Adding initial support for bbfw.conf

3 files changed, 107 insertions, 29 deletions

diff --git a/Makefile.am b/Makefile.am
index 2935dc7..17d604b 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -91,6 +91,7 @@ EXTRA_DIST				= \
                                           doc/slack-desc \
                                           src/bbfw.in \
                                           src/bbfw-log.in \
+                                          src/bbfw.conf-example.in \
                                           src/firewall.d/global.d/rules-example \
                                           src/firewall.d/global.d/rules4-example \
                                           src/firewall.d/global.d/rules6-example \
@@ -107,6 +108,7 @@ CLEANFILES				= \
                                           config.h.in~ $(srcdir)/config.h.in~ \
                                           $(man_MANS) \
                                           $(pkgdata_DATA) \
+                                          $(sysconf_DATA) \
                                           $(bin_SCRIPTS) \
                                           $(sbin_SCRIPTS) \
                                           $(slackrcd_SCRIPTS) \
@@ -126,6 +128,7 @@ DISTCHECK_CONFIGURE_FLAGS		= \
 
 # conditional targets for slackware
 if ENABLE_EXAMPLES
+sysconf_DATA                            = src/bbfw.conf-example
 firewallglobal_DATA                     = src/firewall.d/global.d/rules-example \
                                           src/firewall.d/global.d/rules4-example \
                                           src/firewall.d/global.d/rules6-example \
@@ -160,6 +163,9 @@ include $(srcdir)/@bindletools_srcdir@/build-aux/makefile-version.am
 src/bbfw: Makefile src/bbfw.in
         @$(do_subst_fn)
 
+src/bbfw.conf-example: Makefile src/bbfw.conf-example.in
+        @$(do_subst_dt)
+
 src/bbfw-log: Makefile src/bbfw-log.in
         @$(do_subst_fn)
 
diff --git a/src/bbfw.conf-example.in b/src/bbfw.conf-example.in
new file mode 100644
index 0000000..ec70086
--- /dev/null
+++ b/src/bbfw.conf-example.in
@@ -0,0 +1,37 @@
+#
+#   Bindle Binaries Linux Firewall
+#   Copyright (c) 2019 David M. Syzdek <david@syzdek.net>.
+#
+#   Redistribution and use in source and binary forms, with or without
+#   modification, are permitted provided that the following conditions are
+#   met:
+#
+#      * Redistributions of source code must retain the above copyright
+#        notice, this list of conditions and the following disclaimer.
+#      * Redistributions in binary form must reproduce the above copyright
+#        notice, this list of conditions and the following disclaimer in the
+#        documentation and/or other materials provided with the distribution.
+#      * Neither the name of David M. Syzdek nor the
+#        names of its contributors may be used to endorse or promote products
+#        derived from this software without specific prior written permission.
+#
+#   THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
+#   IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+#   THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+#   PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL DAVID M. SYZDEK BE LIABLE FOR
+#   ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+#   DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+#   SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+#   CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+#   LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+#   OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+#   SUCH DAMAGE.
+
+
+#   The `firewall_dir` option overrides the default directory used to store
+#   firewall rules, ipset files, and pre/post hooks.  Uncomment the line below
+#   to change the default location of the firewall rules.
+# firewall_dir = @sysconfdir@/firewall.d    
+
+
+# end of configuration
diff --git a/src/bbfw.in b/src/bbfw.in
index fbd561b..60ea7b1 100755
--- a/src/bbfw.in
+++ b/src/bbfw.in
@@ -79,6 +79,7 @@ export PATH
 
 # determine prefix of conf files
 FW_PREFIX=@sysconfdir@/firewall.d/
+FW_CONF=@sysconfdir@/bbfw.conf
 
 
 ###########
@@ -113,6 +114,29 @@ clean_file()
 }
 
 
+config_option()
+{
+   if test ! -f "${FW_CONF}";then
+      return 0
+   fi
+   TMP_STR="$(
+      egrep \
+         -i \
+         "^[[:space:]]{0,}${1}[[:space:]]{0,}=" \
+         "${FW_CONF}" \
+         |sed \
+            -e "s/^[[:space:]]\{0,\}${1}[[:space:]]\{0,\}=[[:space:]]\{0,\}//g" \
+            -e "s/[[:space:]]\{0,\}$//g" \
+         |tr "${3:-0}" "${4:-0}"
+   )"
+   if test -z "${TMP_STR}";then
+      echo "${2}"
+   else
+      echo "${TMP_STR}"
+   fi
+}
+
+
 dump()
 {
    ipset list |sed -e "s/^/ipset: /g"
@@ -139,9 +163,9 @@ name_appfile()
 find_appfile()
 {
    find -L \
-      /etc/firewall.d/apps.d/ \
+      ${FW_PREFIX}/apps.d/ \
       -regextype posix-extended \
-      -regex "^/etc/firewall.d/apps.d/[-.a-zA-Z0-9]+[./]${1}$" \
+      -regex "^${FW_PREFIX}/apps.d/[-.a-zA-Z0-9]+[./]${1}$" \
       -type f \
       2> /dev/null
 }
@@ -191,20 +215,20 @@ load()
 # Function to start the network:
 start() {
    # run pre-hooks
-   run_hook start ${FW_PREFIX}global.d/pre-hook     "running global pre-hook start ..."
+   run_hook start ${FW_PREFIX}/global.d/pre-hook    "running global pre-hook start ..."
    for FILE in $( find_appfile pre-hook );do
       run_hook start ${FILE}                        "running app pre-hook start (App: $(name_appfile ${FILE})) ..."
    done
-   run_hook start ${FW_PREFIX}cluster.d/pre-hook    "running cluster pre-hook start ..."
-   run_hook start ${FW_PREFIX}pre-hook              "running local pre-hook start ..."
+   run_hook start ${FW_PREFIX}/cluster.d/pre-hook   "running cluster pre-hook start ..."
+   run_hook start ${FW_PREFIX}/pre-hook             "running local pre-hook start ..."
 
    # create IP sets
-   load ipset ${FW_PREFIX}global.d/ipsets           "adding global IP sets"
+   load ipset ${FW_PREFIX}/global.d/ipsets          "adding global IP sets"
    for FILE in $( find_appfile ipsets );do
       load ipset ${FILE}                            "adding IP sets (App: $(name_appfile ${FILE})) ..."
    done
-   load ipset ${FW_PREFIX}cluster.d/ipsets          "adding cluster IP sets"
-   load ipset ${FW_PREFIX}ipsets                    "adding local IP sets"
+   load ipset ${FW_PREFIX}/cluster.d/ipsets         "adding cluster IP sets"
+   load ipset ${FW_PREFIX}/ipsets                   "adding local IP sets"
 
    # Application rules
    for FILE in $( find_appfile rules4 );do
@@ -219,42 +243,42 @@ start() {
    done
 
    # apply host specific firewall rules
-   load iptables  ${FW_PREFIX}rules4                "adding IPv4 local rules"
-   load ip6tables ${FW_PREFIX}rules6                "adding IPv6 local rules"
-   load iptables  ${FW_PREFIX}rules                 "adding IPv4/IPv6 local rules"
-   load ip6tables ${FW_PREFIX}rules
+   load iptables  ${FW_PREFIX}/rules4               "adding IPv4 local rules"
+   load ip6tables ${FW_PREFIX}/rules6               "adding IPv6 local rules"
+   load iptables  ${FW_PREFIX}/rules                "adding IPv4/IPv6 local rules"
+   load ip6tables ${FW_PREFIX}/rules
 
    # apply cluster specific firewall rules
-   load iptables  ${FW_PREFIX}cluster.d/rules4      "adding IPv4 cluster rules"
-   load ip6tables ${FW_PREFIX}cluster.d/rules6      "adding IPv6 cluster rules"
-   load iptables  ${FW_PREFIX}cluster.d/rules       "adding IPv4/IPv6 cluster rules"
-   load ip6tables ${FW_PREFIX}cluster.d/rules
+   load iptables  ${FW_PREFIX}/cluster.d/rules4     "adding IPv4 cluster rules"
+   load ip6tables ${FW_PREFIX}/cluster.d/rules6     "adding IPv6 cluster rules"
+   load iptables  ${FW_PREFIX}/cluster.d/rules      "adding IPv4/IPv6 cluster rules"
+   load ip6tables ${FW_PREFIX}/cluster.d/rules
 
    # apply company policy for firewall rules
-   load iptables  ${FW_PREFIX}global.d/rules4       "adding IPv4 global rules"
-   load ip6tables ${FW_PREFIX}global.d/rules6       "adding IPv6 global rules"
-   load iptables  ${FW_PREFIX}global.d/rules        "adding IPv4/IPv6 global rules"
-   load ip6tables ${FW_PREFIX}global.d/rules
+   load iptables  ${FW_PREFIX}/global.d/rules4      "adding IPv4 global rules"
+   load ip6tables ${FW_PREFIX}/global.d/rules6      "adding IPv6 global rules"
+   load iptables  ${FW_PREFIX}/global.d/rules       "adding IPv4/IPv6 global rules"
+   load ip6tables ${FW_PREFIX}/global.d/rules
 
    # run post-hooks
-   run_hook start ${FW_PREFIX}global.d/post-hook    "running global post-hook start ..."
+   run_hook start ${FW_PREFIX}/global.d/post-hook   "running global post-hook start ..."
    for FILE in $( find_appfile post-hook );do
       run_hook start ${FILE}                        "running app post-hook start (App: $(name_appfile ${FILE})) ..."
    done
-   run_hook start ${FW_PREFIX}cluster.d/post-hook   "running cluster post-hook start ..."
-   run_hook start ${FW_PREFIX}post-hook             "running local post-hook start ..."
+   run_hook start ${FW_PREFIX}/cluster.d/post-hook  "running cluster post-hook start ..."
+   run_hook start ${FW_PREFIX}/post-hook            "running local post-hook start ..."
 }
 
 
 # Function to stop the network:
 stop() {
    # run pre-hooks
-   run_hook stop ${FW_PREFIX}global.d/pre-hook      "running global pre-hook stop ..."
+   run_hook stop ${FW_PREFIX}/global.d/pre-hook     "running global pre-hook stop ..."
    for FILE in $( find_appfile pre-hook );do
       run_hook stop ${FILE}                         "running app pre-hook stop (App: $(name_appfile ${FILE})) ..."
    done
-   run_hook stop ${FW_PREFIX}cluster.d/pre-hook     "running cluster pre-hook stop ..."
-   run_hook stop ${FW_PREFIX}pre-hook               "running local pre-hook stop ..."
+   run_hook stop ${FW_PREFIX}/cluster.d/pre-hook    "running cluster pre-hook stop ..."
+   run_hook stop ${FW_PREFIX}/pre-hook              "running local pre-hook stop ..."
 
    for TABLE in $(iptables-save  |grep '^*' |sed -e 's/^*//g' |sort);do
       echo "Flushing rules from ${TABLE} table (IPv4)"
@@ -287,12 +311,12 @@ stop() {
    done
 
    # run post-hooks
-   run_hook stop ${FW_PREFIX}global.d/post-hook    "running global post-hook stop ..."
+   run_hook stop ${FW_PREFIX}/global.d/post-hook   "running global post-hook stop ..."
    for FILE in $( find_appfile post-hook );do
       run_hook stop ${FILE}                        "running app post-hook stop (App: $(name_appfile ${FILE})) ..."
    done
-   run_hook stop ${FW_PREFIX}cluster.d/post-hook   "running cluster post-hook stop ..."
-   run_hook stop ${FW_PREFIX}post-hook             "running local post-hook stop ..."
+   run_hook stop ${FW_PREFIX}/cluster.d/post-hook  "running cluster post-hook stop ..."
+   run_hook stop ${FW_PREFIX}/post-hook            "running local post-hook stop ..."
 }
 
 
@@ -300,6 +324,17 @@ stop() {
 ### MAIN ###
 ############
 
+# sets options from configuration file
+FW_PREFIX="$(  config_option firewall_dir "${FW_PREFIX}" )"
+
+
+# checks and normalizes options
+if test ! -d "${FW_PREFIX}";then
+   echo "${PROGRAM_NAME}: ${FW_PREFIX}: firewall directory does not exist" 1>&2
+   exit 1
+fi
+
+
 case "$1" in
    -h|--help)
       echo "Usage: ${PROGRAM_NAME} [ start | stop | restart | dump ]"