Adding ability to change order in which files are processed

2 files changed, 216 insertions, 53 deletions

diff --git a/src/bbfw.conf-example.in b/src/bbfw.conf-example.in
index e8a62fa..24a8955 100644
--- a/src/bbfw.conf-example.in
+++ b/src/bbfw.conf-example.in
@@ -45,4 +45,51 @@
 # verbose = yes
 
 
+#   Options which specify order of executions or loading of rules use the
+#   following keywords:
+#
+#   global  - files within %{firewall_dir}/global.d/
+#   apps    - files within %{firewall_dir}/apps.d/%{app}/
+#   cluster - files within %{firewall_dir}/cluster.d/
+#   local   - files within %{firewall_dir}/
+#
+#   Types of files are always processed in the following order:
+#
+#   pre-hooks       (start and stop)
+#   ipsets load     (start only)
+#   iptables load   (start only)
+#   iptables flush  (stop only / not user definable)
+#   ipsets flush    (stop only / not user definable)
+#   post-hooks      (start and stop)
+#
+
+
+#   The `order_prehook` option defines the order in which pre-hooks are
+#   executed.  To modify the order in which pre-hooks are executed, uncomment
+#   the line below and modify the order of the key words.  See above for
+#   keyword descriptions.
+# order_prehook = global apps cluster local
+
+
+#   The `order_posthook` option defines the order in which post-hooks are
+#   executed.  To modify the order in which post-hooks are executed, uncomment
+#   the line below and modify the order of the key words.  See above for
+#   keyword descriptions.
+# order_posthook = global apps cluster local
+
+
+#   The `order_ipsets` option defines the order in which ipsets are
+#   loaded.  To modify the order in which ipsets are loaded, uncomment
+#   the line below and modify the order of the key words.  See above for
+#   keyword descriptions.
+# order_ipsets = global apps cluster local
+
+
+#   The `order_iptables` option defines the order in which iptables
+#   and ip6tables  are loaded.  To modify the order in which rules are loaded,
+#   uncomment the line below and modify the order of the key words.  See above
+#   for keyword descriptions.
+# order_iptables = apps local cluster global
+
+
 # end of configuration
diff --git a/src/bbfw.in b/src/bbfw.in
index 00c45b9..40fdcb8 100755
--- a/src/bbfw.in
+++ b/src/bbfw.in
@@ -82,6 +82,10 @@ FW_PREFIX=@sysconfdir@/firewall.d/
 FW_CONF=@sysconfdir@/bbfw.conf
 FW_QUIET=no
 FW_VERBOSE=no
+FW_ORDER_PRE="global apps cluster local"
+FW_ORDER_POST="global apps cluster local"
+FW_ORDER_IPSETS="global apps cluster local"
+FW_ORDER_IPTABLES="apps local cluster global"
 
 
 ###########
@@ -218,70 +222,159 @@ load()
 # Function to start the network:
 start() {
    # run pre-hooks
-   run_hook start ${FW_PREFIX}/global.d/pre-hook    "running global pre-hook start ..."
-   for FILE in $( find_appfile pre-hook );do
-      run_hook start ${FILE}                        "running app pre-hook start (App: $(name_appfile ${FILE})) ..."
+   for LEVEL in ${FW_ORDER_PRE};do
+      case "${LEVEL}" in
+         global)
+         run_hook start ${FW_PREFIX}/global.d/pre-hook    "running global pre-hook start ..."
+         ;;
+
+         apps)
+         for FILE in $( find_appfile pre-hook );do
+            run_hook start ${FILE}                        "running app pre-hook start (App: $(name_appfile ${FILE})) ..."
+         done
+         ;;
+
+         cluster)
+         run_hook start ${FW_PREFIX}/cluster.d/pre-hook   "running cluster pre-hook start ..."
+         ;;
+
+         local)
+         run_hook start ${FW_PREFIX}/pre-hook             "running local pre-hook start ..."
+         ;;
+
+         *)
+         echo "Unknown pre-hook order \"${LEVEL}\""
+         ;;
+      esac
    done
-   run_hook start ${FW_PREFIX}/cluster.d/pre-hook   "running cluster pre-hook start ..."
-   run_hook start ${FW_PREFIX}/pre-hook             "running local pre-hook start ..."
 
    # create IP sets
-   load ipset ${FW_PREFIX}/global.d/ipsets          "adding global IP sets"
-   for FILE in $( find_appfile ipsets );do
-      load ipset ${FILE}                            "adding IP sets (App: $(name_appfile ${FILE})) ..."
+   for LEVEL in ${FW_ORDER_IPSETS};do
+      case "${LEVEL}" in
+         global)
+         load ipset ${FW_PREFIX}/global.d/ipsets          "adding global IP sets"
+         ;;
+
+         apps)
+         for FILE in $( find_appfile ipsets );do
+            load ipset ${FILE}                            "adding IP sets (App: $(name_appfile ${FILE})) ..."
+         done
+         ;;
+
+         cluster)
+         load ipset ${FW_PREFIX}/cluster.d/ipsets         "adding cluster IP sets"
+         ;;
+
+         local)
+         load ipset ${FW_PREFIX}/ipsets                   "adding local IP sets"
+         ;;
+
+         *)
+         echo "Unknown ipsets order \"${LEVEL}\""
+         ;;
+      esac
    done
-   load ipset ${FW_PREFIX}/cluster.d/ipsets         "adding cluster IP sets"
-   load ipset ${FW_PREFIX}/ipsets                   "adding local IP sets"
 
-   # Application rules
-   for FILE in $( find_appfile rules4 );do
-      load iptables ${FILE}                         "adding IPv4 rules (App: $(name_appfile ${FILE})) ..."
+   # loads iptables/ip6tables
+   for LEVEL in ${FW_ORDER_IPTABLES};do
+      case "${LEVEL}" in
+         apps)
+         for FILE in $( find_appfile rules4 );do
+            load iptables ${FILE}                         "adding IPv4 rules (App: $(name_appfile ${FILE})) ..."
+         done
+         for FILE in $( find_appfile rules6 );do
+            load ip6tables ${FILE}                        "adding IPv6 rules (App: $(name_appfile ${FILE})) ..."
+         done
+         for FILE in $( find_appfile rules );do
+            load iptables ${FILE}                         "adding IPv4/IPv6 rules (App: $(name_appfile ${FILE})) ..."
+            load ip6tables ${FILE}
+         done
+         ;;
+
+         local)
+         load iptables  ${FW_PREFIX}/rules4               "adding IPv4 local rules"
+         load ip6tables ${FW_PREFIX}/rules6               "adding IPv6 local rules"
+         load iptables  ${FW_PREFIX}/rules                "adding IPv4/IPv6 local rules"
+         load ip6tables ${FW_PREFIX}/rules
+         ;;
+
+         cluster)
+         load iptables  ${FW_PREFIX}/cluster.d/rules4     "adding IPv4 cluster rules"
+         load ip6tables ${FW_PREFIX}/cluster.d/rules6     "adding IPv6 cluster rules"
+         load iptables  ${FW_PREFIX}/cluster.d/rules      "adding IPv4/IPv6 cluster rules"
+         load ip6tables ${FW_PREFIX}/cluster.d/rules
+         ;;
+
+         global)
+         load iptables  ${FW_PREFIX}/global.d/rules4      "adding IPv4 global rules"
+         load ip6tables ${FW_PREFIX}/global.d/rules6      "adding IPv6 global rules"
+         load iptables  ${FW_PREFIX}/global.d/rules       "adding IPv4/IPv6 global rules"
+         load ip6tables ${FW_PREFIX}/global.d/rules
+         ;;
+
+         *)
+         echo "Unknown iptables order \"${LEVEL}\""
+         ;;
+      esac
    done
-   for FILE in $( find_appfile rules6 );do
-      load ip6tables ${FILE}                        "adding IPv6 rules (App: $(name_appfile ${FILE})) ..."
-   done
-   for FILE in $( find_appfile rules );do
-      load iptables ${FILE}                         "adding IPv4/IPv6 rules (App: $(name_appfile ${FILE})) ..."
-      load ip6tables ${FILE}
-   done
-
-   # apply host specific firewall rules
-   load iptables  ${FW_PREFIX}/rules4               "adding IPv4 local rules"
-   load ip6tables ${FW_PREFIX}/rules6               "adding IPv6 local rules"
-   load iptables  ${FW_PREFIX}/rules                "adding IPv4/IPv6 local rules"
-   load ip6tables ${FW_PREFIX}/rules
-
-   # apply cluster specific firewall rules
-   load iptables  ${FW_PREFIX}/cluster.d/rules4     "adding IPv4 cluster rules"
-   load ip6tables ${FW_PREFIX}/cluster.d/rules6     "adding IPv6 cluster rules"
-   load iptables  ${FW_PREFIX}/cluster.d/rules      "adding IPv4/IPv6 cluster rules"
-   load ip6tables ${FW_PREFIX}/cluster.d/rules
-
-   # apply company policy for firewall rules
-   load iptables  ${FW_PREFIX}/global.d/rules4      "adding IPv4 global rules"
-   load ip6tables ${FW_PREFIX}/global.d/rules6      "adding IPv6 global rules"
-   load iptables  ${FW_PREFIX}/global.d/rules       "adding IPv4/IPv6 global rules"
-   load ip6tables ${FW_PREFIX}/global.d/rules
 
    # run post-hooks
-   run_hook start ${FW_PREFIX}/global.d/post-hook   "running global post-hook start ..."
-   for FILE in $( find_appfile post-hook );do
-      run_hook start ${FILE}                        "running app post-hook start (App: $(name_appfile ${FILE})) ..."
+   for LEVEL in ${FW_ORDER_POST};do
+      case "${LEVEL}" in
+         global)
+         run_hook start ${FW_PREFIX}/global.d/post-hook   "running global post-hook start ..."
+         ;;
+
+         apps)
+         for FILE in $( find_appfile post-hook );do
+            run_hook start ${FILE}                        "running app post-hook start (App: $(name_appfile ${FILE})) ..."
+         done
+         ;;
+
+         cluster)
+         run_hook start ${FW_PREFIX}/cluster.d/post-hook  "running cluster post-hook start ..."
+         ;;
+
+         local)
+         run_hook start ${FW_PREFIX}/post-hook            "running local post-hook start ..."
+         ;;
+
+         *)
+         echo "Unknown post-hook order \"${LEVEL}\""
+         ;;
+      esac
    done
-   run_hook start ${FW_PREFIX}/cluster.d/post-hook  "running cluster post-hook start ..."
-   run_hook start ${FW_PREFIX}/post-hook            "running local post-hook start ..."
 }
 
 
 # Function to stop the network:
 stop() {
    # run pre-hooks
-   run_hook stop ${FW_PREFIX}/global.d/pre-hook     "running global pre-hook stop ..."
-   for FILE in $( find_appfile pre-hook );do
-      run_hook stop ${FILE}                         "running app pre-hook stop (App: $(name_appfile ${FILE})) ..."
+   for LEVEL in ${FW_ORDER_PRE};do
+      case "${LEVEL}" in
+         global)
+         run_hook stop ${FW_PREFIX}/global.d/pre-hook     "running global pre-hook stop ..."
+         ;;
+
+         apps)
+         for FILE in $( find_appfile pre-hook );do
+            run_hook stop ${FILE}                         "running app pre-hook stop (App: $(name_appfile ${FILE})) ..."
+         done
+         ;;
+
+         cluster)
+         run_hook stop ${FW_PREFIX}/cluster.d/pre-hook    "running cluster pre-hook stop ..."
+         ;;
+
+         local)
+         run_hook stop ${FW_PREFIX}/pre-hook              "running local pre-hook stop ..."
+         ;;
+
+         *)
+         echo "Unknown pre-hook order \"${LEVEL}\""
+         ;;
+      esac
    done
-   run_hook stop ${FW_PREFIX}/cluster.d/pre-hook    "running cluster pre-hook stop ..."
-   run_hook stop ${FW_PREFIX}/pre-hook              "running local pre-hook stop ..."
 
    # flushes iptables
    for TABLE in $(iptables-save  |grep '^*' |sed -e 's/^*//g' |sort);do
@@ -323,12 +416,31 @@ stop() {
    done
 
    # run post-hooks
-   run_hook stop ${FW_PREFIX}/global.d/post-hook   "running global post-hook stop ..."
-   for FILE in $( find_appfile post-hook );do
-      run_hook stop ${FILE}                        "running app post-hook stop (App: $(name_appfile ${FILE})) ..."
+   for LEVEL in ${FW_ORDER_POST};do
+      case "${LEVEL}" in
+         global)
+         run_hook stop ${FW_PREFIX}/global.d/post-hook   "running global post-hook stop ..."
+         ;;
+
+         apps)
+         for FILE in $( find_appfile post-hook );do
+            run_hook stop ${FILE}                        "running app post-hook stop (App: $(name_appfile ${FILE})) ..."
+         done
+         ;;
+
+         cluster)
+         run_hook stop ${FW_PREFIX}/cluster.d/post-hook  "running cluster post-hook stop ..."
+         ;;
+
+         local)
+         run_hook stop ${FW_PREFIX}/post-hook            "running local post-hook stop ..."
+         ;;
+
+         *)
+         echo "Unknown post-hook order \"${LEVEL}\""
+         ;;
+      esac
    done
-   run_hook stop ${FW_PREFIX}/cluster.d/post-hook  "running cluster post-hook stop ..."
-   run_hook stop ${FW_PREFIX}/post-hook            "running local post-hook stop ..."
 }
 
 
@@ -340,6 +452,10 @@ stop() {
 FW_PREFIX="$(         config_option firewall_dir     "${FW_PREFIX}" )"
 FW_QUIET="$(          config_option quiet            "${FW_QUIET}"          A-Z a-z )"
 FW_VERBOSE="$(        config_option verbose          "${FW_VERBOSE}"        A-Z a-z )"
+FW_ORDER_PRE="$(      config_option order_prehook    "${FW_ORDER_PRE}"      A-Z a-z )"
+FW_ORDER_POST="$(     config_option order_posthook   "${FW_ORDER_POST}"     A-Z a-z )"
+FW_ORDER_IPTABLES="$( config_option order_iptables   "${FW_ORDER_IPTABLES}" A-Z a-z )"
+FW_ORDER_IPSETS="$(   config_option order_ipsets     "${FW_ORDER_IPSETS}"   A-Z a-z )"
 
 
 # checks and normalizes options