#!/bin/bash

#

# iptables-apply -- a safer way to update iptables remotely

#

# Copyright © Martin F. Krafft <madduck@madduck.net>

# Released under the terms of the Artistic Licence 2.0

#

set -eu

PROGNAME="${0##*/}";

VERSION=1.0

TIMEOUT=10

function blurb()

{

	cat <<-_eof

	$PROGNAME $VERSION -- a safer way to update iptables remotely

	_eof

}

function copyright()

{

	cat <<-_eof

	$PROGNAME is C Martin F. Krafft <madduck@madduck.net>.

	The program has been published under the terms of the Artistic Licence 2.0

	_eof

}

function about()

{

	blurb

	echo

	copyright

}

function usage()

{

	cat <<-_eof

	Usage: $PROGNAME [options] ruleset

	The script will try to apply a new ruleset (as output by iptables-save/read

	by iptables-restore) to iptables, then prompt the user whether the changes

	are okay. If the new ruleset cut the existing connection, the user will not

	be able to answer affirmatively. In this case, the script rolls back to the

	previous ruleset.

	The following options may be specified, using standard conventions:

	-t | --timeout	Specify the timeout in seconds (default: $TIMEOUT)

	-V | --version	Display version information

	-h | --help	Display this help text

	_eof

}

SHORTOPTS="t:Vh";

LONGOPTS="timeout:,version,help";

OPTS=$(getopt -s bash -o "$SHORTOPTS" -l "$LONGOPTS" -n "$PROGNAME" -- "$@") || exit $?

for opt in $OPTS; do

	case "$opt" in

		(-*) unset OPT_STATE;;

		(*)

			case "${OPT_STATE:-}" in

				(SET_TIMEOUT)

					eval TIMEOUT=$opt

					case "$TIMEOUT" in

						([0-9]*) :;;

						(*)

							echo "E: non-numeric timeout value." >&2

							exit 1

							;;

					esac

					;;

			esac

			;;

	esac

	case "$opt" in

		(-h|--help) usage >&2; exit 0;;

		(-V|--version) about >&2; exit 0;;

		(-t|--timeout) OPT_STATE=SET_TIMEOUT;;

		(--) break;;

	esac

	shift

done

case "$PROGNAME" in

	(*6*)

		SAVE=ip6tables-save

		RESTORE=ip6tables-restore

		DEFAULT_FILE=/etc/network/ip6tables

		;;

	(*)

		SAVE=iptables-save

		RESTORE=iptables-restore

		DEFAULT_FILE=/etc/network/iptables

		;;

esac

FILE="${1:-$DEFAULT_FILE}";

if [[ -z "$FILE" ]]; then

	echo "E: missing file argument." >&2

	exit 1

fi

if [[ ! -r "$FILE" ]]; then

	echo "E: cannot read $FILE" >&2

	exit 2

fi

COMMANDS=(mktemp "$SAVE" "$RESTORE")

for cmd in "${COMMANDS[@]}"; do

	if ! command -v $cmd >/dev/null; then

		echo "E: command not found: $cmd" >&2

		exit 127

	fi

done

umask 0700

TMPFILE=$(mktemp)

trap "rm -f $TMPFILE" EXIT HUP INT QUIT ILL TRAP ABRT BUS \

		      FPE USR1 SEGV USR2 PIPE ALRM TERM

if ! "$SAVE" >"$TMPFILE"; then

	if ! grep -q ipt /proc/modules 2>/dev/null; then

		echo "E: iptables support lacking from the kernel." >&2

		exit 3

	else

		echo "E: unknown error saving current iptables ruleset." >&2

		exit 4

	fi

fi

[ -x /etc/init.d/fail2ban ] && /etc/init.d/fail2ban stop

echo -n "Applying new ruleset... "

if ! "$RESTORE" <"$FILE"; then

	echo "failed."

	echo "E: unknown error applying new iptables ruleset." >&2

	exit 5

else

	echo "done."

fi

echo -n "Can you establish NEW connections to the machine? (y/N) "

read -n1 -t "${TIMEOUT:-15}" ret 2>&1 || :

case "${ret:-}" in

	(y*|Y*)

		echo

		echo "... then my job is done. See you next time."

		;;

	(*)

		if [[ -z "${ret:-}" ]]; then

			echo "apparently not..."

		else

			echo

		fi

		echo "Timeout. Something happened (or did not). Better play it safe..."

		echo -n "Reverting to old ruleset... "

		"$RESTORE" <"$TMPFILE";

		echo "done."

		exit 255

		;;

esac

[ -x /etc/init.d/fail2ban ] && /etc/init.d/fail2ban start

exit 0

# vim:noet:sw=8