall/firewall.init.in b/scripts/firewall/firewall.init.in
new file mode 100644
index 0000000..8b9ec5d
--- /dev/null
+++ b/scripts/firewall/firewall.init.in
@@ -0,0 +1,73 @@
+#!/bin/bash
+# **** License ****
+# Version: VPL 1.0
+#
+# The contents of this file are subject to the Vyatta Public License
+# Version 1.0 ("License"); you may not use this file except in
+# compliance with the License. You may obtain a copy of the License at
+# http://www.vyatta.com/vpl
+#
+# Software distributed under the License is distributed on an "AS IS"
+# basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
+# the License for the specific language governing rights and limitations
+# under the License.
+#
+# This code was originally developed by Vyatta, Inc.
+# Portions created by Vyatta are Copyright (C) 2007 Vyatta, Inc.
+# All Rights Reserved.
+#
+# Author:	Tom Grennan <tgrennan@vyatta.com>
+# Description:	firewall init 
+#		this is an indirect init sub-script executed by ofr.init
+#
+# **** End License ****
+
+prefix=@prefix@
+exec_prefix=@exec_prefix@
+bindir=@bindir@
+sbindir=@sbindir@
+
+export PATH=/usr/bin:/usr/sbin:/bin:/sbin:$bindir:$sbindir
+
+. /lib/lsb/init-functions
+
+ACTION=$1
+
+declare -a modules=(
+    nf_conntrack
+    nf_conntrack_ftp
+    nf_conntrack_tftp
+    nf_nat
+    nf_nat_ftp
+    nf_nat_tftp
+    nf_nat_proto_gre
+    nf_nat_sip
+    nf_nat_h323
+    nf_nat_pptp)
+
+## setup firewall & nat conntrack modules
+start () {
+    for mod in ${modules[@]} ; do 
+	modprobe --syslog $mod
+    done
+
+    # set up notrack chains/rules
+    # by default, nothing is tracked.
+    iptables -t raw -A PREROUTING -j NOTRACK
+    iptables -t raw -A OUTPUT -j NOTRACK
+}
+
+case "$ACTION" in
+    start) start ;;
+    stop|restart|force-reload) true ;; # nothing to stop/restart
+    *)	log_failure_msg "action unknown: $ACTION" ;
+	false ;;
+esac
+
+exit $?
+
+# Local Variables:
+# mode: shell-script
+# sh-indentation: 4
+# End:
+