meshwizard: ipv6 fixes, fix uhttpd setup

[project/luci.git] / contrib / package / meshwizard / files / usr / bin / meshwizard / helpers / setup_firewall.sh

diff --git a/contrib/package/meshwizard/files/usr/bin/meshwizard/helpers/setup_firewall.sh b/contrib/package/meshwizard/files/usr/bin/meshwizard/helpers/setup_firewall.sh
index f5c4416..bf47241 100755 (executable)
--- a/contrib/package/meshwizard/files/usr/bin/meshwizard/helpers/setup_firewall.sh
+++ b/contrib/package/meshwizard/files/usr/bin/meshwizard/helpers/setup_firewall.sh
@@ -1,30 +1,20 @@
 #!/bin/sh
 # Add "freifunk" firewall zone
-# If wan is used for olsr then delete wan zone and all wan rules
+# If wan/lan is used for olsr then remove these networks from wan/lan zones
 # Also setup rules defined in /etc/config/freifunk and /etc/config/profile_<community>
 
-. /etc/functions.sh
+. /lib/functions.sh
 . $dir/functions.sh
 
 wan_is_olsr=$(uci -q get meshwizard.netconfig.wan_config)
+lan_is_olsr=$(uci -q get meshwizard.netconfig.lan_config)
 
 config_load firewall
 
-# Add local_restrict to wan firewall zone (if wan is not used for olsr)
-# If wan is used for olsr then remove the firewall zone wan
-handle_zonewan() {
-       config_get name "$1" name
-       if [ "$name" == "wan" ]; then
-               if  [ "$wan_is_olsr" == 1 ]; then
-                       uci del firewall.$1 && uci_commitverbose "WAN is used for olsr, delete firewall zone wan" firewall
-               else
-                       uci set firewall.$1.local_restrict=1 && uci_commitverbose "Enable local_restrict for zone wan" firewall
-               fi
-       fi
-}
-config_foreach handle_zonewan zone
+# Rename firewall zone for freifunk if unnamed
+# If wan is used for olsr then set network for the firewall zone wan to ' ' to remove the wan interface from it, else add local restrict to it
+# If lan is used for olsr then set network for the firewall zone lan to ' ' to remove the lan interface from it
 
-# Rename firewall zone for freifunk if unnamed and delete wan zone if it is used for olsr; else enable local restrict
 handle_fwzone() {
        config_get name "$1" name
        config_get network "$1" network
@@ -38,21 +28,25 @@ handle_fwzone() {
 
        if [ "$name" == "wan" ]; then
                if  [ "$wan_is_olsr" == 1 ]; then
-                       uci del firewall.$1 && uci_commitverbose "WAN is used for olsr, delete firewall zone wan" firewall
+                       uci set firewall.$1.network=' ' && uci_commitverbose "WAN is used for olsr, removed the wan interface from zone wan" firewall
                else
                        uci set firewall.$1.local_restrict=1 && uci_commitverbose "Enable local_restrict for zone wan" firewall
                fi
        fi
+
+       if [ "$name" == "lan" ] && [ "$lan_is_olsr" == 1 ]; then
+                       uci set firewall.$1.network=' ' && uci_commitverbose "LAN is used for olsr, removed the lan interface from zone lan" firewall
+       fi
 }
 
 config_foreach handle_fwzone zone
 
 uci batch << EOF
-set firewall.zone_freifunk="zone"
-set firewall.zone_freifunk.name="freifunk"
-set firewall.zone_freifunk.input="$zone_freifunk_input"
-set firewall.zone_freifunk.forward="$zone_freifunk_forward"
-set firewall.zone_freifunk.output="$zone_freifunk_output"
+       set firewall.zone_freifunk="zone"
+       set firewall.zone_freifunk.name="freifunk"
+       set firewall.zone_freifunk.input="$zone_freifunk_input"
+       set firewall.zone_freifunk.forward="$zone_freifunk_forward"
+       set firewall.zone_freifunk.output="$zone_freifunk_output"
 EOF
 
 uci_commitverbose "Setup firewall zones" firewall
@@ -80,7 +74,7 @@ if [ -n "$LANIP" ]; then
 fi
 
 currms=$(uci -q get firewall.zone_freifunk.masq_src)
-if [ ! "$no_masq_lan" == "1" ]; then
+if [ ! "$no_masq_lan" == "1" ] && [ ! "$(uci -q get meshwizard.netconfig.lan_config)" == 1 ]; then
        uci set firewall.zone_freifunk.masq="1"
        [ -z "$(echo $currms |grep lan)" ] && uci add_list firewall.zone_freifunk.masq_src="lan"
 fi
@@ -103,22 +97,43 @@ for config in freifunk profile_$community; do
                config_foreach handle_firewall $section
        done
 done
-uci_commitverbose "Setup rules, forwardings, advanced config and includes." firewall
 
-# If wan is used for olsr we need to cleanup old wan (forward) rules
+# If we use auto-ipv6-dhcp then allow 547/udp on the freifunk zone
+if [ "$ipv6_config" = "auto-ipv6-dhcpv6" ]; then
+       uci batch <<- EOF
+               set firewall.dhcpv6=rule
+               set firewall.dhcpv6.src=freifunk
+               set firewall.dhcpv6.target=ACCEPT
+               set firewall.dhcpv6.dest_port=547
+               set firewall.dhcpv6.proto=udp
+       EOF
+fi
 
-if  [ "$wan_is_olsr" == 1 ]; then
-       handle_wanrules() {
-       config_get src "$1" src
-               config_get dest "$1" dest
-               if [ "$src" == "wan" ] || [ "$dest" == "wan" ]; then
-                       uci del firewall.$1
-               fi
-       }
-       for i in rule forwarding; do
-               config_load firewall
-               config_foreach handle_wanrules $i
-       done
-       uci_commitverbose "Wan is used for olsr, delete wan firewall rules and forwardings" firewall
+# Firewall rules to allow incoming ssh and web if enabled
+
+if [ "$wan_allowssh" == 1 ]; then
+       uci batch <<- EOF
+               set firewall.wanssh=rule
+               set firewall.wanssh.src=wan
+               set firewall.wanssh.target=ACCEPT
+               set firewall.wanssh.proto=tcp
+               set firewall.wanssh.dest_port=22
+       EOF
+fi
+
+if [ "$wan_allowweb" == 1 ]; then
+       uci batch <<- EOF
+               set firewall.wanweb=rule
+               set firewall.wanweb.src=wan
+               set firewall.wanweb.target=ACCEPT
+               set firewall.wanweb.proto=tcp
+               set firewall.wanweb.dest_port=80
+               set firewall.wanwebhttps=rule
+               set firewall.wanwebhttps.src=wan
+               set firewall.wanwebhttps.target=ACCEPT
+               set firewall.wanwebhttps.proto=tcp
+               set firewall.wanwebhttps.dest_port=443
+       EOF
 fi
 
+uci_commitverbose "Setup rules, forwardings, advanced config and includes." firewall