firewall_containers/firewall/firewall-add

#!/bin/sh

# Debugging function
debug() {
        if [ $DEBUG -eq 1 ]; then
                echo "DEBUG: "$1 $2 $3
        fi; 
}

# Task type variables
ROUTE=$ROUTE
HOST=$HOST
PREROUTING=$PREROUTING
POSTROUTING=$POSTROUTING

# Mandatory task variables
CHAIN=$CHAIN
NAME=$NAME
COMMENT=$COMMENT
NAME=$NAME-$COMMENT
PROTOCOL=$TYPE

EXTRA_OPTIONS="$2 $3 $4"
      
      # turn on debug mode by extra option "debug"
      if [[ "$(echo "$EXTRA_OPTIONS" | grep debug)" != "" ]] ; then
              DEBUG=1
      fi;


if [[ -z "$TYPE" ]]; then
	TYPE="tcp"
fi;

if [[ -z "$SOURCE_IP" ]]; then
	SOURCE_IP="0.0.0.0/0";

elif [[ "$(echo $SOURCE_IP | cut -d . -f4)" == "0" ]] ; then
	SOURCE_IP="$SOURCE_IP/24";
	debug "source ip is $SOURCE_IP"

# Modifying source or target IP addresses if POSTROUTING rules needed to applied
fi;

if [[ -z "$TARGET_IP" ]]; then
	TARGET_IP="0.0.0.0/0";

elif [[ "$(echo $TARGET_IP | cut -d . -f4)" == "0" ]] ; then
	TARGET_IP="$TARGET_IP/24";
	debug "target ip is $TARGET_IP"
fi;


prerouting() {
	LINES=$($IPTABLES -L --line-number -n | grep PREROUTING | grep $SOURCE_PORT |grep $TARGET_IP |grep $TARGET_PORT |grep $COMMENT | awk '{print $1}'| tac)
	debug "Previous prerouting lines: "$LINES
	# DELETE UNECESSARY LINES FROM PREVIOUS RULES
	if [ -n "$LINES" ] ; then
		for i in $LINES; do 
			debug "$IPTABLES -D PREROUTING $i"
			$IPTABLES -D PREROUTING $i
			sleep 0.1
		done
	fi

	debug "$IPTABLES -I PREROUTING -d $SOURCE_IP -p $PROTOCOL --dport $SOURCE_PORT -m comment --comment "$COMMENT" -j DNAT --to $TARGET_IP:$TARGET_PORT"
	$IPTABLES -I PREROUTING -d $SOURCE_IP -p $PROTOCOL --dport $SOURCE_PORT -m comment --comment "$COMMENT" -j DNAT --to $TARGET_IP:$TARGET_PORT
}

postrouting() {

	
	if [[ ! -z "$SOURCE_IP" ]]; then
	SOURCE_IP_FOR_POSTROUTING="$(echo $SOURCE_IP | cut -d . -f1-3).0/24";
	debug "source ip is $SOURCE_IP_FOR_POSTROUTING"
	fi
	
	if [[ ! -z "$TARGET_IP" ]]; then
	TARGET_IP_FOR_POSTROUTING="$(echo $TARGET_IP | cut -d . -f1-3).0/24";
	debug "target ip is $TARGET_IP_FOR_POSTROUTING"
	fi
	
	if  [ -n "$SOURCE_IP" ] ; then
		LINES=$($IPTABLES -L --line-number -n | grep POSTROUTING | grep $COMMENT | grep $SOURCE_IP_FOR_POSTROUTING | grep $SOURCE_PORT | awk '{print $1}'| tac)
		debug "Previous postrouting lines: "$LINES

		# DELETE UNECESSARY LINES FROM PREVIOUS RULES
		if [ -n "$LINES" ] ; then
			for i in $LINES; do 
				debug "$IPTABLES -D POSTROUTING $i"
				$IPTABLES -D POSTROUTING $i
				sleep 0.1
			done
		fi
	
	debug "$IPTABLES -I POSTROUTING -s $SOURCE_IP_FOR_POSTROUTING -p $PROTOCOL --dport $SOURCE_PORT -m comment --comment "$COMMENT" -j MASQUERADE"	
	$IPTABLES -I POSTROUTING -d $SOURCE_IP_FOR_POSTROUTING -p $PROTOCOL --dport $SOURCE_PORT -m comment --comment "$COMMENT" -j MASQUERADE	

	fi 

	if  [ -n "$TARGET_IP" ] ; then
		LINES=$($IPTABLES -L --line-number -n | grep $COMMENT | grep $TARGET_IP_FOR_POSTROUTING | grep $TARGET_PORT | awk '{print $1}'| tac)
		debug "Previous postrouting lines: "$LINES

		# DELETE UNECESSARY LINES FROM PREVIOUS RULES
		if [ -n "$LINES" ] ; then
			for i in $LINES; do 
				debug "$IPTABLES -D POSTROUTING $i"
				$IPTABLES -D POSTROUTING $i
				sleep 0.1
			done
		fi
	debug "$IPTABLES -I POSTROUTING -s $TARGET_IP_FOR_POSTROUTING -p $PROTOCOL --dport $TARGET_PORT -m comment --comment "$COMMENT" -j MASQUERADE"	
	$IPTABLES -I POSTROUTING -d $TARGET_IP_FOR_POSTROUTING -p $PROTOCOL --dport $TARGET_PORT -m comment --comment "$COMMENT" -j MASQUERADE	
	fi
}

ip_route() {

	COUNT_NETWORK=$(set |grep NETWORK |wc -l)
	
	for network_index in $(seq 1 $COUNT_NETWORK) ; do
		if set |grep NETWORK_ ; then
			NETWORK=$(eval "echo \${"NETWORK_$network_index"}")
			GATEWAY=$(eval "echo \${"GATEWAY_$network_index"}")
		fi
		debug "ip route add "$NETWORK"/24 via "$GATEWAY
		$IP_ROUTE add $NETWORK/24 via $GATEWAY
	done
}

if [[ "$ROUTE" == "true" ]] ; then
	IP_ROUTE="nsenter -t $(docker inspect --format {{.State.Pid}} $NAME) -n -- ip route";

	debug "ip_route: "$IP_ROUTE;
	ip_route;
	exit;
fi

##############################

echo 1 > /proc/sys/net/ipv4/ip_forward

##############################

IPTABLES=/sbin/iptables-legacy

###############################

COUNT_SOURCE_IP=$(set |grep SOURCE_IP |wc -l)
COUNT_SOURCE_PORT=$(set |grep SOURCE_PORT |wc -l)
COUNT_TARGET_IP=$(set |grep TARGET_IP |wc -l)
COUNT_TARGET_PORT=$(set |grep TARGET_PORT |wc -l)

if [ "$COUNT_SOURCE_IP" == 0 ] ; then COUNT_SOURCE_IP=1 ; fi
for source_ip_index in $(seq 1 $COUNT_SOURCE_IP) ; do
	if set |grep SOURCE_IP_ ; then
		SOURCE_IP=$(eval "echo \${"SOURCE_IP_$source_ip_index"}")
	fi
	
	if [ "$COUNT_SOURCE_PORT" == 0 ] ; then COUNT_SOURCE_PORT=1 ; fi
	for source_port_index in $(seq 1 $COUNT_SOURCE_PORT) ; do
		if set |grep SOURCE_PORT_ ; then
			SOURCE_PORT=$(eval "echo \${"SOURCE_PORT_$source_port_index"}")
		fi
	
		if [ "$COUNT_TARGET_IP" == 0 ] ; then COUNT_TARGET_IP=1 ; fi
		for target_ip_index in $(seq 1 $COUNT_TARGET_IP) ; do
			if set |grep TARGET_IP_ ; then
				TARGET_IP=$(eval "echo \${"TARGET_IP_$target_ip_index"}")                 
			fi                                                                               
	
			if [ "$COUNT_TARGET_PORT" == 0 ] ; then COUNT_TARGET_PORT=1 ; fi
			for target_port_index in $(seq 1 $COUNT_TARGET_PORT) ; do
				if set |grep TARGET_PORT_ ; then
					TARGET_PORT=$(eval "echo \${"TARGET_PORT_$target_port_index"}")
				fi

#############################
# NSENTER Specific settings #

if [[ "$PREROUTING" == "true" ]] || [[ "$POSTROUTING" == "true" ]] || [[ "$HOST" == "true" ]] ; then
	
	if [ "$HOST" == "true" ] ; then
		IPTABLES="/sbin/iptables -t nat";
	else
		IPTABLES="nsenter -t $(docker inspect --format {{.State.Pid}} $NAME) -n -- $IPTABLES -t nat";
	
		debug "iptables: "$IPTABLES;
	
		if [[ "$PREROUTING" == "true" ]] ; then
		prerouting;
		fi

		if [[ "$POSTROUTING" == "true" ]] ; then
			postrouting;
		fi	
	fi;

else 

############################
# Host firewall settings ###

	if $IPTABLES --list $CHAIN |grep ESTABLISHED |grep RELATED|grep ACCEPT ; then 
		echo "nothing to do";
	else
		$IPTABLES -I $CHAIN -m state --state established,related -j ACCEPT;
	fi

	# 
	# DELETE UNECESSARY LINES FROM PREVIOUS RULES
	LINES=$($IPTABLES --line-number -n --list $CHAIN | grep $SOURCE_IP |grep $TARGET_IP |grep $PROTOCOL |grep $TARGET_PORT | awk '{print $1}'| tac)

	if [ -n "$LINES" ] ; then
		for i in $LINES; do 
			debug "$IPTABLES -D $CHAIN $i"
			$IPTABLES -D $CHAIN $i
			sleep 0.1
		done
	fi

	debug "$IPTABLES -I $CHAIN -p $PROTOCOL -s $SOURCE_IP --sport $SOURCE_PORT -d $TARGET_IP --dport $TARGET_PORT -m comment --comment "$COMMENT" -j ACCEPT"
	$IPTABLES -I $CHAIN -p $PROTOCOL -s $SOURCE_IP -d $TARGET_IP --dport $TARGET_PORT -m comment --comment "$COMMENT" -j ACCEPT

	#############################
fi

			done # target_port
		done # target_ip
	done # source_port
done # source_ip