initscript: check firewall

[hippotat.git] / debian / hippotat.init

diff --git a/debian/hippotat.init b/debian/hippotat.init
index 51495e9ed5086667b56ddd81094b60aa9ed42185..640bd8f26a24a795fccab59c3c048f4557facb83 100644 (file)
--- a/debian/hippotat.init
+++ b/debian/hippotat.init
@@ -15,7 +15,9 @@ MASTER_CONFIG=/etc/hippotat/master.cfg
 USER=Debian-hippotat
 PIDFILE=/var/run/hippotat/hippotatd.pid
 LOGFACILITY=daemon
 USER=Debian-hippotat
 PIDFILE=/var/run/hippotat/hippotatd.pid
 LOGFACILITY=daemon

+CHECK_FIREWALL=true

 # HIPPOTATD_ARGS
 # HIPPOTATD_ARGS

+AS_USER=as_user_userv

 DESCRIPTION='Asinine IP over HTTP server'
 if type -p authbind >/dev/null 2>&1; then AUTHBIND=authbind; fi
 
 DESCRIPTION='Asinine IP over HTTP server'
 if type -p authbind >/dev/null 2>&1; then AUTHBIND=authbind; fi
 


@@ -26,6 +28,13 @@ egrep '^[^   #]' $MASTER_CONFIG >/dev/null 2>&1 || exit 0
 
 . /lib/lsb/init-functions
 
 
 . /lib/lsb/init-functions
 

+as_user_userv () {
+       userv --override '
+               execute-from-path
+               no-suppress-args
+       ' $USER "$@"
+}
+

 ssd () {
        set +e
        start-stop-daemon --start --quiet --user $USER --pidfile=$PIDFILE "$@"
 ssd () {
        set +e
        start-stop-daemon --start --quiet --user $USER --pidfile=$PIDFILE "$@"


@@ -39,7 +48,25 @@ ensure_dirs () {
        chown $USER $pidfiledir
 }
 
        chown $USER $pidfiledir
 }
 

+dump_firewall () {
+       iptables -L -v -n
+}
+
+print_config () {
+       $AS_USER $DAEMON $HIPPOTATD_ARGS --print-config "$1"
+}
+
+check_firewall () {
+       vnetwork=$(print_config vnetwork)
+       if dump_firewall | fgrep " $vnetwork " >/dev/null; then :; else
+               log_failure_msg \
+ "no entry in firewall for insecure vnetwork $vnetwork"
+               exit 1
+       fi
+}
+

 do_start () {
 do_start () {

+       check_firewall

        ensure_dirs
        ssd     --chuid $USER --startas                         \
                $AUTHBIND $DAEMON --daemon --pidfile=$PIDFILE   \
        ensure_dirs
        ssd     --chuid $USER --startas                         \
                $AUTHBIND $DAEMON --daemon --pidfile=$PIDFILE   \