gistfile1.txt
· 2.1 KiB · Text
Raw
function rule::apply() {
local rule_name="$1"
local client_ip="$2"
rule::require_exists "$rule_name" || return 1
# Check if already applied
local peer_name
peer_name=$(peers::find_by_ip "$client_ip")
if [[ -n "$peer_name" ]]; then
# Check if already applied via iptables
if rule::is_applied "$rule_name" "$client_ip"; then
log::wg "Rule '${rule_name}' already applied to: ${client_ip}"
return 0
fi
fi
local rule_file
rule_file="$(ctx::rule::path "${rule_name}.rule")"
# Process block_ips
while IFS= read -r ip; do
[[ -z "$ip" ]] && continue
firewall::block_ip "$client_ip" "$ip"
done < <(rule::get "$rule_name" "block_ips")
# Process block_ports
while IFS= read -r entry; do
[[ -z "$entry" ]] && continue
local target port proto
IFS=":" read -r target port proto <<< "$entry"
proto="${proto:-tcp}"
firewall::block_port "$client_ip" "$target" "$port" "$proto"
done < <(rule::get "$rule_name" "block_ports")
# Process allow_ips (inserted before blocks)
while IFS= read -r ip; do
[[ -z "$ip" ]] && continue
firewall::allow_ip "$client_ip" "$ip"
done < <(rule::get "$rule_name" "allow_ips")
# allow_ports (inserted last = highest priority)
while IFS= read -r entry; do
[[ -z "$entry" ]] && continue
local target port proto
IFS=":" read -r target port proto <<< "$entry"
proto="${proto:-tcp}"
firewall::allow_port "$client_ip" "$target" "$port" "$proto"
done < <(rule::get "$rule_name" "allow_ports")
# Persist rule assignment in meta
log::debug "rule::apply: peer_name=$peer_name ip=$client_ip"
if [[ -n "$peer_name" ]]; then
peers::set_meta "$peer_name" "rule" "$rule_name"
log::debug "rule::apply: set meta rule=$rule_name for $peer_name"
fi
local dns_redirect
dns_redirect=$(rule::get "$rule_name" "dns_redirect")
if [[ "$dns_redirect" == "true" ]]; then
local subnet
subnet=$(config::subnet_for "$(peers::get_meta "$peer_name" "subtype")")
rule::apply_dns_redirect "${subnet}.0/24"
fi
log::wg_preset "Applied rule '${rule_name}' to: ${client_ip}"
}
| 1 | function rule::apply() { |
| 2 | local rule_name="$1" |
| 3 | local client_ip="$2" |
| 4 | |
| 5 | rule::require_exists "$rule_name" || return 1 |
| 6 | |
| 7 | # Check if already applied |
| 8 | local peer_name |
| 9 | peer_name=$(peers::find_by_ip "$client_ip") |
| 10 | if [[ -n "$peer_name" ]]; then |
| 11 | # Check if already applied via iptables |
| 12 | if rule::is_applied "$rule_name" "$client_ip"; then |
| 13 | log::wg "Rule '${rule_name}' already applied to: ${client_ip}" |
| 14 | return 0 |
| 15 | fi |
| 16 | fi |
| 17 | |
| 18 | local rule_file |
| 19 | rule_file="$(ctx::rule::path "${rule_name}.rule")" |
| 20 | |
| 21 | # Process block_ips |
| 22 | while IFS= read -r ip; do |
| 23 | [[ -z "$ip" ]] && continue |
| 24 | firewall::block_ip "$client_ip" "$ip" |
| 25 | done < <(rule::get "$rule_name" "block_ips") |
| 26 | |
| 27 | # Process block_ports |
| 28 | while IFS= read -r entry; do |
| 29 | [[ -z "$entry" ]] && continue |
| 30 | local target port proto |
| 31 | IFS=":" read -r target port proto <<< "$entry" |
| 32 | proto="${proto:-tcp}" |
| 33 | firewall::block_port "$client_ip" "$target" "$port" "$proto" |
| 34 | done < <(rule::get "$rule_name" "block_ports") |
| 35 | |
| 36 | # Process allow_ips (inserted before blocks) |
| 37 | while IFS= read -r ip; do |
| 38 | [[ -z "$ip" ]] && continue |
| 39 | firewall::allow_ip "$client_ip" "$ip" |
| 40 | done < <(rule::get "$rule_name" "allow_ips") |
| 41 | |
| 42 | # allow_ports (inserted last = highest priority) |
| 43 | while IFS= read -r entry; do |
| 44 | [[ -z "$entry" ]] && continue |
| 45 | local target port proto |
| 46 | IFS=":" read -r target port proto <<< "$entry" |
| 47 | proto="${proto:-tcp}" |
| 48 | firewall::allow_port "$client_ip" "$target" "$port" "$proto" |
| 49 | done < <(rule::get "$rule_name" "allow_ports") |
| 50 | |
| 51 | # Persist rule assignment in meta |
| 52 | log::debug "rule::apply: peer_name=$peer_name ip=$client_ip" |
| 53 | if [[ -n "$peer_name" ]]; then |
| 54 | peers::set_meta "$peer_name" "rule" "$rule_name" |
| 55 | log::debug "rule::apply: set meta rule=$rule_name for $peer_name" |
| 56 | fi |
| 57 | |
| 58 | local dns_redirect |
| 59 | dns_redirect=$(rule::get "$rule_name" "dns_redirect") |
| 60 | |
| 61 | if [[ "$dns_redirect" == "true" ]]; then |
| 62 | local subnet |
| 63 | subnet=$(config::subnet_for "$(peers::get_meta "$peer_name" "subtype")") |
| 64 | rule::apply_dns_redirect "${subnet}.0/24" |
| 65 | fi |
| 66 | |
| 67 | log::wg_preset "Applied rule '${rule_name}' to: ${client_ip}" |
| 68 | } |