[git.ipfire.org] IPFire 2.x development tree branch, master, updated. 8d2fe8cedd68bfdf648df1baf8b654a846f8c022

[git@ipfire.org]

[-- Attachment #1: Type: text/plain, Size: 4601 bytes --]

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "IPFire 2.x development tree".

The branch, master has been updated
       via  8d2fe8cedd68bfdf648df1baf8b654a846f8c022 (commit)
       via  8490e4961886c6fc44bbfcbaa5073484f235208e (commit)
      from  39e96de566bc4f3a48de9b683de7ffac850bc0a3 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 8d2fe8cedd68bfdf648df1baf8b654a846f8c022
Merge: 8490e49 39e96de
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date:   Fri Apr 18 22:24:24 2014 +0200

    Merge branch 'master' of ssh://git.ipfire.org/pub/git/ipfire-2.x

commit 8490e4961886c6fc44bbfcbaa5073484f235208e
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date:   Thu Apr 17 12:31:27 2014 +0200

    firewall: Explicitely allow DHCP messages.

-----------------------------------------------------------------------

Summary of changes:
 src/initscripts/init.d/dhcp     | 25 +++++++++++++++++++------
 src/initscripts/init.d/firewall | 31 ++++++++++++++++++++++++++-----
 2 files changed, 45 insertions(+), 11 deletions(-)

Difference in files:
diff --git a/src/initscripts/init.d/dhcp b/src/initscripts/init.d/dhcp
index abc6b5c..bc0abce 100644
--- a/src/initscripts/init.d/dhcp
+++ b/src/initscripts/init.d/dhcp
@@ -9,19 +9,30 @@
 . $rc_functions
 eval $(/usr/local/bin/readhash /var/ipfire/ethernet/settings)
 
+function flush_chains() {
+	iptables -F DHCPGREENINPUT
+	iptables -F DHCPGREENOUTPUT
+	iptables -F DHCPBLUEINPUT
+	iptables -F DHCPBLUEOUTPUT
+}
+
 case "$1" in
 	start)
-		iptables -F DHCPBLUEINPUT
+		flush_chains
+
 		if [ -e /var/ipfire/dhcp/enable_green ]; then
 			devices="${GREEN_DEV}"
+
+			iptables -A DHCPGREENINPUT  -i "${GREEN_DEV}" -j DHCPINPUT
+			iptables -A DHCPGREENOUTPUT -o "${GREEN_DEV}" -j DHCPOUTPUT
 		fi
 		if [ -e /var/ipfire/dhcp/enable_blue ]; then
 			devices+=" ${BLUE_DEV}"
-			
-			iptables -A DHCPBLUEINPUT -p tcp --source-port 68 --destination-port 67 -i ${BLUE_DEV} -j ACCEPT > /dev/null 2>&1
-			iptables -A DHCPBLUEINPUT -p udp --source-port 68 --destination-port 67 -i ${BLUE_DEV} -j ACCEPT > /dev/null 2>&1
-		fi		
-		
+
+			iptables -A DHCPBLUEINPUT  -i "${BLUE_DEV}" -j DHCPINPUT
+			iptables -A DHCPBLUEOUTPUT -o "${BLUE_DEV}" -j DHCPOUTPUT
+		fi
+
 		boot_mesg "Starting DHCP Server..."
 		loadproc /usr/sbin/dhcpd -q ${devices}
 		
@@ -29,6 +40,8 @@ case "$1" in
 		;;
 
 	stop)
+		flush_chains
+
 		boot_mesg "Stopping DHCP Server..."
 		killproc -p /var/run/dhcpd.pid /usr/sbin/dhcpd
 		if [ "$(ps -A | grep " dhcpd")" != "" ] ; then
diff --git a/src/initscripts/init.d/firewall b/src/initscripts/init.d/firewall
index f0d9c49..8371781 100644
--- a/src/initscripts/init.d/firewall
+++ b/src/initscripts/init.d/firewall
@@ -143,6 +143,31 @@ iptables_init() {
 		iptables -A ${i} -j CONNTRACK
 	done
 
+	# Allow DHCP
+	iptables -N DHCPINPUT
+	iptables -A DHCPINPUT -p udp --sport 68 --dport 67 -j ACCEPT
+	iptables -A DHCPINPUT -p tcp --sport 68 --dport 67 -j ACCEPT
+
+	iptables -N DHCPOUTPUT
+	iptables -A DHCPOUTPUT -p udp --sport 67 --dport 68 -j ACCEPT
+	iptables -A DHCPOUTPUT -p tcp --sport 67 --dport 68 -j ACCEPT
+
+	# Allow DHCP on GREEN
+	iptables -N DHCPGREENINPUT
+	iptables -N DHCPGREENOUTPUT
+	if [ -n "${GREEN_DEV}" ]; then
+		iptables -A INPUT  -i "${GREEN_DEV}" -j DHCPGREENINPUT
+		iptables -A OUTPUT -o "${GREEN_DEV}" -j DHCPGREENOUTPUT
+	fi
+
+	# allow DHCP on BLUE to be turned on/off
+	iptables -N DHCPBLUEINPUT
+	iptables -N DHCPBLUEOUTPUT
+	if [ -n "${BLUE_DEV}" ]; then
+		iptables -A INPUT  -i "${BLUE_DEV}" -j DHCPBLUEINPUT
+		iptables -A OUTPUT -o "${BLUE_DEV}" -j DHCPBLUEOUTPUT
+	fi
+
 	# trafic from ipsecX/TUN/TAP interfaces, before "-i GREEN_DEV" accept everything
 	iptables -N IPSECINPUT
 	iptables -N IPSECFORWARD
@@ -155,11 +180,7 @@ iptables_init() {
 
 	# localhost and ethernet.
 	iptables -A INPUT   -i $GREEN_DEV  -m conntrack --ctstate NEW -j ACCEPT ! -p icmp
-	
-	# allow DHCP on BLUE to be turned on/off
-	iptables -N DHCPBLUEINPUT 
-	iptables -A INPUT -j DHCPBLUEINPUT
-	
+
 	# WIRELESS chains
 	iptables -N WIRELESSINPUT
 	iptables -A INPUT -m conntrack --ctstate NEW -j WIRELESSINPUT


hooks/post-receive
--
IPFire 2.x development tree