FreenetIS

echo $LOG_PREFIX"Downloading data...";

PATH_ALLOWED=`mktemp`

PATH_SELF_CANCEL=`mktemp`

PATH_RANGES=`mktemp`

for URL in $SET_URL_ALLOWED;

do

echo $LOG_PREFIX"Downloaded list of allowed IP addresses from: $URL"

wget -qO- $URL --no-check-certificate >> "$PATH_ALLOWED"

done

for URL in $SET_URL_SELF_CANCEL;

do

echo $LOG_PREFIX"Downloaded list of self-cancel IP addresses from: $URL"

wget -qO- $URL --no-check-certificate >> "$PATH_SELF_CANCEL"

done

for URL in $SET_URL_RANGES;

do

echo $LOG_PREFIX"Downloaded list of ranges from: $URL"

wget -qO- $URL --no-check-certificate >> "$PATH_RANGES"

done

#! /bin/bash

### BEGIN INIT INFO

# Provides: freenetis-redirection

# Required-Start: $remote_fs

# Required-Stop: $remote_fs

# Should-Start: $network $syslog

# Should-Stop: $network $syslog

# Default-Start: 2 3 4 5

# Default-Stop: 0 1 6

# Short-Description: Start and stop freenetis synchronization daemon

# Description: FreenetIS synchronization script.

### END INIT INFO

################################################################################

# #

# This script serves for redirection ip policy and QoS of IS FreenetIS #

# #

# Author Sevcik Roman 2011 #

# Email sevcik.roman@slfree.net #

# #

# Name freenetis-redirection.init.sh #

# Version 1.9.2 #

# #

################################################################################

#Local variable contains path to iptables - mandatory

IPTABLES=/sbin/iptables

#Load variables from config file

CONFIG=/etc/freenetis/freenetis-redirection.conf

# Path to redirection synchronization file

REDIRECTION_SYNCFILE=/usr/sbin/freenetis-redirection-sync

# Path to HTTP 302 redirector

REDIRECTION_HTTP_REDIRECTOR=/usr/sbin/freenetis-http-302-redirection.py

#Path to redirection pid file

REDIRECTION_PIDFILE=/var/run/freenetis-redirection.pid

# Path to HTTP 302 redirector

REDIRECTION_HTTP_REDIRECTOR_PIDFILE=/var/run/freenetis-http-302-redirection.pid

#Load variables

if [ -f ${CONFIG} ]; then

. $CONFIG;

else

echo "Config file is missing at path $CONFIG."

echo "Terminating..."

exit 0

fi

start_redirection ()

{

if [ -f ${REDIRECTION_PIDFILE} ] && [ -f ${REDIRECTION_HTTP_REDIRECTOR_PIDFILE} ]; then

echo "Already started"

return 0

fi

if [ ! -f ${REDIRECTION_PIDFILE} ]; then

cat /dev/null > "$LOG_FILE"

echo -n "Starting FreenetIS redirection sync daemon: "

ipset -N allowed iphash --hashsize 10000 --probes 8 --resize 50

ipset -N self_cancel iphash --hashsize 10000 --probes 8 --resize 50

ipset -N ranges nethash --hashsize 1024 --probes 4 --resize 50

#Rule for allowing access. If come packet to $IP_TARGET then we add source address do set allowed and to set seen

#Set seen is used for ip synchronization with FreenetIS.

$IPTABLES -i $INPUT_INTERFACE -t nat -A PREROUTING -m set --match-set self_cancel src -d $IP_TARGET -p tcp --dport $PORT_SELF_CANCEL -j SET --add-set allowed src

#If IP is allowed then it is not redirected

$IPTABLES -i $INPUT_INTERFACE -t nat -A PREROUTING -m set --match-set allowed src -j ACCEPT

#Redirect everything trafic what has destination port $PORT_WEB to $PORT_REDIRECT

$IPTABLES -i $INPUT_INTERFACE -t nat -A PREROUTING -m set --match-set ranges src -p tcp --dport $PORT_WEB -j REDIRECT --to-port $PORT_REDIRECT

#If IP is allowed then it is not redirected

$IPTABLES -i $INPUT_INTERFACE -I FORWARD 1 -m set --match-set allowed src -j ACCEPT

#Else everything drop

$IPTABLES -i $INPUT_INTERFACE -I FORWARD 2 -m set --match-set ranges src -j DROP

#Run update script on background

nohup $REDIRECTION_SYNCFILE >> "$LOG_FILE" 2>&1 &

#Parse PID a save to file

ps aux | grep $REDIRECTION_SYNCFILE | grep -v grep | awk '{print $2}' > $REDIRECTION_PIDFILE

# test if daemon is started

if [ `ps aux | grep $REDIRECTION_SYNCFILE | grep -v grep | wc -l` -gt 0 ]; then

echo "OK"

else

echo "FAILED!"

fi

else

echo "Starting FreenetIS redirection sync daemon: Already started"

fi

if [ ! -f ${REDIRECTION_HTTP_REDIRECTOR_PIDFILE} ]; then

cat /dev/null > "$LOG_FILE_REDIRECTOR"

echo -n "Starting FreenetIS redirection HTTP deamon: "

#Run update script on background

nohup $REDIRECTION_HTTP_REDIRECTOR "$PORT_REDIRECT" "$PATH_FN" > "$LOG_FILE_REDIRECTOR" 2>&1 &

#Parse PID a save to file

ps aux | grep $REDIRECTION_HTTP_REDIRECTOR | grep -v grep | awk '{print $2}' > $REDIRECTION_HTTP_REDIRECTOR_PIDFILE

# test if daemon is started

if [ `ps aux | grep $REDIRECTION_HTTP_REDIRECTOR | grep -v grep | wc -l` -gt 0 ]; then

echo "OK"

else

echo "FAILED!"

fi

else

echo "Starting FreenetIS redirection HTTP deamon: Already started"

fi

return 0

}

stop_redirection ()

{

if [ ! -f ${REDIRECTION_PIDFILE} ] && [ ! -f ${REDIRECTION_HTTP_REDIRECTOR_PIDFILE} ]; then

echo "Already stopped."

return 0

fi

if [ -f ${REDIRECTION_PIDFILE} ]; then

#Killing of process by sigterm

echo -n "Stopping FreenetIS redirection deamon: "

kill -9 `cat $REDIRECTION_PIDFILE`

rm -f $REDIRECTION_PIDFILE

#Rule for allowing access. If come packet to $IP_TARGET then we add souce address do set allowed and to set seen

#Set seen is used for ip synchronization with FreenetIS.

$IPTABLES -i $INPUT_INTERFACE -t nat -D PREROUTING -m set --match-set self_cancel src -d $IP_TARGET -p tcp --dport $PORT_SELF_CANCEL -j SET --add-set allowed src

#If IP is allowed then it is not redirected

$IPTABLES -i $INPUT_INTERFACE -t nat -D PREROUTING -m set --match-set allowed src -j ACCEPT

#Redirect everything traffic what has destination port $PORT_WEB to $PORT_REDIRECT

$IPTABLES -i $INPUT_INTERFACE -t nat -D PREROUTING -m set --match-set ranges src -p tcp --dport $PORT_WEB -j REDIRECT --to-port $PORT_REDIRECT

#If IP is allowed then it is not redirected

$IPTABLES -i $INPUT_INTERFACE -D FORWARD -m set --match-set allowed src -j ACCEPT

#Else everything drop

$IPTABLES -i $INPUT_INTERFACE -D FORWARD -m set --match-set ranges src -j DROP

ipset -X allowed

ipset -X self_cancel

ipset -X ranges

# test if daemon is stopped

if [ `ps aux | grep $REDIRECTION_SYNCFILE | grep -v grep | wc -l` -eq 0 ]; then

echo "OK"

else

echo "FAILED!";

fi

else

echo "Stopping FreenetIS redirection deamon: Already stopped"

fi

if [ -f ${REDIRECTION_HTTP_REDIRECTOR_PIDFILE} ]; then

#Killing of process by sigterm

echo -n "Stopping FreenetIS redirection HTTP deamon: "

kill `cat $REDIRECTION_HTTP_REDIRECTOR_PIDFILE`

rm -f $REDIRECTION_HTTP_REDIRECTOR_PIDFILE

# test if daemon is stopped

if [ `ps aux | grep $REDIRECTION_HTTP_REDIRECTOR | grep -v grep | wc -l` -eq 0 ]; then

echo "OK"

else

echo "FAILED!";

fi

fi

return 0

}

status_redirection ()

{

if [ -f ${REDIRECTION_PIDFILE} ]; then

echo "FreenetIS redirection is running with PID `cat $REDIRECTION_PIDFILE`"

else

echo "FreenetIS redirection is not running"

fi

if [ -f ${REDIRECTION_HTTP_REDIRECTOR_PIDFILE} ]; then

echo "FreenetIS redirection HTTP is running with PID `cat $REDIRECTION_HTTP_REDIRECTOR_PIDFILE`"

else

echo "FreenetIS redirection HTTP is not running"

fi

return 0

}

usage_redirection ()

{

echo "usage : `echo $0` (start|stop|restart|status|help)"

}

help_redirection ()

{

echo " start - initialization of firewall rules and settings for redirection"

echo " stop - clears firewall rules and settings for redirection"

echo " restart - restarts firewall rules and settings for redirection"

echo " status - returns actual status of redirection"

echo " help - prints help for redirection"

}

# Is parameter #1 zero length?

if [ -z "$1" ]; then

usage_redirection

exit 0

fi;

case "$1" in

start)

start_redirection

exit 0

;;

restart)

stop_redirection

start_redirection

exit 0

;;

stop)

stop_redirection

exit 0

;;

status)

status_redirection

exit 0

;;

help)

usage_redirection

help_redirection

exit 0

;;

*)

usage_redirection

exit 0

;;

esac

exit 0