#!/bin/bash 
  
 #### VARIABILI 
 SCRIPTNAME=`echo $0 | awk -vFS='/' '{print $NF}'` 
 #EXEC=/hosthome${PWD#$HOME}${0#'.'} 
  

waitfinish() 
{ 
    SEMAPHORE=$1.booting 
    touch $SEMAPHORE 
    while [ -f $SEMAPHORE ]; do 
       sleep 2 
    done 
    sleep 5 
} 
 
 notifyfinish() 
{ 
   rm $1.booting 
} 

startvm() 
{ 
X="--new --exec=/hosthome${PWD#$HOME}/${SCRIPTNAME}" 

 	  if       [ -e r_1-pc1.disk ]   ; then    
 	    echo "$0: some .disk file exists in this directory!" 
 	    echo " launch "$0 crash" first" 
 	    exit 1 
 	  fi 
  
 	  vstart  r_1-pc1 --eth0=C0 $X 
 	  waitfinish r_1-pc1 
echo '' 
echo ' *** all machines started ***'
} 

crashvm() 
 { 
 	  vcrash  r_1-pc1
 } 
 
make_ripd_file() 
{ 
cat > /etc/zebra/ripd.conf <<  EOF 
! 
 hostname ripd 
 password root 
 enable password root 
! 
log file /var(log/zebra/ripd.log 
!ricorda che questa è una prova...
EOF
}
  
make_zebra_daemon_file() 
 { 
 	  cat > /etc/zebra/daemons <<EOF
 # This file tells the zebra package  
 # which daemons to start. 
 zebra=yes 
 bgpd=no 
 ospfd=no 
 ospf6d=no 
 ripd=no 
 ripngd=no 
EOF
}
 
make_zebra_file() 
 { 
  	  cat > /etc/zebra/zebra.conf <<EOF
 ! -*- zebra -*-  
 ! 
 ! zebra configuration file 
 ! 
 hostname zebrad 
 password root 
 enable password root 
 ! 
 ! Static default route sample. 
 ! 
 ! ip route 0.0.0.0/0 203.181.89.241 
 ! 
 log file /var/log/zebra/zebra.log 
EOF
}
 
  help_exit() 
 { 
 	    echo "Usage:$0 {start|crash}" 
 	    echo " Run this script from your home or from a subdir" 
 	    echo "  lab start " 
 	    echo "starts all virtual machines for the lab " 
    echo "     press enter after each virtual machines has booted " 
 	   echo "  lab crash " 
	   echo "     makes all virtual machines to crash and delete .disk files " 
 	    exit 1 
 	  } 
  
 if [ "$1" = "start" ]; then 
 startvm 
 elif [ "$1" = "crash" ]; then 
 crashvm 
 rm -f *.disk  *.booting 
 elif [ ! -z $1 ]; then 
 help_exit 
 elif [ -z $1 ]; then 
 
	if [ `id -u` != "0" ]; then 
 help_exit 
 fi 
 
   SCRIPTFILE=`cat /proc/cmdline | awk -v FS== -v RS=' ' '{if($1=="exec") print $2}' ` 
   SCRIPTDIR=${SCRIPTFILE%/${SCRIPTNAME}} 
   echo changing directory to $SCRIPTDIR 
   cd $SCRIPTDIR  
 
case "$HOSTNAME" in 
 
r_1-pc1) 
 /sbin/ifconfig eth0 135.207.10.208 up 
# standard: protect from common attacks

/sbin/iptables -F 
/sbin/iptables -P INPUT DROP
/sbin/iptables -P OUTPUT DROP
/sbin/iptables -P FORWARD DROP

# construct loopback: allow in and outbound loopback connections

/sbin/iptables -A INPUT -i lo -s 0/0 -d 0/0 -p all -j ACCEPT
/sbin/iptables -A FORWARDlo -s 0/0 -d 0/0 -p all -j ACCEPT
/sbin/iptables -A OUTPUT -o lo -s 0/0 -d 0/0 -p all -j ACCEPT
# construct : allow established connections

/sbin/iptables -A INPUT -s 0/0 -d 0/0 -p tcp -j ACCEPT -m state --state established,related
/sbin/iptables -A FORWARD -s 0/0 -d 0/0 -p tcp -j ACCEPT -m state --state established,related
/sbin/iptables -A OUTPUT -s 0/0 -d 0/0 -p tcp -j ACCEPT -m state --state established,related
/sbin/iptables -A INPUT -s 0/0 -d 0/0 -p udp -j ACCEPT -m state --state established,related
/sbin/iptables -A FORWARD -s 0/0 -d 0/0 -p udp -j ACCEPT -m state --state established,related
/sbin/iptables -A OUTPUT -s 0/0 -d 0/0 -p udp -j ACCEPT -m state --state established,related
# construct no frags: deny fragmented packets

/sbin/iptables -A INPUT -f -p all -j DROP
/sbin/iptables -A FORWARD -f -p all -j DROP
/sbin/iptables -A OUTPUT -f -p all -j DROP
# construct Spoof Prevention: Prevents spoofing over untrusted interface (eth0 = internet)

/sbin/iptables -A FORWARD -i eth0 -s 135.207.10.208 -d 0/0 -p all -j DROP
/sbin/iptables -A INPUT -i eth0 -s 135.207.10.208 -d 0/0 -p all -j DROP
/sbin/iptables -A FORWARD -i eth0 -s 135.207.10.208 -d 0/0 -p all -j LOG
/sbin/iptables -A INPUT -i eth0 -s 135.207.10.208 -d 0/0 -p all -j LOG
/sbin/iptables -A FORWARD -i eth0 -s 127.0.0.1 -d 0/0 -p all -j DROP
/sbin/iptables -A INPUT -i eth0 -s 127.0.0.1 -d 0/0 -p all -j DROP
/sbin/iptables -A FORWARD -i eth0 -s 127.0.0.1 -d 0/0 -p all -j LOG
/sbin/iptables -A INPUT -i eth0 -s 127.0.0.1 -d 0/0 -p all -j LOG
# construct deny unroutable: prevent unroutable nets from entering the internet interface

/sbin/iptables -A FORWARD -i eth0 -s 0.0.0.0/255.0.0.0 -d 0/0 -p all -j DROP
/sbin/iptables -A INPUT -i eth0 -s 0.0.0.0/255.0.0.0 -d 0/0 -p all -j DROP
/sbin/iptables -A FORWARD -i eth0 -s 0.0.0.0/255.0.0.0 -d 0/0 -p all -j LOG
/sbin/iptables -A INPUT -i eth0 -s 0.0.0.0/255.0.0.0 -d 0/0 -p all -j LOG
/sbin/iptables -A FORWARD -i eth0 -s 169.254.0.0/255.255.0.0 -d 0/0 -p all -j DROP
/sbin/iptables -A INPUT -i eth0 -s 169.254.0.0/255.255.0.0 -d 0/0 -p all -j DROP
/sbin/iptables -A FORWARD -i eth0 -s 169.254.0.0/255.255.0.0 -d 0/0 -p all -j LOG
/sbin/iptables -A INPUT -i eth0 -s 169.254.0.0/255.255.0.0 -d 0/0 -p all -j LOG
/sbin/iptables -A FORWARD -i eth0 -s 192.0.2.0/255.255.255.0 -d 0/0 -p all -j DROP
/sbin/iptables -A INPUT -i eth0 -s 192.0.2.0/255.255.255.0 -d 0/0 -p all -j DROP
/sbin/iptables -A FORWARD -i eth0 -s 192.0.2.0/255.255.255.0 -d 0/0 -p all -j LOG
/sbin/iptables -A INPUT -i eth0 -s 192.0.2.0/255.255.255.0 -d 0/0 -p all -j LOG
/sbin/iptables -A FORWARD -i eth0 -s 224.0.0.0/255.0.0.0 -d 0/0 -p all -j DROP
/sbin/iptables -A INPUT -i eth0 -s 224.0.0.0/255.0.0.0 -d 0/0 -p all -j DROP
/sbin/iptables -A FORWARD -i eth0 -s 224.0.0.0/255.0.0.0 -d 0/0 -p all -j LOG
/sbin/iptables -A INPUT -i eth0 -s 224.0.0.0/255.0.0.0 -d 0/0 -p all -j LOG
/sbin/iptables -A FORWARD -i eth0 -s 240.0.0.0/255.0.0.0 -d 0/0 -p all -j DROP
/sbin/iptables -A INPUT -i eth0 -s 240.0.0.0/255.0.0.0 -d 0/0 -p all -j DROP
/sbin/iptables -A FORWARD -i eth0 -s 240.0.0.0/255.0.0.0 -d 0/0 -p all -j LOG
/sbin/iptables -A INPUT -i eth0 -s 240.0.0.0/255.0.0.0 -d 0/0 -p all -j LOG
# construct tcp in/out: allow outbound tcp traffic, permit inbound,except connection initiation

/sbin/iptables -A FORWARD -o eth0 -s 135.207.10.208 -d 0/0 -p tcp -j ACCEPT
/sbin/iptables -A OUTPUT -o eth0 -s 135.207.10.208 -d 0/0 -p tcp -j ACCEPT
/sbin/iptables -A FORWARD -i eth0 -s 0/0 -d 135.207.10.208 -p tcp -j DROP -m state --state new
/sbin/iptables -A INPUT -i eth0 -s 0/0 -d 135.207.10.208 -p tcp -j DROP -m state --state new
/sbin/iptables -A FORWARD -i + -s 0/0 -d 135.207.10.208 -p tcp -j ACCEPT
/sbin/iptables -A INPUT -i + -s 0/0 -d 135.207.10.208 -p tcp -j ACCEPT
# construct udp: allow dns and NTP traffic

/sbin/iptables -A INPUT -s 0/0 -d 135.207.10.208 -p udp -j ACCEPT -m multiport --sport 53,123
/sbin/iptables -A FORWARD -s 0/0 -d 135.207.10.208 -p udp -j ACCEPT -m multiport --sport 53,123
/sbin/iptables -A OUTPUT -s 0/0 -d 135.207.10.208 -p udp -j ACCEPT -m multiport --sport 53,123
/sbin/iptables -A INPUT -s 135.207.10.208 -d 0/0 -p udp -j ACCEPT -m multiport --dport 53,123
/sbin/iptables -A FORWARD -s 135.207.10.208 -d 0/0 -p udp -j ACCEPT -m multiport --dport 53,123
/sbin/iptables -A OUTPUT -s 135.207.10.208 -d 0/0 -p udp -j ACCEPT -m multiport --dport 53,123
# construct icmp: allow ping, ping reply, time-exceeded, fragmentation needed messages

/sbin/iptables -A FORWARD -i eth0 -s 0/0 -d 135.207.10.208 -p icmp -j ACCEPT --icmp-type echo-request
/sbin/iptables -A INPUT -i eth0 -s 0/0 -d 135.207.10.208 -p icmp -j ACCEPT --icmp-type echo-request
/sbin/iptables -A FORWARD -i eth0 -s 0/0 -d 135.207.10.208 -p icmp -j ACCEPT --icmp-type echo-reply
/sbin/iptables -A INPUT -i eth0 -s 0/0 -d 135.207.10.208 -p icmp -j ACCEPT --icmp-type echo-reply
/sbin/iptables -A FORWARD -i eth0 -s 0/0 -d 135.207.10.208 -p icmp -j ACCEPT --icmp-type ttl-exceed
/sbin/iptables -A INPUT -i eth0 -s 0/0 -d 135.207.10.208 -p icmp -j ACCEPT --icmp-type ttl-exceed
/sbin/iptables -A FORWARD -i eth0 -s 0/0 -d 135.207.10.208 -p icmp -j ACCEPT --icmp-type source-quench
/sbin/iptables -A INPUT -i eth0 -s 0/0 -d 135.207.10.208 -p icmp -j ACCEPT --icmp-type source-quench
/sbin/iptables -A FORWARD -o eth0 -s 135.207.10.208 -d 0/0 -p icmp -j ACCEPT --icmp-type echo-request
/sbin/iptables -A OUTPUT -o eth0 -s 135.207.10.208 -d 0/0 -p icmp -j ACCEPT --icmp-type echo-request
/sbin/iptables -A FORWARD -o eth0 -s 135.207.10.208 -d 0/0 -p icmp -j ACCEPT --icmp-type echo-reply
/sbin/iptables -A OUTPUT -o eth0 -s 135.207.10.208 -d 0/0 -p icmp -j ACCEPT --icmp-type echo-reply
 
notifyfinish r_1-pc1
  ;; 
 
 
*) 
echo "error:don\'t know how to configure $HOSTNAME " 
exit 1 
esac 
fi