From acde46cc56ce9c2f969371bc21896bfa8b7824b0 Mon Sep 17 00:00:00 2001
From: Gardouille <gardouille@gmail.com>
Date: Fri, 11 Sep 2015 19:33:08 +0200
Subject: [PATCH] Add Iptables rules only if a slapd or an ldap directory is
 available.

---
 firewall | 22 +++++++++++++---------
 1 file changed, 13 insertions(+), 9 deletions(-)

diff --git a/firewall b/firewall
index c7c1f94..76a716e 100755
--- a/firewall
+++ b/firewall
@@ -98,7 +98,7 @@ fw_start() {
   #############
   #### Pour tenter de s'y retrouver avec l'affichage des règles iptables, pour l'écriture des règles,
   #   respecter cet ordre:
-  # -t TABLE -A CHAINE -j TARGET -p PROTOCOLE -i ETH_IN -o ETH_OUT -s SOURCE -d DESTINATION --sport PORT_SRC --dport PORT_DST -m state --state �TAT -m comment --comment "COMMENTAIRE"
+  # -t TABLE -A CHAINE -j TARGET -p PROTOCOLE -i ETH_IN -o ETH_OUT -s SOURCE -d DESTINATION --sport PORT_SRC --dport PORT_DST -m state --state LIST_OF_STATE -m comment --comment "tiny DESCRIPTION"
   ####
 
   #### Ne pas casser les connexions etablies
@@ -131,9 +131,12 @@ fw_start() {
   #$IPT -A INPUT -j ACCEPT -p tcp -i "${ILAN}" -d "${IPLAN}" --dport 80 -m state --state NEW -m comment --comment "New HTTP in"
   #$IPT -A INPUT -j ACCEPT -p tcp -i "${ILAN}" -d "${IPLAN}" --dport 443 -m state --state NEW -m comment --comment "New HTTPS in"
 
+if [ $(command -v slapd) ]; then
   #### slapd
-  #$IPT -A INPUT -j ACCEPT -p tcp -i "${ILAN}" -d "${IPLAN}" --dport 389 -m state --state NEW -m comment --comment "New LDAP in"
-  #$IPT -A INPUT -j ACCEPT -p tcp -i "${ILAN}" -d "${IPLAN}" --dport 636 -m state --state NEW -m comment --comment "New LDAPS in"
+  #### if 389 is use, ldap connections should be in TLS
+  $IPT -A INPUT -j ACCEPT -p tcp -i "${ILAN}" -d "${IPLAN}" --dport 389 -m state --state NEW -m comment --comment "New LDAP in"
+  $IPT -A INPUT -j ACCEPT -p tcp -i "${ILAN}" -d "${IPLAN}" --dport 636 -m state --state NEW -m comment --comment "New LDAPS in"
+fi
 
   #### dhcpd
   #$IPT -A INPUT -j ACCEPT -p udp -i "${ILAN}" -d "${IPLAN}" --sport 67:68 --dport 67:68 -m state --state NEW -m comment --comment "New DHCPD in"
@@ -211,12 +214,13 @@ fw_start() {
 #
 #  #### dhcpd
 #  #$IPT -A OUTPUT -j ACCEPT -p udp -o "${ILAN}" -s "${IPLAN}" --sport 67:68 --dport 67:68 -m state --state NEW -m comment --comment "DHCPD out"
-#
-#  #### ldap connection//synchronisation (only the server is allowed to connect without SSL)
-##  $IPT -A OUTPUT -j ACCEPT -p tcp -o "${ILAN}" -s "${IPLAN}" --dport 389 -m state --state NEW -m comment --comment "LDAP out"
-#  #### ldap connection (should be an LDAPS connection when it will be available!)
-#  #$IPT -A OUTPUT -j ACCEPT -p tcp -o "${ILAN}" -s "${IPLAN}" --dport 389 -m state --state NEW -m comment --comment "LDAP out"
-#
+
+if [ -d /etc/ldap ]; then
+  #### ldap connection should be in TLS or at least in LDAPS/SSL
+  $IPT -A OUTPUT -j ACCEPT -p tcp -o "${ILAN}" -s "${IPLAN}" --dport 389 -m state --state NEW -m comment --comment "LDAP out"
+  $IPT -A OUTPUT -j ACCEPT -p tcp -o "${ILAN}" -s "${IPLAN}" --dport 636 -m state --state NEW -m comment --comment "LDAPS out"
+fi
+
 #  #### NFS Client
 #  #$IPT -A OUTPUT -j ACCEPT -p tcp -o "${ILAN}" -s "${IPLAN}" --dport 111 -m state --state NEW -m comment --comment "NFS out"
 #  #$IPT -A OUTPUT -j ACCEPT -p udp -o "${ILAN}" -s "${IPLAN}" --dport 111 -m state --state NEW -m comment --comment "NFS out"