1 files changed, 169 insertions, 53 deletions

diff --git a/src/bbfw.in b/src/bbfw.in
index 00c45b9..40fdcb8 100755
--- a/src/bbfw.in
+++ b/src/bbfw.in
@@ -82,6 +82,10 @@ FW_PREFIX=@sysconfdir@/firewall.d/
 FW_CONF=@sysconfdir@/bbfw.conf
 FW_QUIET=no
 FW_VERBOSE=no
+FW_ORDER_PRE="global apps cluster local"
+FW_ORDER_POST="global apps cluster local"
+FW_ORDER_IPSETS="global apps cluster local"
+FW_ORDER_IPTABLES="apps local cluster global"
 
 
 ###########
@@ -218,70 +222,159 @@ load()
 # Function to start the network:
 start() {
    # run pre-hooks
-   run_hook start ${FW_PREFIX}/global.d/pre-hook    "running global pre-hook start ..."
-   for FILE in $( find_appfile pre-hook );do
-      run_hook start ${FILE}                        "running app pre-hook start (App: $(name_appfile ${FILE})) ..."
+   for LEVEL in ${FW_ORDER_PRE};do
+      case "${LEVEL}" in
+         global)
+         run_hook start ${FW_PREFIX}/global.d/pre-hook    "running global pre-hook start ..."
+         ;;
+
+         apps)
+         for FILE in $( find_appfile pre-hook );do
+            run_hook start ${FILE}                        "running app pre-hook start (App: $(name_appfile ${FILE})) ..."
+         done
+         ;;
+
+         cluster)
+         run_hook start ${FW_PREFIX}/cluster.d/pre-hook   "running cluster pre-hook start ..."
+         ;;
+
+         local)
+         run_hook start ${FW_PREFIX}/pre-hook             "running local pre-hook start ..."
+         ;;
+
+         *)
+         echo "Unknown pre-hook order \"${LEVEL}\""
+         ;;
+      esac
    done
-   run_hook start ${FW_PREFIX}/cluster.d/pre-hook   "running cluster pre-hook start ..."
-   run_hook start ${FW_PREFIX}/pre-hook             "running local pre-hook start ..."
 
    # create IP sets
-   load ipset ${FW_PREFIX}/global.d/ipsets          "adding global IP sets"
-   for FILE in $( find_appfile ipsets );do
-      load ipset ${FILE}                            "adding IP sets (App: $(name_appfile ${FILE})) ..."
+   for LEVEL in ${FW_ORDER_IPSETS};do
+      case "${LEVEL}" in
+         global)
+         load ipset ${FW_PREFIX}/global.d/ipsets          "adding global IP sets"
+         ;;
+
+         apps)
+         for FILE in $( find_appfile ipsets );do
+            load ipset ${FILE}                            "adding IP sets (App: $(name_appfile ${FILE})) ..."
+         done
+         ;;
+
+         cluster)
+         load ipset ${FW_PREFIX}/cluster.d/ipsets         "adding cluster IP sets"
+         ;;
+
+         local)
+         load ipset ${FW_PREFIX}/ipsets                   "adding local IP sets"
+         ;;
+
+         *)
+         echo "Unknown ipsets order \"${LEVEL}\""
+         ;;
+      esac
    done
-   load ipset ${FW_PREFIX}/cluster.d/ipsets         "adding cluster IP sets"
-   load ipset ${FW_PREFIX}/ipsets                   "adding local IP sets"
 
-   # Application rules
-   for FILE in $( find_appfile rules4 );do
-      load iptables ${FILE}                         "adding IPv4 rules (App: $(name_appfile ${FILE})) ..."
+   # loads iptables/ip6tables
+   for LEVEL in ${FW_ORDER_IPTABLES};do
+      case "${LEVEL}" in
+         apps)
+         for FILE in $( find_appfile rules4 );do
+            load iptables ${FILE}                         "adding IPv4 rules (App: $(name_appfile ${FILE})) ..."
+         done
+         for FILE in $( find_appfile rules6 );do
+            load ip6tables ${FILE}                        "adding IPv6 rules (App: $(name_appfile ${FILE})) ..."
+         done
+         for FILE in $( find_appfile rules );do
+            load iptables ${FILE}                         "adding IPv4/IPv6 rules (App: $(name_appfile ${FILE})) ..."
+            load ip6tables ${FILE}
+         done
+         ;;
+
+         local)
+         load iptables  ${FW_PREFIX}/rules4               "adding IPv4 local rules"
+         load ip6tables ${FW_PREFIX}/rules6               "adding IPv6 local rules"
+         load iptables  ${FW_PREFIX}/rules                "adding IPv4/IPv6 local rules"
+         load ip6tables ${FW_PREFIX}/rules
+         ;;
+
+         cluster)
+         load iptables  ${FW_PREFIX}/cluster.d/rules4     "adding IPv4 cluster rules"
+         load ip6tables ${FW_PREFIX}/cluster.d/rules6     "adding IPv6 cluster rules"
+         load iptables  ${FW_PREFIX}/cluster.d/rules      "adding IPv4/IPv6 cluster rules"
+         load ip6tables ${FW_PREFIX}/cluster.d/rules
+         ;;
+
+         global)
+         load iptables  ${FW_PREFIX}/global.d/rules4      "adding IPv4 global rules"
+         load ip6tables ${FW_PREFIX}/global.d/rules6      "adding IPv6 global rules"
+         load iptables  ${FW_PREFIX}/global.d/rules       "adding IPv4/IPv6 global rules"
+         load ip6tables ${FW_PREFIX}/global.d/rules
+         ;;
+
+         *)
+         echo "Unknown iptables order \"${LEVEL}\""
+         ;;
+      esac
    done
-   for FILE in $( find_appfile rules6 );do
-      load ip6tables ${FILE}                        "adding IPv6 rules (App: $(name_appfile ${FILE})) ..."
-   done
-   for FILE in $( find_appfile rules );do
-      load iptables ${FILE}                         "adding IPv4/IPv6 rules (App: $(name_appfile ${FILE})) ..."
-      load ip6tables ${FILE}
-   done
-
-   # apply host specific firewall rules
-   load iptables  ${FW_PREFIX}/rules4               "adding IPv4 local rules"
-   load ip6tables ${FW_PREFIX}/rules6               "adding IPv6 local rules"
-   load iptables  ${FW_PREFIX}/rules                "adding IPv4/IPv6 local rules"
-   load ip6tables ${FW_PREFIX}/rules
-
-   # apply cluster specific firewall rules
-   load iptables  ${FW_PREFIX}/cluster.d/rules4     "adding IPv4 cluster rules"
-   load ip6tables ${FW_PREFIX}/cluster.d/rules6     "adding IPv6 cluster rules"
-   load iptables  ${FW_PREFIX}/cluster.d/rules      "adding IPv4/IPv6 cluster rules"
-   load ip6tables ${FW_PREFIX}/cluster.d/rules
-
-   # apply company policy for firewall rules
-   load iptables  ${FW_PREFIX}/global.d/rules4      "adding IPv4 global rules"
-   load ip6tables ${FW_PREFIX}/global.d/rules6      "adding IPv6 global rules"
-   load iptables  ${FW_PREFIX}/global.d/rules       "adding IPv4/IPv6 global rules"
-   load ip6tables ${FW_PREFIX}/global.d/rules
 
    # run post-hooks
-   run_hook start ${FW_PREFIX}/global.d/post-hook   "running global post-hook start ..."
-   for FILE in $( find_appfile post-hook );do
-      run_hook start ${FILE}                        "running app post-hook start (App: $(name_appfile ${FILE})) ..."
+   for LEVEL in ${FW_ORDER_POST};do
+      case "${LEVEL}" in
+         global)
+         run_hook start ${FW_PREFIX}/global.d/post-hook   "running global post-hook start ..."
+         ;;
+
+         apps)
+         for FILE in $( find_appfile post-hook );do
+            run_hook start ${FILE}                        "running app post-hook start (App: $(name_appfile ${FILE})) ..."
+         done
+         ;;
+
+         cluster)
+         run_hook start ${FW_PREFIX}/cluster.d/post-hook  "running cluster post-hook start ..."
+         ;;
+
+         local)
+         run_hook start ${FW_PREFIX}/post-hook            "running local post-hook start ..."
+         ;;
+
+         *)
+         echo "Unknown post-hook order \"${LEVEL}\""
+         ;;
+      esac
    done
-   run_hook start ${FW_PREFIX}/cluster.d/post-hook  "running cluster post-hook start ..."
-   run_hook start ${FW_PREFIX}/post-hook            "running local post-hook start ..."
 }
 
 
 # Function to stop the network:
 stop() {
    # run pre-hooks
-   run_hook stop ${FW_PREFIX}/global.d/pre-hook     "running global pre-hook stop ..."
-   for FILE in $( find_appfile pre-hook );do
-      run_hook stop ${FILE}                         "running app pre-hook stop (App: $(name_appfile ${FILE})) ..."
+   for LEVEL in ${FW_ORDER_PRE};do
+      case "${LEVEL}" in
+         global)
+         run_hook stop ${FW_PREFIX}/global.d/pre-hook     "running global pre-hook stop ..."
+         ;;
+
+         apps)
+         for FILE in $( find_appfile pre-hook );do
+            run_hook stop ${FILE}                         "running app pre-hook stop (App: $(name_appfile ${FILE})) ..."
+         done
+         ;;
+
+         cluster)
+         run_hook stop ${FW_PREFIX}/cluster.d/pre-hook    "running cluster pre-hook stop ..."
+         ;;
+
+         local)
+         run_hook stop ${FW_PREFIX}/pre-hook              "running local pre-hook stop ..."
+         ;;
+
+         *)
+         echo "Unknown pre-hook order \"${LEVEL}\""
+         ;;
+      esac
    done
-   run_hook stop ${FW_PREFIX}/cluster.d/pre-hook    "running cluster pre-hook stop ..."
-   run_hook stop ${FW_PREFIX}/pre-hook              "running local pre-hook stop ..."
 
    # flushes iptables
    for TABLE in $(iptables-save  |grep '^*' |sed -e 's/^*//g' |sort);do
@@ -323,12 +416,31 @@ stop() {
    done
 
    # run post-hooks
-   run_hook stop ${FW_PREFIX}/global.d/post-hook   "running global post-hook stop ..."
-   for FILE in $( find_appfile post-hook );do
-      run_hook stop ${FILE}                        "running app post-hook stop (App: $(name_appfile ${FILE})) ..."
+   for LEVEL in ${FW_ORDER_POST};do
+      case "${LEVEL}" in
+         global)
+         run_hook stop ${FW_PREFIX}/global.d/post-hook   "running global post-hook stop ..."
+         ;;
+
+         apps)
+         for FILE in $( find_appfile post-hook );do
+            run_hook stop ${FILE}                        "running app post-hook stop (App: $(name_appfile ${FILE})) ..."
+         done
+         ;;
+
+         cluster)
+         run_hook stop ${FW_PREFIX}/cluster.d/post-hook  "running cluster post-hook stop ..."
+         ;;
+
+         local)
+         run_hook stop ${FW_PREFIX}/post-hook            "running local post-hook stop ..."
+         ;;
+
+         *)
+         echo "Unknown post-hook order \"${LEVEL}\""
+         ;;
+      esac
    done
-   run_hook stop ${FW_PREFIX}/cluster.d/post-hook  "running cluster post-hook stop ..."
-   run_hook stop ${FW_PREFIX}/post-hook            "running local post-hook stop ..."
 }
 
 
@@ -340,6 +452,10 @@ stop() {
 FW_PREFIX="$(         config_option firewall_dir     "${FW_PREFIX}" )"
 FW_QUIET="$(          config_option quiet            "${FW_QUIET}"          A-Z a-z )"
 FW_VERBOSE="$(        config_option verbose          "${FW_VERBOSE}"        A-Z a-z )"
+FW_ORDER_PRE="$(      config_option order_prehook    "${FW_ORDER_PRE}"      A-Z a-z )"
+FW_ORDER_POST="$(     config_option order_posthook   "${FW_ORDER_POST}"     A-Z a-z )"
+FW_ORDER_IPTABLES="$( config_option order_iptables   "${FW_ORDER_IPTABLES}" A-Z a-z )"
+FW_ORDER_IPSETS="$(   config_option order_ipsets     "${FW_ORDER_IPSETS}"   A-Z a-z )"
 
 
 # checks and normalizes options