View difference between Paste ID: VGy4gmRB and gjLUDVEQ

 #!/bin/sh
-#   Written by Simon Richter <[email protected]>
+#    Written by Simon Richter <[email protected]>
-#   Modified by Jonathan Wiltshire <[email protected]>
+#    Modified by Jonathan Wiltshire <[email protected]>
-#       with help from Christoph Anton Mitterer
+#        with help from Christoph Anton Mitterer
-#   Modified by Konstantin Demin <[email protected]>
+#    Modified by Konstantin Demin <[email protected]>
-#       with God willing
+#        with God willing
 
 ### BEGIN INIT INFO
 # Provides:          iptables-persistent
 # Required-Start:    mountkernfs $local_fs
 # Required-Stop:     $local_fs
 # Default-Start:     2 3 4 5
 # Default-Stop:      0 1 6
 # X-Start-Before:    $network
 # X-Stop-After:      $network
 # Short-Description: Set up iptables rules
 # Description:       Loads/saves current iptables rules from/to /etc/iptables
 #                    to provide a persistent rule set during boot time
 ### END INIT INFO
 
 export PATH=/sbin:/bin
 
 . /lib/lsb/init-functions
 
 RULES=/etc/iptables/rules
 RULES_set=${RULES}.ipset
 RULES_v4=${RULES}.ipv4
 RULES_v6=${RULES}.ipv6
 
 
 binary_exist() {
-    # todo: partial re-implement /bin/which
+    IFS_BAK=${IFS} IFS=':' notfound=1
 
     # if PATH ends with ':' then search in current directory too (IFS hack)
     case "${PATH}" in
     *[!:]:) PATH="${PATH}:" ;;
     esac
 
     case "$1" in
     */*)
         binary_exist_h "$1" && notfound=0
     ;;
     *)
         for location in ${PATH}; do
             test -z "${location}" && location=.
             binary_exist_h "${location}/$1" && notfound=0 && break
         done
     ;;
     esac
     IFS=${IFS_BAK}
     return ${notfound}
 }
 binary_exist_h() { test -f "$1" && test -x "$1"; }
 
 # keep in sync with test_avail()
 init_avail() {
     for subsys in ipset ipv4 ipv6; do
         case "${subsys}" in
         ipset)
-            K)    for i in ${dirs}; do test -d $i || err=1; done
+
             files=
             binaries='ipset '
-            U)    for i in ${binaries}; do binary_exist $i || err=1; done
+
         ipv4)
             dirs=
             files='/proc/net/ip_tables_names '
             binaries='iptables iptables-restore iptables-save '
         ;;
         ipv6)
             dirs=
             files='/proc/net/ip6_tables_names '
             binaries='ip6tables ip6tables-restore ip6tables-save '
         ;;
         *) continue ;; # this may not happen at all.
         esac
 
         for flavour in K U; do
             err=0
             case "${flavour}" in
             K)  for i in ${dirs}; do test -d $i || err=1; done
                 for i in ${files}; do test -e $i || err=1; done
             ;;
             U)  for i in ${binaries}; do binary_exist $i || err=1; done
             ;;
             *) continue ;; # this may not happen at all.
             esac
 
             eval "avail_${subsys}_${flavour}() { return ${err};}"
         done
     done
 
     return 0
 }
 
 test_avail() {
     subsys=$1 flavour=
     case "$2" in
     kernel) flavour=K ;; # kernel-space
     *)      flavour=U ;; # user-space
     esac
 
     case "${subsys}" in
     ipset) ;;
     ipv4) ;;
     ipv6) ;;
     *) return 2 ;;
     esac
 
     eval "avail_${subsys}_${flavour}"
 }
 
 m_ok=' [ok]'
 m_skip=' [skip]'
 m_err=' {ERROR}'
 
 
 load_rules() {
     log_action_begin_msg "Loading iptables rules"
 
     subsystems='ipset ipv4 ipv6'
     test $# -ne 0 && subsystems=$@
 
     for i in ${subsystems}; do
         title= cmd= file=
         case "$i" in
         ipset)  title=IPset  cmd=load_rules_ipset  file=${RULES_set} ;;
         ipv4)   title=IPv4   cmd=load_rules_ipv4   file=${RULES_v4}  ;;
         ipv6)   title=IPv6   cmd=load_rules_ipv6   file=${RULES_v6}  ;;
         *)
             # todo: notify user if subsystem isn't recognized or supported
             continue
         ;;
         esac
 
         test_avail $i user || continue
 
         log_action_cont_msg " ${title}"
 
         if test -f ${file}; then
             ${cmd} < ${file} 2> /dev/null
 
             if test $? -ne 0
             then log_action_cont_msg "${m_err}"
 #           else log_action_cont_msg "${m_ok}"
             fi
         else
             log_action_cont_msg "${m_skip}"
         fi
     done
 
     log_action_end_msg 0
     return 0
 }
 load_rules_ipset() {
     ipset restore
 }
 load_rules_ipv4() {
     iptables-restore
 }
 load_rules_ipv6() {
     ip6tables-restore
 }
 
 save_rules() {
     log_action_begin_msg "Saving rules"
 
     subsystems='ipset ipv4 ipv6'
     test $# -ne 0 && subsystems=$@
 
     for i in ${subsystems}; do
         title= cmd= file=
         case "$i" in
         ipset)  title=IPset  cmd=save_rules_ipset  file=${RULES_set} ;;
         ipv4)   title=IPv4   cmd=save_rules_ipv4   file=${RULES_v4}  ;;
         ipv6)   title=IPv6   cmd=save_rules_ipv6   file=${RULES_v6}  ;;
         *)
             # todo: notify user if subsystem isn't recognized or supported
             continue
         ;;
         esac
 
         test_avail $i user || continue
 
         log_action_cont_msg " ${title}"
 
         if test -f ${file}; then
             ${cmd} > ${file} 2> /dev/null
 
             if test $? -ne 0
             then log_action_cont_msg "${m_err}"
 #           else log_action_cont_msg "${m_ok}"
             fi
         else
             log_action_cont_msg "${m_skip}"
         fi
     done
 
     log_action_end_msg 0
     return 0
 }
 save_rules_ipset() {
     ipset save
 }
 save_rules_ipv4() {
     iptables-save
 }
 save_rules_ipv6() {
     ip6tables-save
 }
 
 flush_rules() {
     log_action_begin_msg "Flushing rules"
 
     # reversed order IS correct
     subsystems='ipv6 ipv4 ipset'
     test $# -ne 0 && subsystems=$@
 
     for i; do
         case "$i" in
         ipset)  title=IPSet  cmd=flush_rules_ipset ;;
         ipv4)   title=IPv4   cmd=flush_rules_ipv4  ;;
         ipv6)   title=IPv6   cmd=flush_rules_ipv6  ;;
         *)
             # todo: notify user if subsystem isn't recognized or supported
             continue
         ;;
         esac
 
         test_avail $i || continue
 
         log_action_cont_msg " ${title}"
 
         if test_avail $i kernel; then
             ${cmd}
 
             if test $? -ne 0
             then log_action_cont_msg "${m_err}"
 #           else log_action_cont_msg "${m_ok}"
             fi
         else
             log_action_cont_msg "${m_skip}"
         fi
     done
 
     log_action_end_msg 0
     return 0
 }
 flush_rules_ipset() {
     ipset flush
     ipset destroy
 }
 flush_rules_ipv4() {
     for chain in INPUT FORWARD OUTPUT; do
         iptables -P ${chain} ACCEPT
     done
     for table in $(cat /proc/net/ip_tables_names); do
         iptables -t ${table} -F
         iptables -t ${table} -X
         iptables -t ${table} -Z
     done
 }
 flush_rules_ipv6() {
     for chain in INPUT FORWARD OUTPUT; do
         ip6tables -P ${chain} ACCEPT
     done
     for table in $(cat /proc/net/ip6_tables_names); do
         ip6tables -t ${table} -F
         ip6tables -t ${table} -X
         ip6tables -t ${table} -Z
     done
 }
 
 
 act=$1; shift
 case "${act}" in
 start|reload)
     init_avail
     load_rules "$@"
 ;;
 save)
     init_avail
     save_rules "$@"
 ;;
 flush)
     init_avail
     flush_rules "$@"
 ;;
 restart|force-reload)
     init_avail
     flush_rules "$@"
     load_rules "$@"
 ;;
 stop)
     # Why? because if stop is used, the firewall gets flushed for a variable
     # amount of time during package upgrades, leaving the machine vulnerable
     # It's also not always desirable to flush during purge
     echo 'Automatic flushing disabled, use "flush" instead of "stop"' >&2
 ;;
 *)
     echo "Usage: $0 {start|restart|reload|force-reload|save|flush}" >&2
     exit 1
 ;;
 esac
 
 exit 0