aboutsummaryrefslogtreecommitdiffstats
path: root/sysconfig
diff options
context:
space:
mode:
authorBill Nottingham <notting@redhat.com>2001-02-06 22:27:25 +0000
committerBill Nottingham <notting@redhat.com>2001-02-06 22:27:25 +0000
commit32d629933257051980054822fc9a92cc5462cfc6 (patch)
treef660d6e62c5ef0ca44fafb538828d8e9d5f15857 /sysconfig
parent85814c076ce47f2d7ea16c6d41d3ce51be32206a (diff)
downloadinitscripts-32d629933257051980054822fc9a92cc5462cfc6.tar
initscripts-32d629933257051980054822fc9a92cc5462cfc6.tar.gz
initscripts-32d629933257051980054822fc9a92cc5462cfc6.tar.bz2
initscripts-32d629933257051980054822fc9a92cc5462cfc6.tar.xz
initscripts-32d629933257051980054822fc9a92cc5462cfc6.zip
modify the firewall to allow any (new) DNS servers through on ifup
Diffstat (limited to 'sysconfig')
-rwxr-xr-xsysconfig/network-scripts/ifup17
-rwxr-xr-xsysconfig/network-scripts/ifup-post30
2 files changed, 38 insertions, 9 deletions
diff --git a/sysconfig/network-scripts/ifup b/sysconfig/network-scripts/ifup
index e64ba822..b661f5bf 100755
--- a/sysconfig/network-scripts/ifup
+++ b/sysconfig/network-scripts/ifup
@@ -93,6 +93,13 @@ if [ -n "${MACADDR}" ]; then
ifconfig ${DEVICE} hw ether ${MACADDR}
fi
+# Is there a firewall running, and does it look like one we configured?
+FWACTIVE=
+if [ -f /etc/sysconfig/ipchains -a "ipchains -L input -n 2>&1 | awk 'END { print NR }'" -gt 1 ]; then
+ FWACTIVE=1
+ export FWACTIVE
+fi
+
if [ -n "${DYNCONFIG}" ]; then
PUMPARGS=
DHCPCDARGS=
@@ -110,14 +117,24 @@ if [ -n "${DYNCONFIG}" ]; then
fi
echo -n $"Determining IP information for ${DEVICE}..."
+ # DHCP clients need DNS to be available, and we don't know
+ # what DNS server they're using until they are done.
+ FWHACK=
+ if [ -n "$FWACTIVE" -a "$FIREWALL_MODS" != "no" ]; then
+ ipchains -I input -s 0/0 53 -p udp -j ACCEPT
+ FWHACK=1
+ fi
+
if [ -x /sbin/pump ] && /sbin/pump ${PUMPARGS} -i ${DEVICE} ; then
echo $" done."
elif [ -x /sbin/dhcpcd ] && /sbin/dhcpcd ${DHCPCDARGS} ${DEVICE} ; then
echo $" done."
else
echo $" failed."
+ [ -n "$FWHACK" ] && ipchains -D input -s 0/0 53 -p udp -j ACCEPT
exit 1
fi
+ [ -n "$FWHACK" ] && ipchains -D input -s 0/0 53 -p udp -j ACCEPT
else
if [ -z "${IPADDR}" ]; then
# enable device without IP, useful for e.g. PPPoE
diff --git a/sysconfig/network-scripts/ifup-post b/sysconfig/network-scripts/ifup-post
index d99b2111..9ea7ffbe 100755
--- a/sysconfig/network-scripts/ifup-post
+++ b/sysconfig/network-scripts/ifup-post
@@ -21,15 +21,6 @@ fi
/etc/sysconfig/network-scripts/ifup-routes ${DEVICE}
-# don't set hostname on ppp/slip connections
-if [ "$2" = "boot" -a -n "$NEEDHOSTNAME" -a "${DEVICE}" != lo -a "${DEVICETYPE}" != "ppp" -a "${DEVICETYPE}" != "slip" ]; then
- IPADDR=`LANG= LC_ALL= ifconfig ${DEVICE} | grep 'inet addr' |
- awk -F: '{ print $2 } ' | awk '{ print $1 }'`
- eval `/bin/ipcalc --silent --hostname ${IPADDR}`
- if [ "$?" = "0" ]; then
- set_hostname $HOSTNAME
- fi
-fi
if [ "$PEERDNS" != "no" -o -n "$RESOLV_MODS" -a "$RESOLV_MODS" != "no" ]; then
[ -n "$MS_DNS1" ] && DNS1=$MS_DNS1
@@ -89,6 +80,27 @@ if [ "$PEERDNS" != "no" -o -n "$RESOLV_MODS" -a "$RESOLV_MODS" != "no" ]; then
fi
fi
+if [ "$FIREWALL_MODS" != "no" -a -n "$FWACTIVE" ]; then
+ ns=`awk '/^nameserver / { print $2 }' /etc/resolv.conf`
+ if [ -n "$ns" ]; then
+ for nameserver in $ns ; do
+ if ! ipchains -L input -n | grep -q $nameserver ; then
+ ipchains -I input -s $nameserver/32 53 -p udp -j ACCEPT
+ fi
+ done
+ fi
+fi
+
+# don't set hostname on ppp/slip connections
+if [ "$2" = "boot" -a -n "$NEEDHOSTNAME" -a "${DEVICE}" != lo -a "${DEVICETYPE}" != "ppp" -a "${DEVICETYPE}" != "slip" ]; then
+ IPADDR=`LANG= LC_ALL= ifconfig ${DEVICE} | grep 'inet addr' |
+ awk -F: '{ print $2 } ' | awk '{ print $1 }'`
+ eval `/bin/ipcalc --silent --hostname ${IPADDR}`
+ if [ "$?" = "0" ]; then
+ set_hostname $HOSTNAME
+ fi
+fi
+
# Notify programs that have requested notification
do_netreport