-#!/bin/sh
+#!/bin/sh
# Copyright (C) 2008 John Crispin <blogic@openwrt.org>
. /etc/functions.sh
config fw_zones
ZONE_LIST=$CONFIG_SECTION
+ZONE_NAMES=
CUSTOM_CHAINS=1
DEF_INPUT=DROP
CONNTRACK_ZONES=
NOTRACK_DISABLED=
+add_state() {
+ local var="$1"
+ local item="$2"
+
+ local val="$(uci_get_state firewall core $var)"
+ uci_set_state firewall core $var "${val:+$val }$item"
+}
+
+del_state() {
+ local var="$1"
+ local item="$2"
+
+ local val=" $(uci_get_state firewall core $var) "
+ val="${val// $item / }"
+ val="${val# }"
+ val="${val% }"
+ uci_set_state firewall core $var "$val"
+}
+
find_item() {
local item="$1"; shift
for i in "$@"; do
return 1
}
+get_portrange() {
+ local _var="$1"
+ local _range="$2"
+ local _delim="${3:-:}"
+
+ local _min="${_range%%[:-]*}"
+ local _max="${_range##*[:-]}"
+
+ [ -n "$_min" ] && [ -n "$_max" ] && [ "$_min" != "$_max" ] && \
+ export -n -- "$_var=$_min$_delim$_max" || \
+ export -n -- "$_var=${_min:-$_max}"
+}
+
load_policy() {
config_get input $1 input
config_get output $1 output
}
create_zone() {
+ local name="$1"
+ local network="$2"
+ local input="$3"
+ local output="$4"
+ local forward="$5"
+ local mtu_fix="$6"
+ local masq="$7"
+ local masq_src="$8"
+ local masq_dest="$9"
+
local exists
-
- [ "$1" == "loopback" ] && return
- config_get exists $ZONE_LIST $1
+ [ "$name" == "loopback" ] && return
+
+ config_get exists $ZONE_LIST $name
[ -n "$exists" ] && return
- config_set $ZONE_LIST $1 1
-
- $IPTABLES -N zone_$1
- $IPTABLES -N zone_$1_MSSFIX
- $IPTABLES -N zone_$1_ACCEPT
- $IPTABLES -N zone_$1_DROP
- $IPTABLES -N zone_$1_REJECT
- $IPTABLES -N zone_$1_forward
- [ "$5" ] && $IPTABLES -A zone_$1_forward -j zone_$1_$5
- [ "$3" ] && $IPTABLES -A zone_$1 -j zone_$1_$3
- [ "$4" ] && $IPTABLES -A output -j zone_$1_$4
- $IPTABLES -N zone_$1_nat -t nat
- $IPTABLES -N zone_$1_prerouting -t nat
- $IPTABLES -t raw -N zone_$1_notrack
- [ "$6" == "1" ] && $IPTABLES -t nat -A POSTROUTING -j zone_$1_nat
- [ "$7" == "1" ] && $IPTABLES -I FORWARD 1 -j zone_$1_MSSFIX
+ config_set $ZONE_LIST $name 1
+
+ $IPTABLES -N zone_${name}
+ $IPTABLES -N zone_${name}_MSSFIX
+ $IPTABLES -N zone_${name}_ACCEPT
+ $IPTABLES -N zone_${name}_DROP
+ $IPTABLES -N zone_${name}_REJECT
+ $IPTABLES -N zone_${name}_forward
+ [ "$output" ] && $IPTABLES -A output -j zone_${name}_${output}
+ $IPTABLES -N zone_${name}_nat -t nat
+ $IPTABLES -N zone_${name}_prerouting -t nat
+ $IPTABLES -t raw -N zone_${name}_notrack
+ [ "$mtu_fix" == "1" ] && $IPTABLES -I FORWARD 1 -j zone_${name}_MSSFIX
+
+ if [ "$masq" == "1" ]; then
+ local msrc mdst
+ for msrc in ${masq_src:-0.0.0.0/0}; do
+ [ "${msrc#!}" != "$msrc" ] && msrc="! -s ${msrc#!}" || msrc="-s $msrc"
+ for mdst in ${masq_dest:-0.0.0.0/0}; do
+ [ "${mdst#!}" != "$mdst" ] && mdst="! -d ${mdst#!}" || mdst="-d $mdst"
+ $IPTABLES -A zone_${name}_nat -t nat $msrc $mdst -j MASQUERADE
+ done
+ done
+ fi
+
+ append ZONE_NAMES "$name"
}
+
addif() {
local network="$1"
local ifname="$2"
$IPTABLES -I zone_${zone}_ACCEPT 1 -i "$ifname" -j ACCEPT
$IPTABLES -I zone_${zone}_DROP 1 -i "$ifname" -j DROP
$IPTABLES -I zone_${zone}_REJECT 1 -i "$ifname" -j reject
- $IPTABLES -I zone_${zone}_nat 1 -t nat -o "$ifname" -j MASQUERADE
- $IPTABLES -I PREROUTING 1 -t nat -i "$ifname" -j zone_${zone}_prerouting
+
+ $IPTABLES -I PREROUTING 1 -t nat -i "$ifname" -j zone_${zone}_prerouting
+ $IPTABLES -I POSTROUTING 1 -t nat -o "$ifname" -j zone_${zone}_nat
$IPTABLES -A forward -i "$ifname" -j zone_${zone}_forward
- $IPTABLES -t raw -I PREROUTING 1 -i "$ifname" -j zone_${zone}_notrack
+ $IPTABLES -I PREROUTING 1 -t raw -i "$ifname" -j zone_${zone}_notrack
+
uci_set_state firewall core "${network}_ifname" "$ifname"
uci_set_state firewall core "${network}_zone" "$zone"
+
+ add_state "${zone}_networks" "$network"
+
ACTION=add ZONE="$zone" INTERFACE="$network" DEVICE="$ifname" /sbin/hotplug-call firewall
}
$IPTABLES -D zone_${zone}_ACCEPT -i "$ifname" -j ACCEPT
$IPTABLES -D zone_${zone}_DROP -i "$ifname" -j DROP
$IPTABLES -D zone_${zone}_REJECT -i "$ifname" -j reject
- $IPTABLES -D zone_${zone}_nat -t nat -o "$ifname" -j MASQUERADE
- $IPTABLES -D PREROUTING -t nat -i "$ifname" -j zone_${zone}_prerouting
+
+ $IPTABLES -D PREROUTING -t nat -i "$ifname" -j zone_${zone}_prerouting
+ $IPTABLES -D POSTROUTING -t nat -o "$ifname" -j zone_${zone}_nat
$IPTABLES -D forward -i "$ifname" -j zone_${zone}_forward
+ $IPTABLES -D PREROUTING -t raw -i "$ifname" -j zone_${zone}_notrack
+
uci_revert_state firewall core "${network}_ifname"
uci_revert_state firewall core "${network}_zone"
+
+ del_state "${zone}_networks" "$network"
+
ACTION=remove ZONE="$zone" INTERFACE="$network" DEVICE="$ifname" /sbin/hotplug-call firewall
}
load_policy "$1"
echo 1 > /proc/sys/net/ipv4/tcp_syncookies
- for f in /proc/sys/net/ipv4/conf/*/accept_redirects
+ for f in /proc/sys/net/ipv4/conf/*/accept_redirects
do
echo 0 > $f
done
- for f in /proc/sys/net/ipv4/conf/*/accept_source_route
+ for f in /proc/sys/net/ipv4/conf/*/accept_source_route
do
echo 0 > $f
- done
-
+ done
+
uci_revert_state firewall core
- uci_set_state firewall core "" firewall_state
+ uci_set_state firewall core "" firewall_state
$IPTABLES -P INPUT DROP
$IPTABLES -P OUTPUT DROP
config_get syn_rate $1 syn_rate
config_get syn_burst $1 syn_burst
[ "$syn_flood" == "1" ] && load_synflood $syn_rate $syn_burst
-
+
echo "Adding custom chains"
fw_custom_chains
fw_set_chain_policy FORWARD "$DEF_FORWARD"
}
+fw_zone_defaults() {
+ local name
+ local network
+ local masq
+
+ config_get name $1 name
+ config_get network $1 network
+ config_get_bool masq $1 masq "0"
+ config_get_bool conntrack $1 conntrack "0"
+ config_get_bool mtu_fix $1 mtu_fix 0
+
+ load_policy $1
+ [ "$forward" ] && $IPTABLES -A zone_${name}_forward -j zone_${name}_${forward}
+ [ "$input" ] && $IPTABLES -A zone_${name} -j zone_${name}_${input}
+}
+
fw_zone() {
local name
local network
+ local mtu_fix
+ local conntrack
local masq
+ local masq_src
+ local masq_dest
config_get name $1 name
config_get network $1 network
config_get_bool masq $1 masq "0"
config_get_bool conntrack $1 conntrack "0"
config_get_bool mtu_fix $1 mtu_fix 0
+ config_get masq_src $1 masq_src
+ config_get masq_dest $1 masq_dest
load_policy $1
[ "$conntrack" = "1" -o "$masq" = "1" ] && append CONNTRACK_ZONES "$name"
[ -z "$network" ] && network=$name
- create_zone "$name" "$network" "$input" "$output" "$forward" "$masq" "$mtu_fix"
+
+ create_zone "$name" "$network" "$input" "$output" "$forward" "$mtu_fix" \
+ "$masq" "$masq_src" "$masq_dest"
+
fw_custom_chains_zone "$name"
}
fw_rule() {
- local src
+ local src
local src_ip
local src_mac
local src_port
config_get target $1 target
config_get ruleset $1 ruleset
- src_port_first=${src_port%-*}
- src_port_last=${src_port#*-}
- [ "$src_port_first" -ne "$src_port_last" ] && { \
- src_port="$src_port_first:$src_port_last"; }
+ local srcports destports
+ get_portrange srcports "$src_port" ":"
+ get_portrange destports "$dest_port" ":"
- dest_port_first=${dest_port%-*}
- dest_port_last=${dest_port#*-}
- [ "$dest_port_first" -ne "$dest_port_last" ] && { \
- dest_port="$dest_port_first:$dest_port_last"; }
-
ZONE=input
TARGET=$target
[ -z "$target" ] && target=DROP
[ -n "$src" -a -z "$dest" ] && ZONE=zone_$src
[ -n "$src" -a -n "$dest" ] && ZONE=zone_${src}_forward
[ -n "$dest" ] && TARGET=zone_${dest}_$target
+
+ eval 'RULE_COUNT=$((++RULE_COUNT_'$ZONE'))'
+
add_rule() {
- $IPTABLES -I $ZONE 1 \
+ $IPTABLES -I $ZONE $RULE_COUNT \
${proto:+-p $proto} \
${icmp_type:+--icmp-type $icmp_type} \
${src_ip:+-s $src_ip} \
- ${src_port:+--sport $src_port} \
+ ${srcports:+--sport $srcports} \
${src_mac:+-m mac --mac-source $src_mac} \
${dest_ip:+-d $dest_ip} \
- ${dest_port:+--dport $dest_port} \
- -j $TARGET
+ ${destports:+--dport $destports} \
+ -j $TARGET
}
- [ "$proto" == "tcpudp" -o -z "$proto" ] && {
- proto=tcp
- add_rule
- proto=udp
+
+ [ "$proto" == "tcpudp" ] && proto="tcp udp"
+ for proto in ${proto:-tcp udp}; do
add_rule
- return
- }
- add_rule
+ done
}
fw_forwarding() {
fw_redirect() {
local src
local src_ip
+ local src_dip
local src_port
local src_dport
local src_mac
+ local dest
local dest_ip
- local dest_port dest_port2
+ local dest_port
local proto
-
+ local target
+
config_get src $1 src
config_get src_ip $1 src_ip
+ config_get src_dip $1 src_dip
config_get src_port $1 src_port
config_get src_dport $1 src_dport
config_get src_mac $1 src_mac
+ config_get dest $1 dest
config_get dest_ip $1 dest_ip
config_get dest_port $1 dest_port
config_get proto $1 proto
- [ -z "$src" -o -z "$dest_ip" ] && { \
- echo "redirect needs src and dest_ip"; return ; }
-
- src_port_first=${src_port%-*}
- src_port_last=${src_port#*-}
- [ "$src_port_first" -ne "$src_port_last" ] && { \
- src_port="$src_port_first:$src_port_last"; }
-
- src_dport_first=${src_dport%-*}
- src_dport_last=${src_dport#*-}
- [ "$src_dport_first" -ne "$src_dport_last" ] && { \
- src_dport="$src_dport_first:$src_dport_last"; }
-
- dest_port2=$dest_port
- dest_port_first=${dest_port2%-*}
- dest_port_last=${dest_port2#*-}
- [ "$dest_port_first" -ne "$dest_port_last" ] && { \
- dest_port2="$dest_port_first:$dest_port_last"; }
+ config_get target $1 target
+
+ local fwdchain natchain natopt nataddr natports srcdaddr srcdports
+ if [ "${target:-DNAT}" == "DNAT" ]; then
+ [ -n "$src" -a -n "$dest_ip$dest_port" ] || {
+ echo "DNAT redirect needs src and dest_ip or dest_port"
+ return
+ }
+
+ fwdchain="zone_${src}_forward"
+
+ natopt="--to-destination"
+ natchain="zone_${src}_prerouting"
+ nataddr="$dest_ip"
+ get_portrange natports "$dest_port" "-"
+
+ srcdaddr="$src_dip"
+ get_portrange srcdports "$src_dport" ":"
+
+ find_item "$src" $CONNTRACK_ZONES || \
+ append CONNTRACK_ZONES "$src"
+
+ elif [ "$target" == "SNAT" ]; then
+ [ -n "$dest" -a -n "$src_dip" ] || {
+ echo "SNAT redirect needs dest and src_dip"
+ return
+ }
+
+ fwdchain="${src:+zone_${src}_forward}"
+
+ natopt="--to-source"
+ natchain="zone_${dest}_nat"
+ nataddr="$src_dip"
+ get_portrange natports "$src_dport" "-"
+
+ srcdaddr="$dest_ip"
+ get_portrange srcdports "$dest_port" ":"
+
+ find_item "$dest" $CONNTRACK_ZONES || \
+ append CONNTRACK_ZONES "$dest"
+
+ else
+ echo "redirect target must be either DNAT or SNAT"
+ return
+ fi
+
+ local srcports destports
+ get_portrange srcports "$src_port" ":"
+ get_portrange destports "${dest_port-$src_dport}" ":"
add_rule() {
- $IPTABLES -A zone_${src}_prerouting -t nat \
+ $IPTABLES -I $natchain 1 -t nat \
${proto:+-p $proto} \
${src_ip:+-s $src_ip} \
- ${src_port:+--sport $src_port} \
- ${src_dport:+--dport $src_dport} \
+ ${srcports:+--sport $srcports} \
+ ${srcdaddr:+-d $srcdaddr} \
+ ${srcdports:+--dport $srcdports} \
${src_mac:+-m mac --mac-source $src_mac} \
- -j DNAT --to-destination $dest_ip${dest_port:+:$dest_port}
+ -j ${target:-DNAT} $natopt $nataddr${natports:+:$natports}
- $IPTABLES -I zone_${src}_forward 1 \
+ [ -n "$dest_ip" ] && \
+ $IPTABLES -I ${fwdchain:-forward} 1 \
${proto:+-p $proto} \
- -d $dest_ip \
${src_ip:+-s $src_ip} \
- ${src_port:+--sport $src_port} \
- ${dest_port2:+--dport $dest_port2} \
+ ${srcports:+--sport $srcports} \
+ ${dest_ip:+-d $dest_ip} \
+ ${destports:+--dport $destports} \
${src_mac:+-m mac --mac-source $src_mac} \
- -j ACCEPT
+ -j ACCEPT
}
- [ "$proto" == "tcpudp" -o -z "$proto" ] && {
- proto=tcp
- add_rule
- proto=udp
+
+ [ "$proto" == "tcpudp" ] && proto="tcp udp"
+ for proto in ${proto:-tcp udp}; do
add_rule
- return
- }
- add_rule
+ done
}
fw_include() {
[ -e $path ] && . $path
}
+get_interface_zones() {
+ local interface="$2"
+ local name
+ local network
+ local masq_src
+ local masq_dest
+ config_get name $1 name
+ config_get network $1 network
+ config_get masq_src $1 masq_src
+ config_get masq_dest $1 masq_dest
+ [ -z "$network" ] && network=$name
+ for n in $network; do
+ [ "$n" = "$interface" ] && {
+ append add_zone "$name"
+ append add_masq_src "$masq_src"
+ append add_masq_dest "$masq_dest"
+ }
+ done
+}
+
+fw_event() {
+ local action="$1"
+ local interface="$2"
+ local ifname="$(sh -c ". /etc/functions.sh; include /lib/network; scan_interfaces; config_get "$interface" ifname")"
+ local add_zone=
+ local add_masq_src=
+ local add_masq_dest=
+ local up
+
+ [ -z "$ifname" ] && return 0
+ config_foreach get_interface_zones zone "$interface"
+ [ -z "$add_zone" ] && return 0
+
+ case "$action" in
+ ifup)
+ for z in $add_zone; do
+ local loaded masq_src masq_dest
+ config_get loaded core loaded
+ [ -n "$loaded" ] && addif "$interface" "$ifname" "$z" "$add_masq_src" "$add_masq_dest"
+ done
+ ;;
+ ifdown)
+ config_get up "$interface" up
+
+ for z in $ZONE; do
+ local masq_src masq_dest
+ config_get masq_src core "${z}_masq_src"
+ config_get masq_dest core "${z}_masq_dest"
+ [ "$up" == "1" ] && delif "$interface" "$ifname" "$z" "$masq_src" "$masq_dest"
+ done
+ ;;
+ esac
+}
+
fw_addif() {
local up
local ifname
config_get up $1 up
- config_get ifname $1 ifname
[ -n "$up" ] || return 0
- (ACTION="ifup" INTERFACE="$1" . /etc/hotplug.d/iface/20-firewall)
+ fw_event ifup "$1"
}
fw_custom_chains() {
$IPTABLES -N forwarding_rule
$IPTABLES -N prerouting_rule -t nat
$IPTABLES -N postrouting_rule -t nat
-
+
$IPTABLES -A INPUT -j input_rule
$IPTABLES -A OUTPUT -j output_rule
$IPTABLES -A FORWARD -j forwarding_rule
config_foreach fw_rule rule
echo "Loading includes"
config_foreach fw_include include
+ echo "Loading zone defaults"
+ config_foreach fw_zone_defaults zone
uci_set_state firewall core loaded 1
+ config_set core loaded 1
config_foreach fw_check_notrack zone
- unset CONFIG_APPEND
- config_load network
- config_foreach fw_addif interface
+ INTERFACES="$(sh -c '
+ . /etc/functions.sh; config_load network
+ echo_up() { local up; config_get_bool up "$1" up 0; [ $up = 1 ] && echo "$1"; }
+ config_foreach echo_up interface
+ ')"
+ for interface in $INTERFACES; do
+ fw_event ifup "$interface"
+ done
+
+ uci_set_state firewall core zones "$ZONE_NAMES"
}
fw_stop() {
+ local z n i
+ config_get z core zones
+ for z in $z; do
+ config_get n core "${z}_networks"
+ for n in $n; do
+ config_get i core "${n}_ifname"
+ [ -n "$i" ] && env -i ACTION=remove ZONE="$z" INTERFACE="$n" DEVICE="$i" \
+ /sbin/hotplug-call firewall
+ done
+ done
+
fw_clear
$IPTABLES -P INPUT ACCEPT
$IPTABLES -P OUTPUT ACCEPT
projects / 10.03 / openwrt.git / blobdiff