GitHub/pbot
3
0
Fork 0
mirror of https://github.com/pragma-/pbot.git synced 2024-11-05 19:49:32 +01:00
Code Issues Projects Releases Wiki Activity

pbot-vm: consolidate network enable/disable into one script

Browse Source
This commit is contained in:
Pragmatic Software 2024-04-12 13:07:27 -07:00
parent cc1445be90
commit 111f3bd2e7
No known key found for this signature in database
GPG Key ID: CC916B6E3C84ECCE
9 changed files with 79 additions and 33 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
applets/pbot-vm/guest/bin/disable-network-iptables
View File

@ -1,9 +0,0 @@
#!/bin/sh
# disables all incoming, outgoing and forwarded traffic except incoming/established SSH
iptables -F
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -P OUTPUT DROP

8
applets/pbot-vm/guest/bin/disable-network-nftables
View File

@ -1,8 +0,0 @@
#!/bin/sh
# disables all incoming, outgoing and forwarded traffic except incoming/established SSH
nft add table ip filter
nft add chain ip filter INPUT '{ type filter hook input priority 0; policy drop; }'
nft add chain ip filter OUTPUT '{ type filter hook output priority 0; policy drop; }'
nft 'add rule ip filter INPUT ct state related,established counter accept'
nft 'add rule ip filter INPUT tcp dport 22 counter accept'
nft 'add rule ip filter OUTPUT ct state related,established counter accept'

3
applets/pbot-vm/guest/bin/enable-network-iptables
View File

@ -1,3 +0,0 @@
#!/bin/sh
# removes all iptables rules to re-enable networking
iptables -F

3
applets/pbot-vm/guest/bin/enable-network-nftables
View File

@ -1,3 +0,0 @@
#!/bin/sh
# deletes filter table to re-enable networking
nft delete table ip filter

70
applets/pbot-vm/guest/bin/network Executable file
View File

@ -0,0 +1,70 @@
#!/bin/bash
Usage="$0 <on|off> [iptables|ipt|nftables|nft]"
DefaultMode="iptables"
EnableNetwork() {
case $1 in
iptables)
iptables -F ;;
nftables)
nft delete table ip filter ;;
esac
}
DisableNetwork() {
case $1 in
iptables)
iptables -F
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -P OUTPUT DROP
;;
nftables)
nft add table ip filter
nft add chain ip filter INPUT '{ type filter hook input priority 0; policy drop; }'
nft add chain ip filter OUTPUT '{ type filter hook output priority 0; policy drop; }'
nft add rule ip filter INPUT ct state related,established counter accept
nft add rule ip filter INPUT tcp dport 22 counter accept
nft add rule ip filter OUTPUT ct state related,established counter accept
;;
esac
}
Main() {
case $1 in
on|off) ;;
*)
echo "Invalid command \`$1\`; usage: $Usage"
exit 1 ;;
esac
Toggle="$1"
case $2 in
iptables|ipt)
Mode="iptables" ;;
nftables|nft)
Mode="nftables" ;;
"")
Mode=$DefaultMode ;;
*)
echo "Invalid mode \`$2\`; usage: $Usage"
exit 1 ;;
esac
case $Toggle in
"on")
echo "Enabling networking with $Mode"
EnableNetwork "$Mode" ;;
"off")
echo "Disabling networking with $Mode"
DisableNetwork "$Mode" ;;
esac
}
Main "$@"

6
applets/pbot-vm/guest/provision/debian-trixie
View File

@ -25,8 +25,8 @@ apt install -y --no-install-recommends default-jre default-jdk
apt install -y --no-install-recommends libipc-run-perl libjson-xs-perl
# disable networking
./guest/bin/disable-network-iptables
./guest/bin/network off iptables
echo 'Networking disabled.'
echo 'To re-enable, run ./guest/bin/enable-networking-iptables'
echo 'To disable again, run ./guest/bin/disable-network-iptables'
echo 'To re-enable, run ./guest/bin/network on iptables'
echo 'To disable again, run ./guest/bin/network off iptables'

6
applets/pbot-vm/guest/provision/tumbleweed
View File

@ -22,8 +22,8 @@ zypper -n in --no-recommends clisp gcc-go java java-devel
zypper -n in perl-IPC-Run perl-JSON-XS
# disable networking
./guest/bin/disable-network-nftables
./guest/bin/network off nftables
echo 'Networking disabled.'
echo 'To re-enable, run ./guest/bin/enable-networking-nftables'
echo 'To disable again, run ./guest/bin/disable-network-nftables'
echo 'To re-enable, run ./guest/bin/network on nftables'
echo 'To disable again, run ./guest/bin/network off nftables'

3
applets/pbot-vm/host/bin/vm-exec
View File

@ -299,8 +299,7 @@ sub main() {
exit 2;
}
print $health "\n";
print $health "\n"; # request health
eval {
alarm 2;

4
lib/PBot/VERSION.pm
View File

@ -25,8 +25,8 @@ use PBot::Imports;
# These are set by the /misc/update_version script
use constant {
BUILD_NAME => "PBot",
BUILD_REVISION => 4747,
BUILD_DATE => "2024-04-10",
BUILD_REVISION => 4748,
BUILD_DATE => "2024-04-12",
};
sub initialize {}