add changes that were missing in the last commit

[project/luci.git] / contrib / package / meshwizard / files / usr / bin / meshwizard / helpers / setup_firewall.sh

diff --git a/contrib/package/meshwizard/files/usr/bin/meshwizard/helpers/setup_firewall.sh b/contrib/package/meshwizard/files/usr/bin/meshwizard/helpers/setup_firewall.sh
index 33ff9a2..5265945 100755 (executable)
--- a/contrib/package/meshwizard/files/usr/bin/meshwizard/helpers/setup_firewall.sh
+++ b/contrib/package/meshwizard/files/usr/bin/meshwizard/helpers/setup_firewall.sh
@@ -80,26 +80,33 @@ if [ ! "$no_masq_lan" == "1" ] && [ ! "$(uci -q get meshwizard.netconfig.lan_con
 fi
 
 
-# Rules, Forwardings, advanced config and includes
-
-for config in freifunk profile_$community; do
-
-       config_load $config
+# Rules, Forwardings, advanced config and includes from freifunk and
+# profile_$community config files.
+
+add_fw_rules() {
+    config_cb() {
+       local type="$1"
+       local name="$2"
+       local allowed_section_types="advanced include fw_rule fw_forwarding"
+       if is_in_list "$allowed_section_types" $type ; then
+           uci set firewall.${name}="${type/fw_/}"
+           option_cb() {
+               local option="$1"
+               local value="$2"
+               uci set firewall.${CONFIG_SECTION}.${option}="$value"
+           }
+       else
+           option_cb() { return; }
+       fi
+    }
+    config_load freifunk
+    config_load profile_${community}
+}
+add_fw_rules
 
-       for section in advanced include fw_rule fw_forwarding; do
-               handle_firewall() {
-                       local options=$(uci show $config."$1")
-                       options=$(echo "$options" | sed -e "s/fw_//g" -e "s/^$config/firewall/g")
-                       for o in $options; do
-                               uci set $o
-                       done
-               }
-               config_foreach handle_firewall $section
-       done
-done
 
 # If we use auto-ipv6-dhcp then allow 547/udp on the freifunk zone
-if [ "$profile_ipv6_config" = "auto-ipv6-dhcpv6" ]; then
+if [ "$ipv6_config" = "auto-ipv6-dhcpv6" ]; then
        uci batch <<- EOF
                set firewall.dhcpv6=rule
                set firewall.dhcpv6.src=freifunk
@@ -109,4 +116,31 @@ if [ "$profile_ipv6_config" = "auto-ipv6-dhcpv6" ]; then
        EOF
 fi
 
+# Firewall rules to allow incoming ssh and web if enabled
+
+if [ "$wan_allowssh" == 1 ]; then
+       uci batch <<- EOF
+               set firewall.wanssh=rule
+               set firewall.wanssh.src=wan
+               set firewall.wanssh.target=ACCEPT
+               set firewall.wanssh.proto=tcp
+               set firewall.wanssh.dest_port=22
+       EOF
+fi
+
+if [ "$wan_allowweb" == 1 ]; then
+       uci batch <<- EOF
+               set firewall.wanweb=rule
+               set firewall.wanweb.src=wan
+               set firewall.wanweb.target=ACCEPT
+               set firewall.wanweb.proto=tcp
+               set firewall.wanweb.dest_port=80
+               set firewall.wanwebhttps=rule
+               set firewall.wanwebhttps.src=wan
+               set firewall.wanwebhttps.target=ACCEPT
+               set firewall.wanwebhttps.proto=tcp
+               set firewall.wanwebhttps.dest_port=443
+       EOF
+fi
+
 uci_commitverbose "Setup rules, forwardings, advanced config and includes." firewall