
#-----------------------------------------------------------------------
# Copyright (C) 2000-2001, Jean-Sebastien Morisset <jsmoriss@mvlan.net>
#-----------------------------------------------------------------------
# $Id: service_rules.sh,v 1.7 2001/08/25 15:40:01 jsmoriss Exp $
#-----------------------------------------------------------------------
#  $RCSfile: service_rules.sh,v $
#   $Author: jsmoriss $
# $Revision: 1.7 $
#     $Date: 2001/08/25 15:40:01 $
#   $Locker:  $ 
#     $Name:  $
#-----------------------------------------------------------------------
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by 
# the Free Software Foundation <http://www.gnu.org/copyleft/gpl.txt>.
# 
# This program is distributed in the hope that it will be useful, but
# WITHOUT ANY WARRANTY; without even the implied warranty of 
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
# General Public License (LICENSE file in archive) for more details.
#
#-----------------------------------------------------------------------
# README
#-----------------------------------------------------------------------
#
# A bourne shell function used by rcf; a very secure, fast, and complete
# firewall for linux <http://jsmoriss.mvlan.net/linux/rcf.html>.
#
#-----------------------------------------------------------------------
# FUNCTION
#-----------------------------------------------------------------------

Service_Rules () {

	INTERFACE_TYPE="$1"
	INTERFACE_MODE="$2"

	# Illegal/malformed addresses must be blocked BEFORE opening
	# services which use any/0 (like http, smtp, etc.).
	#
	# Private networks are denied in a MODULE. This is because
	# some ISPs use private addresses on their network for DHCP
	# services. Private networks are blocked after DHCP client
	# rules are implemented.

	if [ ! "$CLUSTER_NAME" -a "$VIRTUAL" = "no" ]
	then
		Malformed_Address_Rules

		if [ "$INTERFACE_TYPE" = "public" ]
		then
			if [ ! "`Match_Interface DMZ $DEVICE`" ]
			then
				#link in the Stuffed Masquerade Chains
				echo "Reject $INTERFACE -> Stuffed Masquerading (logged)"
				ipchains -A $OUTCHAIN -j smasqo $LOG
			fi

			#link in the Private Network Spoofing Chains
			echo "Deny $INTERFACE <-> Private Network Spoofing (logged)"
			ipchains -A $INCHAIN  -j spoofi $LOG
			ipchains -A $OUTCHAIN -j spoofo $LOG

			if [ "$IANA_RESERVED_NETWORKS" ]
			then
			    echo "Deny $INTERFACE <- IANA Reserved Networks (logged)" 
			    ipchains -A $INCHAIN -j ianai $LOG
			fi

		fi
	fi
	#-------------------------------------------------------------------
	# Service Modules
	#-------------------------------------------------------------------
	
	for MODULE in ${MODULE_DIR}/${INTERFACE_TYPE}/services/[0-9][0-9][0-9]-*
	do
		if [ -f "$MODULE" ]
		then
			MODE="$INTERFACE_MODE"	# may be used in module code
			MODULE_MODE="`sed -n -e 's/^#[mM]#  *\([ 0-9]*\)/\1/p' $MODULE`"
			if [ ! "$MODULE_MODE" -o \( "`echo $MODULE_MODE|grep \"$INTERFACE_MODE\"`" \) ]
			then
				. "$MODULE" "$MODULE"
			fi
			unset MODULE_MODE
		fi
	done

	#--------------------------------------------------------------------
	# Misc. UDP and TCP Ports
	#--------------------------------------------------------------------
	# The "HOSTPORTS" variables have a different structure -- we don't 
	# need a for-loop here for host names.
	#--------------------------------------------------------------------

	Hostports accept local tcp "" `Option_Value accept $INTOPT tcp rhostlports`
	Hostports accept local udp "" `Option_Value accept $INTOPT udp rhostlports`

	unset INTERFACE_TYPE INTERFACE_MODE
}

