Merge lp:~bertrand-goareguer/ufw/ufw-qos into lp:~jdstrand/ufw/trunk

[Jonathan Davies]

Unmerged revisions

371. By Bertrand Goareguer <beber@beber-laptop> on 2009-02-21

added creation of the TC filters when firewall is enabled

370. By Bertrand Goareguer <beber@beber-laptop> on 2009-02-14

implemented the deletion of the tc filters (when deleting the rule)

369. By Bertrand Goareguer <beber@beber-laptop> on 2009-02-13

added creation of tc filters (deletion is not implemente yet)

368. By Bertrand Goareguer <beber@beber-laptop> on 2009-02-06

added creation/deletion of tc qdiscs on firewall startup/shutdown

367. By Bertrand Goareguer <beber@beber-laptop> on 2009-02-02

- rules now have a rate clause
- the rate is expressed in kbps (kilo bits per second)
- the rate can only be specified with the "allow" action
- if no rate is specified or if action != "allow", the rate is set to "unlimited"
- writing the 2 same rules with different rates updates the rule (similar to writing same rules with different actions)
- both short and full rule formats are supported
- rate must be the last parameter for short rule format

=== modified file 'setup.py'
--- setup.py	2009-11-30 16:03:43 +0000
+++ setup.py	2009-12-09 23:28:13 +0000
@@ -253,7 +253,7 @@
       license='GPL-3',
       cmdclass={'install': Install},
       package_dir={'ufw': 'staging'},
-      py_modules=['ufw.backend', 'ufw.backend_iptables', 'ufw.common', 'ufw.frontend', 'ufw.util', 'ufw.applications']
+      py_modules=['ufw.backend', 'ufw.backend_iptables', 'ufw.common', 'ufw.frontend', 'ufw.util', 'ufw.applications', 'ufw.tc_functions']
 )
 
 shutil.rmtree('staging')
 
=== modified file 'src/backend_iptables.py'
--- src/backend_iptables.py	2009-11-11 18:05:16 +0000
+++ src/backend_iptables.py	2009-12-09 23:28:13 +0000
@@ -20,9 +20,11 @@
 import re
 import sys
 import tempfile
+import ufw.tc_functions
 
 from ufw.common import UFWError, UFWRule, config_dir, state_dir, prefix_dir
 from ufw.util import warn, debug, msg, cmd, cmd_pipe
+from ufw.tc_functions import add_filter, delete_filter
 import ufw.backend
 
 
@@ -388,6 +390,9 @@
             (rc, out) = cmd([self.files['init'], 'start'])
             if rc != 0:
                 raise UFWError(err_msg + " ufw-init")
+            else:
+                # if firewall has been started successfully, apply the TC rules
+                self._reload_user_filters()
 
             if not self.defaults.has_key('loglevel') or \
                self.defaults['loglevel'] not in self.loglevels.keys():
@@ -454,7 +459,19 @@
                 if rc != 0:
                     raise UFWError(err_msg + " ip6tables")
 
+<<<<<<< TREE
     def _get_rules_from_formatted(self, frule, prefix, suffix):
+=======
+    def _reload_user_filters(self):
+        '''Reload TC filters'''
+        for rule in self.rules:
+            if rule.rate != "unlimited":
+                if rule.action == "allow":
+                    add_filter(rule.src, rule.dst, rule.sport, rule.dport, rule.rate, rule.filter_id)
+        
+
+    def _get_rules_from_formatted(self, frule, prefix):
+>>>>>>> MERGE-SOURCE
         '''Return list of iptables rules appropriate for sending'''
         snippets = []
 
@@ -558,7 +575,11 @@
                 if pat_tuple.match(line):
                     tuple = pat_tuple.sub('', line)
                     tmp = re.split(r'\s+', tuple.strip())
+<<<<<<< TREE
                     if len(tmp) < 6 or len(tmp) > 9:
+=======
+                    if len(tmp) != 8 and len(tmp) != 10:
+>>>>>>> MERGE-SOURCE
                         warn_msg = _("Skipping malformed tuple (bad length): %s") % (tuple)
                         warn(warn_msg)
                         continue
@@ -573,12 +594,24 @@
                             else:
                                 type = tmp[-1]
                         try:
+<<<<<<< TREE
                             if len(tmp) < 8:
+=======
+                            if len(tmp) == 8:
+>>>>>>> MERGE-SOURCE
                                 rule = UFWRule(tmp[0], tmp[1], tmp[2], tmp[3],
+<<<<<<< TREE
                                                tmp[4], tmp[5], type)
+=======
+                                               tmp[4], tmp[5], tmp[6], tmp[7])
+>>>>>>> MERGE-SOURCE
                             else:
                                 rule = UFWRule(tmp[0], tmp[1], tmp[2], tmp[3],
+<<<<<<< TREE
                                                tmp[4], tmp[5], type)
+=======
+                                               tmp[4], tmp[5], tmp[8], tmp[9])
+>>>>>>> MERGE-SOURCE
                                 # Removed leading [sd]app_ and unescape spaces
                                 pat_space = re.compile('%20')
                                 if tmp[6] != "-":
@@ -662,6 +695,7 @@
                 action += "_" + r.logtype
 
             if r.dapp == "" and r.sapp == "":
+<<<<<<< TREE
                 tstr = "\n### tuple ### %s %s %s %s %s %s %s" % \
                      (action, r.protocol, r.dport, r.dst, r.sport, r.src, \
                       r.direction)
@@ -670,6 +704,10 @@
                 if r.interface_out != "":
                     tstr += "_%s" % (r.interface_out)
                 ufw.util.write_to_file(fd, tstr + "\n")
+=======
+                os.write(fd, "\n### tuple ### %s %s %s %s %s %s %s %s\n" % \
+                     (r.action, r.protocol, r.dport, r.dst, r.sport, r.src, r.rate, r.filter_id))
+>>>>>>> MERGE-SOURCE
             else:
                 pat_space = re.compile(' ')
                 dapp = "-"
@@ -678,6 +716,7 @@
                 sapp = "-"
                 if r.sapp:
                     sapp = pat_space.sub('%20', r.sapp)
+<<<<<<< TREE
                 tstr = "\n### tuple ### %s %s %s %s %s %s %s %s %s" % \
                        (action, r.protocol, r.dport, r.dst, r.sport, r.src, \
                         dapp, sapp, r.direction)
@@ -697,6 +736,14 @@
             for s in self._get_rules_from_formatted(rule_str, chain_prefix, \
                                                     chain_suffix):
                 ufw.util.write_to_file(fd, s)
+=======
+                os.write(fd, "\n### tuple ### %s %s %s %s %s %s %s %s %s %s\n" \
+                     % (r.action, r.protocol, r.dport, r.dst, r.sport, r.src, \
+                      dapp, sapp, r.rate, r.filter_id))
+
+            for s in self._get_rules_from_formatted(rule_str, chain_prefix):
+                os.write(fd, s)
+>>>>>>> MERGE-SOURCE
 
         # Write footer
         ufw.util.write_to_file(fd, "\n### END RULES ###\n")
@@ -825,9 +872,17 @@
                 # skip it.
                 found = True
                 if not rule.remove:
+<<<<<<< TREE
                     newrules.append(rule.dup_rule())
             elif ret < 0 and not rule.remove and not inserted:
                 # If only the action is different, replace the rule if it's not
+=======
+                    newrules.append(rule)
+                else:
+                    rule.filter_id = r.filter_id
+            elif ret < 0 and not rule.remove:
+                # If only the action or the rate is different, replace the rule if it's not
+>>>>>>> MERGE-SOURCE
                 # to be removed.
                 found = True
                 modified = True
@@ -932,13 +987,39 @@
                         msg(out, sys.stderr)
                         UFWError(err_msg)
 
+<<<<<<< TREE
                     # delete any lingering RETURN rules (needed for upgrades)
                     if flag == "-A" and pat_log.search(" ".join(s)):
                         c = pat_log.sub(r'\2', " ".join(s))
                         (rc, out) = cmd([exe, '-D', c, '-j', 'RETURN'])
+=======
+                    # add/remove the TC filter if needed
+                    if rule.rate != "unlimited": 
+                        if not rule.remove:
+                            add_filter(rule.src, rule.dst, rule.sport, rule.dport, rule.rate, rule.filter_id)
+                        else:
+                            delete_filter(rule.src, rule.dst, rule.sport, rule.dport, rule.filter_id)
+
+                    # delete the RETURN rule then add it back, so it is at the
+                    # end
+                    if flag == "-A":
+                        (rc, out) = cmd([exe, '-D', chain, '-j', 'RETURN'])
+>>>>>>> MERGE-SOURCE
                         if rc != 0:
                             debug("FAILOK: -D %s -j RETURN" % (c))
 
+<<<<<<< TREE
+=======
+                        (rc, out) = cmd([exe, '-A', chain, '-j', 'RETURN'])
+                        if rc != 0:
+                            msg(out, sys.stderr)
+
+            else:
+                # the rule has been updated: remove the old filter (an error occurs if there was none) and add the new one (if it exists)
+                delete_filter(rule.src, rule.dst, rule.sport, rule.dport, rule.filter_id)
+                if rule.rate != "unlimited":
+                    add_filter(rule.src, rule.dst, rule.sport, rule.dport, rule.rate, rule.filter_id)
+>>>>>>> MERGE-SOURCE
         return rstr
 
     def get_app_rules_from_system(self, template, v6):
 
=== modified file 'src/common.py'
--- src/common.py	2009-08-26 20:18:30 +0000
+++ src/common.py	2009-12-09 23:28:13 +0000
@@ -40,7 +40,11 @@
 class UFWRule:
     '''This class represents firewall rules'''
     def __init__(self, action, protocol, dport="any", dst="0.0.0.0/0",
+<<<<<<< TREE
                  sport="any", src="0.0.0.0/0", direction="in"):
+=======
+                 sport="any", src="0.0.0.0/0", rate="unlimited", filter_id="0"):
+>>>>>>> MERGE-SOURCE
         # Be sure to update dup_rule accordingly...
         self.remove = False
         self.updated = False
@@ -54,10 +58,15 @@
         self.dapp = ""
         self.sapp = ""
         self.action = ""
+<<<<<<< TREE
         self.position = 0
         self.logtype = ""
         self.interface_in = ""
         self.interface_out = ""
+=======
+	self.rate =""
+	self.filter_id =""
+>>>>>>> MERGE-SOURCE
         try:
             self.set_action(action)
             self.set_protocol(protocol)
@@ -65,7 +74,12 @@
             self.set_port(sport, "src")
             self.set_src(src)
             self.set_dst(dst)
+<<<<<<< TREE
             self.set_direction(direction)
+=======
+            self.set_rate(rate)
+            self.set_filter_id(filter_id)
+>>>>>>> MERGE-SOURCE
         except UFWError:
             raise
 
@@ -85,11 +99,16 @@
         rule.multi = self.multi
         rule.dapp = self.dapp
         rule.sapp = self.sapp
+<<<<<<< TREE
         rule.position = self.position
         rule.logtype = self.logtype
         rule.interface_in = self.interface_in
         rule.interface_out = self.interface_out
         rule.direction = self.direction
+=======
+        rule.rate = self.rate
+        rule.filter_id = self.filter_id
+>>>>>>> MERGE-SOURCE
 
         return rule
 
@@ -278,6 +297,7 @@
         self.dst = tmp
         self._fix_anywhere()
 
+<<<<<<< TREE
     def set_interface(self, type, name):
         '''Sets an interface for rule'''
         if type != "in" and type != "out":
@@ -321,6 +341,18 @@
             err_msg = _("Unsupported direction '%s'") % (direction)
             raise UFWError(err_msg)
 
+=======
+    def set_rate(self, rate):
+        '''Sets rate for the rule'''
+        self.rate = rate
+        self._fix_anywhere()
+
+    def set_filter_id(self, filter_id):
+        '''Sets the if of the filter associated to the rule'''
+        self.filter_id = filter_id
+        self._fix_anywhere()
+
+>>>>>>> MERGE-SOURCE
     def normalize(self):
         '''Normalize src and dst to standard form'''
         changed = False
@@ -391,6 +423,7 @@
         if x.sapp != y.sapp:
             debug(dbg_msg)
             return 1
+<<<<<<< TREE
         if x.interface_in != y.interface_in:
             return 1
         if x.interface_out != y.interface_out:
@@ -398,13 +431,20 @@
         if x.direction != y.direction:
             return 1
         if x.action == y.action and x.logtype == y.logtype:
+=======
+        if x.action == y.action and x.rate == y.rate:
+>>>>>>> MERGE-SOURCE
             dbg_msg = _("Found exact match")
             debug(dbg_msg)
             return 0
+<<<<<<< TREE
         dbg_msg = _("Found non-action/non-logtype match " \
                     "(%(xa)s/%(ya)s %(xl)s/%(yl)s)") % \
                     ({'xa': x.action, 'ya': y.action, \
                       'xl': x.logtype, 'yl': y.logtype})
+=======
+        dbg_msg = _("Found non-action or non-rate match")
+>>>>>>> MERGE-SOURCE
         debug(dbg_msg)
         return -1
 
 
=== modified file 'src/frontend.py'
--- src/frontend.py	2009-09-21 14:33:28 +0000
+++ src/frontend.py	2009-12-09 23:28:13 +0000
@@ -25,6 +25,7 @@
 import ufw.util
 from ufw.util import error, warn
 from ufw.backend_iptables import UFWBackendIptables
+from ufw.tc_functions import get_next_filter_id
 
 def allowed_command(cmd):
     '''Return command if it is allowed, otherwise raise an exception'''
@@ -204,6 +205,7 @@
                                   direction=rule_direction)
         if remove:
             rule.remove = remove
+<<<<<<< TREE
         elif insert_pos != "":
             try:
                 rule.set_position(insert_pos)
@@ -211,6 +213,10 @@
                 raise
         if nargs == 3:
             # Short form where only app or port/proto is given
+=======
+        if nargs == 3 or nargs == 5:
+            # Short form where only app + rate? or port/proto + rate? is given
+>>>>>>> MERGE-SOURCE
             if ufw.applications.valid_profile_name(argv[2]):
                 # Check if name collision with /etc/services. If so, use
                 # /etc/services instead of application profile
@@ -233,9 +239,21 @@
                         raise UFWError(err_msg)
                     to_service = port
 
+                if nargs == 5 and argv[3] == "rate" and action == "allow":
+                    if not re.match('^\d([0-9]*\d+)*$', argv[4]):
+                        err_msg = ("Rates must be numeric")
+                        raise UFWError(err_msg)
+                    rate = argv[4]
+                    filter_id = "undefined"
+                else:
+                    rate = "unlimited"
+                    filter_id = "0"
+
                 try:
                     rule.set_protocol(proto)
                     rule.set_port(port, "dst")
+                    rule.set_rate(rate)
+                    rule.set_filter_id(filter_id)
                     type = "both"
                 except UFWError:
                     err_msg = _("Bad port")
@@ -249,7 +267,11 @@
             raise UFWError(err_msg)
         else:
             # Full form with PF-style syntax
+<<<<<<< TREE
             keys = [ 'proto', 'from', 'to', 'port', 'app', 'in', 'out' ]
+=======
+            keys = [ 'proto', 'from', 'to', 'port', 'app', 'rate' ]
+>>>>>>> MERGE-SOURCE
 
             # quick check
             if argv.count("to") > 1 or \
@@ -259,7 +281,8 @@
                argv.count("in") > 1 or \
                argv.count("out") > 1 or \
                argv.count("app") > 2 or \
-               argv.count("app") > 0 and argv.count("proto") > 0:
+               argv.count("app") > 0 and argv.count("proto") > 0 or \
+               argv.count("rate") > 1:
                 err_msg = _("Improper rule syntax")
                 raise UFWError(err_msg)
 
@@ -269,7 +292,26 @@
                 if i % 2 == 0 and argv[i] not in keys:
                     err_msg = _("Invalid token '%s'") % (argv[i])
                     raise UFWError(err_msg)
-                if arg == "proto":
+                if arg == "rate":
+                    if i+1 < nargs:
+                        if action != "allow":
+                            err_msg = ("Rates can only be specified with the 'allow' action")
+                            raise UFWError(err_msg)
+                        try:
+                            rate = argv[i+1]
+                            if not re.match('^\d([0-9]*\d+)*$', rate):
+                                err_msg = _("Rates must be numeric")
+                                raise UFWError(err_msg)
+
+                            rule.set_rate(rate)
+                            filter_id = "undefined"
+                            rule.set_filter_id(filter_id)
+                        except Exception:
+                            raise
+                    else:
+                        err_msg = ("Invalid 'rate' clause")
+                        raise UFWError(err_msg)
+                elif arg == "proto":
                     if i+1 < nargs:
                         try:
                             rule.set_protocol(argv[i+1])
@@ -900,6 +942,7 @@
                     tmp = self.backend.find_application_name(rule.sapp)
                     if tmp != rule.sapp:
                         rule.sapp = tmp
+<<<<<<< TREE
                         rule.set_port(tmp, "dst")
                 except UFWError, e:
                     # allow for the profile being deleted (LP: #407810)
@@ -909,6 +952,13 @@
                         err_msg = _("Invalid profile name")
                         raise UFWError(err_msg)
 
+=======
+                        rule.set_port(tmp, "src")
+                if not rule.remove and rule.rate != "undefined":
+                    rule.filter_id = get_next_filter_id(self.backend.rules)
+            except UFWError, e:
+                error(e.value)
+>>>>>>> MERGE-SOURCE
             res = self.set_rule(rule, ip_version)
         else:
             err_msg = _("Unsupported action '%s'") % (action)
 
=== added file 'src/tc_functions.py'
--- src/tc_functions.py	1970-01-01 00:00:00 +0000
+++ src/tc_functions.py	2009-12-09 23:28:13 +0000
@@ -0,0 +1,150 @@
+#
+# tc_functions.py: tc related functions for ufw
+#
+# Copyright (C) 2008-2009 Canonical Ltd.
+#
+#    This program is free software: you can redistribute it and/or modify
+#    it under the terms of the GNU General Public License version 3,
+#    as published by the Free Software Foundation.
+#
+#    This program is distributed in the hope that it will be useful,
+#    but WITHOUT ANY WARRANTY; without even the implied warranty of
+#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#    GNU General Public License for more details.
+#
+#    You should have received a copy of the GNU General Public License
+#    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#
+
+import os
+import re
+import sys
+import subprocess
+
+from ufw.common import UFWError, UFWRule, config_dir, state_dir, prefix_dir
+from ufw.util import warn, debug, msg, cmd, cmd_pipe
+
+def get_interface_list():
+    '''Get a list of all the available network interfaces'''
+    list = [] 
+
+    sp1 = subprocess.Popen("/sbin/ifconfig", stdout=subprocess.PIPE)
+    sp2 = subprocess.Popen(["cut", '-d ', "-f1"], stdin=sp1.stdout,  stdout=subprocess.PIPE)
+    sp3 = subprocess.Popen(["sort", '-u'], stdin=sp2.stdout,  stdout=subprocess.PIPE)
+    sp4 = subprocess.Popen(["grep", '-v', "^$"], stdin=sp3.stdout,  stdout=subprocess.PIPE)
+    sp5 = subprocess.Popen("xargs", stdin=sp4.stdout,  stdout=subprocess.PIPE)
+
+    out = sp5.communicate()[0]
+
+    list = out.split()
+
+    return list
+
+
+def is_local_ip_address(addr):
+    '''Checks whether the given IP address is a local IP addresse'''
+    sp1 = subprocess.Popen("/sbin/ifconfig", stdout=subprocess.PIPE)
+    sp2 = subprocess.Popen(["grep", addr], stdin=sp1.stdout, stdout=subprocess.PIPE)
+    sp3 = subprocess.Popen(["grep", "-ci", "inet"], stdin=sp2.stdout, stdout=subprocess.PIPE)
+
+    out = sp3.communicate()[0]
+
+    return int(out)
+
+
+def add_filter(src, dst, sport, dport, rate, filter_id):
+    interface_list = get_interface_list()
+
+    # if src and/or dst are IP addresses (instead of network addresses, add the all 1s netmask
+    if not re.match(r'.*/.*', src):
+        tc_src = src + "/32"
+    else:
+        tc_src = src
+    if not re.match(r'.*/.*', dst):
+        tc_dst = dst + "/32"
+    else:
+        tc_dst = dst
+
+
+    # build the u32 filter 
+    u32_match="match ip src " + tc_src + " match ip dst " + tc_dst
+    if sport != "any":
+        u32_match = u32_match + " match ip sport " + sport + " 0xffff"
+    if dport != "any":
+        u32_match = u32_match + " match ip dport " + dport + " 0xffff"
+
+    # add the filter to the proper qdiscs (ingress or egress)
+    if is_local_ip_address(src):
+        #msg("add to egress qdisc: "+tc_src+" "+tc_dst+" "+sport+" "+dport+" "+rate)
+        for i in interface_list:
+            command = ["/sbin/tc", "filter", "add", "dev", i, "parent", "1:", "protocol", "ip", "prio", "1", "handle", "::"+str(filter_id), "u32", u32_match, "police", "rate", rate + "kbit", "burst", "100kbit", "drop", "flowid", ':1']
+            command = ' '.join(command)
+            command = command.split(' ')
+            cmd(command)
+    else:
+
+        #msg("add to ingress qdisc: "+tc_src+" "+tc_dst+" "+sport+" "+dport+" "+rate)
+        for i in interface_list:
+            command=["/sbin/tc", "filter", "add", "dev", i, "parent", "ffff:", "protocol", "ip", "prio", "1", "handle", "::"+str(filter_id), "u32", u32_match, "police", "rate", rate + "kbit", "burst", "100kbit", "drop", "flowid", ':1']
+            command = ' '.join(command)
+            command = command.split(' ')
+            cmd(command)
+
+
+def delete_filter(src, dst, sport, dport, filter_id):
+    interface_list = get_interface_list()
+
+    # if src and/or dst are IP addresses (instead of network addresses, add the all 1s netmask
+    if not re.match(r'.*/.*', src):
+        tc_src = src + "/32"
+    else:
+        tc_src = src
+    if not re.match(r'.*/.*', dst):
+        tc_dst = dst + "/32"
+    else:
+        tc_dst = dst
+
+    # remove the filter from the proper qdiscs (ingres or egress)
+    if is_local_ip_address(src):
+        #msg("delete from egress qdisc: "+tc_src+" "+tc_dst+" "+sport+" "+dport)
+        for i in interface_list:
+            command=["/sbin/tc", "filter", "del", "dev", i, "parent", "1:", "protocol", "ip", "prio", "1", "handle", "::"+str(filter_id), "u32"]
+            command = ' '.join(command)
+            command = command.split(' ')
+            cmd(command)
+    else:
+        #msg("delete from ingress qdisc: "+tc_src+" "+tc_dst+" "+sport+" "+dport)
+        for i in interface_list:
+            command=["/sbin/tc", "filter", "del", "dev", i, "parent", "ffff:", "protocol", "ip", "prio", "1", "handle", "800::"+str(filter_id), "u32"]
+            command = ' '.join(command)
+            command = command.split(' ')
+            cmd(command)
+
+
+def get_next_filter_id(rules):
+    id_list = []
+    for r in rules:
+        id_list.append(r.filter_id)
+
+    id_list.sort()
+
+    idx = 1
+    for id in id_list:
+        if(int(id) != idx):
+            return idx
+        idx = idx + 1
+
+    return idx
+
+def my_main():
+    msg("hello")
+    list = get_interface_list()
+    msg("Found interfaces : %s" % list)
+
+    if is_local_ip_address("127.0.0.1"):
+        msg("OK")
+    else:
+        msg("KO")
+    
+
+
 
=== modified file 'src/ufw-init-functions'
--- src/ufw-init-functions	2009-08-24 15:09:18 +0000
+++ src/ufw-init-functions	2009-12-09 23:28:13 +0000
@@ -122,6 +122,18 @@
             flush_builtins
         fi
 
+
+        interface_list=`/sbin/ifconfig | cut -d' ' -f 1 | sort -u | grep -v "^$" | xargs` 
+
+        for i in $interface_list
+        do
+            # create incoming qdiscs
+            /sbin/tc qdisc add dev $i handle ffff: ingress
+            /sbin/tc qdisc add dev $i parent root handle 1: prio bands 3
+        done
+
+
+
         execs="iptables"
 
         # IPv6 setup
@@ -347,6 +359,17 @@
         return 0
     fi
 
+
+    interface_list=`/sbin/ifconfig | cut -d' ' -f 1 | sort -u | grep -v "^$" | xargs`
+
+    for i in $interface_list
+    do
+        # delete incoming qdiscs
+        /sbin/tc qdisc del dev $i ingress
+        /sbin/tc qdisc del dev $i parent root
+    done   
+
+
     error=""
     execs="iptables"
     if ip6tables -L INPUT -n >/dev/null 2>&1; then