blob: 3baffcfb500a21ef3b0f3e444947c836d2b244d8 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
|
log() {
prio="$1"
shift
if [ "$prio" != debug ] || [ "$debug" = 1 ]; then
logger -t "$LOG_TAG" -p "daemon.$prio" -- "$@"
fi
}
NFT_HANDLE=
add_nft_rule() {
local main_domain
local listen_port
main_domain="$1"
listen_port="$2"
[ -n "$listen_port" ] || return
case "$listen_port" in
[0-9]*)
;;
*)
log err "Invalid listen port $listen_port for $main_domain"
return 1
;;
esac
if ! NFT_HANDLE=$(nft -a -e insert rule inet fw4 input tcp dport "$listen_port" counter accept comment \"ACME $main_domain\" | grep -o 'handle [0-9]\+'); then
log err "Failed to add nftables rule for port $listen_port"
return 1
else
log debug "Added nftables rule for port $listen_port with $NFT_HANDLE"
echo "$NFT_HANDLE"
fi
}
del_nft_rule() {
if [ "$NFT_HANDLE" ]; then
# $NFT_HANDLE contains the string 'handle XX' so pass it unquoted to nft
# shellcheck disable=SC2086
if ! nft delete rule inet fw4 input $NFT_HANDLE ; then
log err "Failed to delete nftables rule $NFT_HANDLE"
else
log debug "Deleted nftables rule with $NFT_HANDLE"
fi
NFT_HANDLE=""
fi
}
|
