3 ### Failsafe prologue for firewall scripts
5 ### (c) 2008 Mark Wooding
8 ###----- Licensing notice ---------------------------------------------------
10 ### This program is free software; you can redistribute it and/or modify
11 ### it under the terms of the GNU General Public License as published by
12 ### the Free Software Foundation; either version 2 of the License, or
13 ### (at your option) any later version.
15 ### This program is distributed in the hope that it will be useful,
16 ### but WITHOUT ANY WARRANTY; without even the implied warranty of
17 ### MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 ### GNU General Public License for more details.
20 ### You should have received a copy of the GNU General Public License
21 ### along with this program; if not, write to the Free Software Foundation,
22 ### Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
25 ###--------------------------------------------------------------------------
26 ### Failsafe prologue.
30 ## Report a firewall script failure and retreat to a safe place.
32 echo "$2! Retreating to safe version..."
33 if ! "$1" revert; then
34 echo >&2 "Safe firewall failed. You're screwed. Good luck."
37 echo >&2 "Phew! Fallback to safe version successful."
48 ## Install the NEW firewall rules. If it fails, revert to the OLD ones.
49 ## Updating firewall rules can fail spectacularly, so be careful. Leave a
50 ## timebomb in the form of NEW.errors: if this isn't removed in 10 seconds
51 ## after the NEW rules complete successfully, then revert. Write errors to
54 ## Make sure we have an escape route.
55 if [ ! -x "$old" ]; then
56 echo >&2 "$0: no escape plan: \`$old' is missing"
60 ## Clear the air and make the errors file.
61 rm -f "$new.errors" "$new.timebomb" "$new.grabbed"
62 exec >"$new.errors" 2>&1
64 ## Now try to install the new firewall.
65 "$new" install || revert "$old" "Failed"
67 ## Set up the time bomb. Leave the errors file there if we failed.
69 if [ -f "$new.errors" ]; then
70 mv "$new.errors" "$new.timebomb"
71 revert "$old" "Time bomb"
77 ## Report successful installation of the script.
79 if mv "$new.errors" "$new.grabbed" 2>/dev/null; then
83 mv "$new.timebomb" "$new.grabbed"
84 echo "Timebomb went off."
87 cat "$new.grabbed" >&2
93 export FWCOOKIE=magical
94 case "$#,${1-update}" in
95 1,start | 1,restart | 1,reload | 1,force-reload)
96 echo -n "Starting up firewall... "
97 "$firewall_script" install || revert "$firewall_failsafe" "Failed"
101 echo -n "Shutting down firewall... "
102 exit_after_clearing=finished
105 echo -n "Running new firewall... "
106 if ! (try "$firewall_script" "$0"); then
112 echo "Can you hear me?"
113 (trap 'exit 127' TERM
115 if [ -f "$0.timebomb" ]; then
117 echo "Timebomb went off!"
127 replace,y* | replace,Y*)
128 install -m755 "$0" "$firewall_script"
129 echo "Cool. Firewall script replaced."
133 echo "Cool. Everything seems good."
137 revert "$firewall_script" "Bogus"
142 try "$firewall_script" "$0"
147 install -m755 "$0" "$firewall_script"
150 1,install | 1,revert)
155 $0 start|stop|reload|restart|force-reload
156 $0 replace|test|remote-prepare|remote-commit
163 ###----- That's all, folks --------------------------------------------------