if 判断中的作用

jun821

#!/bin/bash
#this is a common firewall created by 2007-7-29

#define some variable
IPT=/sbin/iptables
CONNECTION_TRACKING="1"
INTERNET="eth0"
CLASS_A="10.0.0.0/8"
CLASS_B="172.16.0.0/12"
CLASS_C="192.168.0.0/16"
CLASS_D_MULTICAST="224.0.0.0/4"
CLASS_E_RESERVED_NET="240.0.0.0/5"
BROADCAST_SRC="0.0.0.0"
BROADCAST_DEST="255.255.255.255"
IPADDR=61.135.55.100
LOOPBACK_INTERFACE="lo"

#Remove any existing rules
$IPT -F
$IPT -X

#setting default firewall policy
$IPT --policy OUTPUT ACCEPT
$IPT --policy FORWARD DROP
$IPT -P INPUT DROP

#stop firewall
if [ "$1" = "stop" ]
then
echo "Filewall completely stopped!no firewall running!"
exit 0
fi

#setting for loopback interface
$IPT -A INPUT -i lo -j ACCEPT
$IPT -A OUTPUT -o lo -j ACCEPT

# Stealth Scans and TCP State Flags
# All of the bits are cleared
$IPT -A INPUT -p tcp --tcp-flags ALL NONE -j DROP
# SYN and FIN are both set
$IPT -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
# SYN and RST are both set
$IPT -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
# FIN and RST are both set
$IPT -A INPUT -p tcp --tcp-flags FIN,RST FIN,RST -j DROP
# FIN is the only bit set, without the expected accompanying ACK
$IPT -A INPUT -p tcp --tcp-flags ACK,FIN FIN -j DROP
# PSH is the only bit set, without the expected accompanying ACK
$IPT -A INPUT -p tcp --tcp-flags ACK,PSH PSH -j DROP
# URG is the only bit set, without the expected accompanying ACK
$IPT -A INPUT -p tcp --tcp-flags ACK,URG URG -j DROP

# Using Connection State to By-pass Rule Checking
if [ "$CONNECTION_TRACKING" = "1" ]; then
$IPT -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A INPUT -m state --state INVALID -j DROP
$IPT -A OUTPUT -m state --state INVALID -j DROP
fi

最近刚开始学习shell，不知道为什么，我发现if [ "$CONNECTION_TRACKING" = "1" ]这个语句中，$CONNECTION_TRACKING这个变量无论=1或=0,下面的语句都会执行，这应该不对吧，如果真这样了，就没有意思了，谢谢大家的指导！

blackold

应该不会。

ywlscpl

真是这样shell就没意思了

jun821

就是了，我也应该觉得是这样的，但是结果让我想不通，也不知道是不是哪里错了

haimming

1. 
   
2. [rockfall@~]$CONNECTION_TRACKING="1"
   
3. [rockfall@~]$if [ "$CONNECTION_TRACKING" = "1" ]; then echo 1;else echo 0;fi
   
4. 1
   
5. [rockfall@~]$CONNECTION_TRACKING="0"
   
6. [rockfall@~]$if [ "$CONNECTION_TRACKING" = "1" ]; then echo 1;else echo 0;fi
   
7. 0
   

复制代码

jun821

那如果是这样的了
[rockfall@~]$CONNECTION_TRACKING="1"
$if [ "$CONNECTION_TRACKING" = "0" ]

这样会怎么样

ywlscpl

楼主难道对1+1=2这样的数学题都要质疑？
man  test

1.   STRING1 = STRING2
   
2.               the strings are equal

复制代码

haimming

不明白就试试,现在的电脑还不会骗你

1. 
   
2. [rockfall@~]$CONNECTION_TRACKING="1"[rockfall@~]$if [ "$CONNECTION_TRACKING" = "0" ]; then echo 1;else echo 0;fi
   
3. 0
   
4. 
   

复制代码

jun821

原帖由 ywlscpl 于 2009-6-19 21:02 发表
楼主难道对1+1=2这样的数学题都要质疑？
man  test
  STRING1 = STRING2
              the strings are equal

大脑有点转不动，多多包涵

jun821

那我就是不明白了为什么我把$CONNECTION_TRACKING= "1"定义为真
在判断的时候if [ "$CONNECTION_TRACKING" = "0" ]为假还是会执行前面的语句，如果一般的话，为真才是前面，为假就是后面，这样是为假的，为什么还是执行前面的？
例：
         $CONNECTION_TRACKING= "1"
       if [ "$CONNECTION_TRACKING" = "0" ]; then
    $IPT -P INPUT DROP
     $IPT -P OUTPUT DROP
     $IPT -P FORWARD DROP
  else
     $IPT -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
fi