UnknownSec Bypass 403

: /usr/lib/lxd/ [ drwxr-xr-x ]
name : lxd-bridge #!/bin/sh config="/etc/default/lxd-bridge" varrun="/run/lxd-bridge/" varlib="/var/lib/lxd-bridge/" # lxdbr0 defaults to only setting up the standard IPv6 link-local network # to enable routable IPv4 and/or IPv6, please edit /etc/default/lxd # The values below are defaults USE_LXD_BRIDGE="true" LXD_BRIDGE="lxdbr0" LXD_CONFILE="" LXD_DOMAIN="" # IPv4 LXD_IPV4_ADDR="" LXD_IPV4_NETMASK="" LXD_IPV4_NETWORK="" LXD_IPV4_DHCP_RANGE="" LXD_IPV4_DHCP_MAX="" LXD_IPV4_NAT="false" LXD_IPV4_FIREWALL="true" # IPv6 LXD_IPV6_ADDR="" LXD_IPV6_MASK="" LXD_IPV6_NETWORK="" LXD_IPV6_NAT="false" LXD_IPV6_FIREWALL="true" LXD_IPV6_PROXY="true" # shellcheck disable=SC1090 [ ! -f "${config}" ] || . "${config}" use_iptables_lock="-w" iptables -w -L -n > /dev/null 2>&1 || use_iptables_lock="" HAS_IPV6=false [ -e "/proc/sys/net/ipv6/conf/default/disable_ipv6" ] && \ [ "$(cat /proc/sys/net/ipv6/conf/default/disable_ipv6)" = "0" ] && HAS_IPV6=true _netmask2cidr () { # Assumes there's no "255." after a non-255 byte in the mask x=${1##*255.} set -- "0^^^128^192^224^240^248^252^254^" "$(( (${#1} - ${#x})*2 ))" "${x%%.*}" x=${1%%${3}*} echo $(( ${2} + (${#x}/4) )) } ifdown() { ip addr flush dev "${1}" ip link set dev "${1}" down } ifup() { [ "${HAS_IPV6}" = "true" ] && [ "${LXD_IPV6_PROXY}" = "true" ] && ip addr add fe80::1/64 dev "${1}" if [ -n "${LXD_IPV4_NETMASK}" ] && [ -n "${LXD_IPV4_ADDR}" ]; then MASK=$(_netmask2cidr ${LXD_IPV4_NETMASK}) CIDR_ADDR="${LXD_IPV4_ADDR}/${MASK}" ip addr add "${CIDR_ADDR}" dev "${1}" fi ip link set dev "${1}" up } start() { [ "x${USE_LXD_BRIDGE}" = "xtrue" ] || { exit 0; } [ ! -f "${varrun}/network_up" ] || { echo "lxd-bridge is already running"; exit 1; } if [ -d /sys/class/net/${LXD_BRIDGE} ]; then stop force 2>/dev/null || true fi FAILED=1 cleanup() { set +e if [ "${FAILED}" = "1" ]; then echo "Failed to setup lxd-bridge." >&2 stop force fi } trap cleanup EXIT HUP INT TERM set -e # set up the lxd network [ ! -d "/sys/class/net/${LXD_BRIDGE}" ] && ip link add dev "${LXD_BRIDGE}" type bridge if [ "${HAS_IPV6}" = "true" ]; then echo 0 > "/proc/sys/net/ipv6/conf/${LXD_BRIDGE}/autoconf" || true echo 0 > "/proc/sys/net/ipv6/conf/${LXD_BRIDGE}/accept_dad" || true fi # if we are run from systemd on a system with selinux enabled, # the mkdir will create /run/lxd as init_var_run_t which dnsmasq # can't write its pid into, so we restorecon it (to var_run_t) if [ ! -d "${varrun}" ]; then mkdir -p "${varrun}" if which restorecon >/dev/null 2>&1; then restorecon "${varrun}" fi fi if [ ! -d "${varlib}" ]; then mkdir -p "${varlib}" if which restorecon >/dev/null 2>&1; then restorecon "${varlib}" fi fi ifup "${LXD_BRIDGE}" "${LXD_IPV4_ADDR}" "${LXD_IPV4_NETMASK}" LXD_IPV4_ARG="" if [ -n "${LXD_IPV4_ADDR}" ] && [ -n "${LXD_IPV4_NETMASK}" ] && [ -n "${LXD_IPV4_NETWORK}" ]; then echo 1 > /proc/sys/net/ipv4/ip_forward if [ "${LXD_IPV4_NAT}" = "true" ]; then iptables "${use_iptables_lock}" -t nat -A POSTROUTING -s "${LXD_IPV4_NETWORK}" ! -d "${LXD_IPV4_NETWORK}" -j MASQUERADE -m comment --comment "managed by lxd-bridge" fi LXD_IPV4_ARG="--listen-address ${LXD_IPV4_ADDR} --dhcp-range ${LXD_IPV4_DHCP_RANGE} --dhcp-lease-max=${LXD_IPV4_DHCP_MAX}" fi LXD_IPV6_ARG="" if [ "${HAS_IPV6}" = "true" ] && [ -n "${LXD_IPV6_ADDR}" ] && [ -n "${LXD_IPV6_MASK}" ] && [ -n "${LXD_IPV6_NETWORK}" ]; then # IPv6 sysctls don't respect the "all" path... for interface in /proc/sys/net/ipv6/conf/*; do echo 2 > "${interface}/accept_ra" done for interface in /proc/sys/net/ipv6/conf/*; do echo 1 > "${interface}/forwarding" done ip -6 addr add dev "${LXD_BRIDGE}" "${LXD_IPV6_ADDR}/${LXD_IPV6_MASK}" if [ "${LXD_IPV6_NAT}" = "true" ]; then ip6tables "${use_iptables_lock}" -t nat -A POSTROUTING -s "${LXD_IPV6_NETWORK}" ! -d "${LXD_IPV6_NETWORK}" -j MASQUERADE -m comment --comment "managed by lxd-bridge" fi LXD_IPV6_ARG="--dhcp-range=${LXD_IPV6_ADDR},ra-stateless,ra-names --listen-address ${LXD_IPV6_ADDR}" fi iptables "${use_iptables_lock}" -I INPUT -i "${LXD_BRIDGE}" -p udp --dport 67 -j ACCEPT -m comment --comment "managed by lxd-bridge" iptables "${use_iptables_lock}" -I INPUT -i "${LXD_BRIDGE}" -p udp --dport 53 -j ACCEPT -m comment --comment "managed by lxd-bridge" iptables "${use_iptables_lock}" -I INPUT -i "${LXD_BRIDGE}" -p tcp --dport 53 -j ACCEPT -m comment --comment "managed by lxd-bridge" if [ "${LXD_IPV4_FIREWALL}" = "true" ]; then iptables "${use_iptables_lock}" -I FORWARD -i "${LXD_BRIDGE}" -j ACCEPT -m comment --comment "managed by lxd-bridge" iptables "${use_iptables_lock}" -I FORWARD -o "${LXD_BRIDGE}" -j ACCEPT -m comment --comment "managed by lxd-bridge" fi iptables "${use_iptables_lock}" -t mangle -A POSTROUTING -o "${LXD_BRIDGE}" -p udp -m udp --dport 68 -j CHECKSUM --checksum-fill -m comment --comment "managed by lxd-bridge" || true if [ "${HAS_IPV6}" = "true" ]; then ip6tables "${use_iptables_lock}" -I INPUT -i "${LXD_BRIDGE}" -p udp --dport 67 -j ACCEPT -m comment --comment "managed by lxd-bridge" ip6tables "${use_iptables_lock}" -I INPUT -i "${LXD_BRIDGE}" -p udp --dport 53 -j ACCEPT -m comment --comment "managed by lxd-bridge" ip6tables "${use_iptables_lock}" -I INPUT -i "${LXD_BRIDGE}" -p tcp --dport 53 -j ACCEPT -m comment --comment "managed by lxd-bridge" if [ "${LXD_IPV6_FIREWALL}" = "true" ]; then ip6tables "${use_iptables_lock}" -I FORWARD -i "${LXD_BRIDGE}" -j ACCEPT -m comment --comment "managed by lxd-bridge" ip6tables "${use_iptables_lock}" -I FORWARD -o "${LXD_BRIDGE}" -j ACCEPT -m comment --comment "managed by lxd-bridge" fi fi LXD_DOMAIN_ARG="" if [ -n "${LXD_DOMAIN}" ]; then LXD_DOMAIN_ARG="-s ${LXD_DOMAIN} -S /${LXD_DOMAIN}/" fi LXD_CONFILE_ARG="" if [ -n "${LXD_CONFILE}" ]; then LXD_CONFILE_ARG="--conf-file=${LXD_CONFILE}" fi # https://lists.linuxcontainers.org/pipermail/lxc-devel/2014-October/010561.html for DNSMASQ_USER in lxd dnsmasq nobody do if getent passwd "${DNSMASQ_USER}" >/dev/null; then break fi done if [ -n "${LXD_IPV4_ADDR}" ] || [ -n "${LXD_IPV6_ADDR}" ]; then # shellcheck disable=SC2086 dnsmasq ${LXD_CONFILE_ARG} ${LXD_DOMAIN_ARG} -u "${DNSMASQ_USER}" --strict-order --bind-interfaces --pid-file="${varrun}/dnsmasq.pid" --dhcp-no-override --except-interface=lo --interface="${LXD_BRIDGE}" --dhcp-leasefile="${varlib}/dnsmasq.${LXD_BRIDGE}.leases" --dhcp-authoritative ${LXD_IPV4_ARG} ${LXD_IPV6_ARG} fi if [ "${HAS_IPV6}" = "true" ] && [ "${LXD_IPV6_PROXY}" = "true" ]; then PATH="${PATH}:$(dirname "${0}")" lxd-bridge-proxy --addr="[fe80::1%${LXD_BRIDGE}]:13128" & PID=$! echo "${PID}" > "${varrun}/proxy.pid" fi touch "${varrun}/network_up" FAILED=0 } stop() { [ -f "${varrun}/network_up" ] || [ "${1}" = "force" ] || { echo "lxd-bridge isn't running"; exit 1; } if [ -d /sys/class/net/${LXD_BRIDGE} ]; then ifdown ${LXD_BRIDGE} iptables ${use_iptables_lock} -D INPUT -i ${LXD_BRIDGE} -p udp --dport 67 -j ACCEPT -m comment --comment "managed by lxd-bridge" iptables ${use_iptables_lock} -D INPUT -i ${LXD_BRIDGE} -p udp --dport 53 -j ACCEPT -m comment --comment "managed by lxd-bridge" iptables ${use_iptables_lock} -D INPUT -i ${LXD_BRIDGE} -p tcp --dport 53 -j ACCEPT -m comment --comment "managed by lxd-bridge" if [ "${LXD_IPV4_FIREWALL}" = "true" ]; then iptables ${use_iptables_lock} -D FORWARD -i ${LXD_BRIDGE} -j ACCEPT -m comment --comment "managed by lxd-bridge" iptables ${use_iptables_lock} -D FORWARD -o ${LXD_BRIDGE} -j ACCEPT -m comment --comment "managed by lxd-bridge" fi iptables ${use_iptables_lock} -t mangle -D POSTROUTING -o ${LXD_BRIDGE} -p udp -m udp --dport 68 -j CHECKSUM --checksum-fill -m comment --comment "managed by lxd-bridge" || true if [ -n "${LXD_IPV4_NETWORK}" ] && [ "${LXD_IPV4_NAT}" = "true" ]; then iptables ${use_iptables_lock} -t nat -D POSTROUTING -s ${LXD_IPV4_NETWORK} ! -d ${LXD_IPV4_NETWORK} -j MASQUERADE -m comment --comment "managed by lxd-bridge" fi if [ "${HAS_IPV6}" = "true" ]; then ip6tables ${use_iptables_lock} -D INPUT -i ${LXD_BRIDGE} -p udp --dport 67 -j ACCEPT -m comment --comment "managed by lxd-bridge" ip6tables ${use_iptables_lock} -D INPUT -i ${LXD_BRIDGE} -p udp --dport 53 -j ACCEPT -m comment --comment "managed by lxd-bridge" ip6tables ${use_iptables_lock} -D INPUT -i ${LXD_BRIDGE} -p tcp --dport 53 -j ACCEPT -m comment --comment "managed by lxd-bridge" if [ "${LXD_IPV6_FIREWALL}" = "true" ]; then ip6tables ${use_iptables_lock} -D FORWARD -i ${LXD_BRIDGE} -j ACCEPT -m comment --comment "managed by lxd-bridge" ip6tables ${use_iptables_lock} -D FORWARD -o ${LXD_BRIDGE} -j ACCEPT -m comment --comment "managed by lxd-bridge" fi fi if [ "${HAS_IPV6}" = "true" ] && [ -n "${LXD_IPV6_NETWORK}" ] && [ "${LXD_IPV6_NAT}" = "true" ]; then ip6tables ${use_iptables_lock} -t nat -D POSTROUTING -s ${LXD_IPV6_NETWORK} ! -d ${LXD_IPV6_NETWORK} -j MASQUERADE -m comment --comment "managed by lxd-bridge" fi if [ -e "${varrun}/dnsmasq.pid" ]; then pid=$(cat "${varrun}/dnsmasq.pid" 2>/dev/null) && kill -9 "${pid}" rm -f "${varrun}/dnsmasq.pid" fi if [ -e "${varrun}/proxy.pid" ]; then pid=$(cat "${varrun}/proxy.pid" 2>/dev/null) && kill -9 "${pid}" rm -f "${varrun}/proxy.pid" fi # if ${LXD_BRIDGE} has attached interfaces, don't destroy the bridge ls /sys/class/net/${LXD_BRIDGE}/brif/* > /dev/null 2>&1 || ip link delete "${LXD_BRIDGE}" fi rm -f "${varrun}/network_up" } # See how we were called. case "${1}" in start) start ;; stop) stop ;; restart|reload|force-reload) ${0} stop ${0} start ;; *) echo "Usage: ${0} {start|stop|restart|reload|force-reload}" exit 2 esac exit $?