contrib/package/meshwizard/files/usr/bin/meshwizard/helpers/setup_firewall_interface.sh

   1 #!/bin/sh
   2 # This will add $net to the zone firewall (and remove it from other zones where it is referenced)
   3 # It will also setup rules defined in /etc/config/freifunk and /etc/config/profile_<community>
   4 # Arg $1 = $net
   5
   6 net=$1
   7 . /lib/functions.sh
   8 . $dir/functions.sh
   9 config_load firewall
  10
  11 # Get some variables
  12 type="$(uci -q get wireless.$net.type)"
  13 vap="$(uci -q get meshwizard.netconfig.$net\_vap)"
  14 wan_is_olsr=$(uci -q get meshwizard.netconfig.wan_config)
  15
  16 # Delete old firewall zone for freifunk
  17 handle_fwzone() {
  18         config_get name "$1" name
  19         config_get network "$1" network
  20
  21         if [ "$2" == "zoneconf" ]; then
  22                 if [ "$name" == "freifunk" ]; then
  23                         # rename section if unnamed
  24                         if [ -z "${1/cfg[0-9a-fA-F]*/}" ]; then
  25                                 section_rename firewall $1 zone_freifunk
  26                         fi
  27                 else
  28                         if [ ! "$name" == "freifunk" ] && [ -n "$netrenamed" -a -n "$(echo $network | grep $netrenamed)" ]; then
  29                                 echo "    Removed $netrenamed from firewall zone $name."
  30                                 network_new=$(echo $network | sed -e 's/'$netrenamed'//' -e 's/^ //' -e 's/  / /' -e 's/ $//')
  31                                 uci set firewall.$1.network="$network_new"
  32                         fi
  33                 fi
  34         fi
  35 }
  36
  37 config_foreach handle_fwzone zone zoneconf
  38
  39 # Add $netrenamed and if needed ${netrenamed}dhcp to the "freifunk" zone
  40 config_get network zone_freifunk network
  41
  42 # remove ${netrenamed}dhcp from networks list
  43 [ -n "$network" -a -n "$net" ] && network="${network/${netrenamed}dhcp/}"
  44 network=$(echo $network) # Removes leading and trailing whitespaces
  45
  46 [ -n "$netrenamed" ] && [ -z "$(echo $network | grep $netrenamed)" ] && network="$network $netrenamed"
  47
  48 # check if this hardware supports VAPs
  49 supports_vap="0"
  50 $dir/helpers/supports_vap.sh $net $type && supports_vap=1
  51
  52 if [ "$supports_vap" == "1" -a "$vap" == 1 ]; then
  53         [ -n "$netrenamed" ] && [ "$network" == "${network/${netrenamed}dhcp/}" ] && network="$network ${netrenamed}dhcp"
  54 fi
  55
  56 uci set firewall.zone_freifunk.network="$network"
  57
  58 uci_commitverbose "Add '$netrenamed' to freifunk firewall zone" firewall
  59
  60 currms=$(uci -q get firewall.zone_freifunk.masq_src)
  61
  62 # If interfaces are outside of the mesh network they should be natted
  63
  64 if [ "$vap" == 1 ]; then
  65         # Get dhcprange and meshnet for the dhcp interface
  66         if_ip="$(uci -q get network.${netrenamed}dhcp.ipaddr)"
  67         if_mask="$(uci -q get network.${netrenamed}dhcp.netmask)"
  68
  69         [ -n "$if_ip" -a "$if_mask" ] && export $(ipcalc.sh $if_ip $if_mask)
  70         [ -n "$NETWORK" -a "$PREFIX" ] && dhcprange="$NETWORK/$PREFIX"
  71
  72         if [ -n "$dhcprange" ]; then
  73                 meshnet="$(uci get profile_$community.profile.mesh_network)"
  74                 # check if the dhcprange is inside meshnet
  75                 dhcpinmesh="$($dir/helpers/check-range-in-range.sh $dhcprange $meshnet)"
  76                 if [ "$dhcpinmesh" == 1 ]; then
  77                         # needed or splash will not work
  78                         if [ "$has_luci_splash" == TRUE ]; then
  79                                 uci set firewall.zone_freifunk.contrack="1"
  80                         fi
  81                 else
  82                         uci set firewall.zone_freifunk.masq=1
  83                         [ -z "$(echo $currms |grep ${netrenamed}dhcp)" ] && uci add_list firewall.zone_freifunk.masq_src="${netrenamed}dhcp"
  84                 fi
  85         fi
  86 fi
  87
  88 # Get dhcprange and meshnet for the adhoc dhcp interface
  89 if_ip="$(uci -q get network.${netrenamed}ahdhcp.ipaddr)"
  90 if_mask="$(uci -q get network.${netrenamed}ahdhcp.netmask)"
  91
  92 [ -n "$if_ip" -a "$if_mask" ] && export $(ipcalc.sh $if_ip $if_mask)
  93 [ -n "$NETWORK" -a "$PREFIX" ] && dhcprangeah="$NETWORK/$PREFIX"
  94
  95 if [ -n "$dhcprangeah" ]; then
  96         meshnet="$(uci get profile_$community.profile.mesh_network)"
  97         # check if the dhcprange is inside meshnet
  98         dhcpinmesh="$($dir/helpers/check-range-in-range.sh $dhcprangeah $meshnet)"
  99         if [ "$dhcpinmesh" == 1 ]; then
 100                 # needed or splash will not work
 101                 if [ "$has_luci_splash" == TRUE ]; then
 102                         uci set firewall.zone_freifunk.contrack="1"
 103                 fi
 104         else
 105                 uci set firewall.zone_freifunk.masq=1
 106                 [ -z "$(echo $currms |grep ${netrenamed}ahdhcp)" ] && uci add_list firewall.zone_freifunk.masq_src="${netrenamed}ahdhcp"
 107         fi
 108 fi
 109
 110
 111 for i in IP NETMASK BROADCAST NETWORK PREFIX; do
 112         unset $i
 113 done
 114
 115 uci_commitverbose "Setup masquerading rules for '$netrenamed'" firewall