contrib/package/meshwizard/files/usr/bin/meshwizard/helpers/setup_firewall.sh

   1 #!/bin/sh
   2 # This will add $net to the zone firewall (and remove it from other zones where it is referenced)
   3 # It will also setup rules defined in /etc/config/freifunk and /etc/config/profile_<community>
   4 # Arg $1 = $net
   5
   6 net=$1
   7 . /etc/functions.sh
   8 . $dir/functions.sh
   9 config_load firewall
  10
  11 # Get some variables
  12 type="$(uci -q get wireless.$net.type)"
  13 vap="$(uci -q get meshwizard.netconfig.$net\_vap)"
  14
  15 # Add local_restrict to wan firewall zone
  16 handle_zonewan() {
  17         config_get name "$1" name
  18         if [ "$name" == "wan" ]; then
  19                 uci set firewall.$1.local_restrict=1
  20         fi
  21 }
  22 config_foreach handle_zonewan zone && uci_commitverbose "Enable local_restrict for zone wan" firewall
  23
  24 # Delete old firewall zone for freifunk
  25 handle_fwzone() {
  26         config_get name "$1" name
  27         config_get network "$1" network
  28
  29         if [ "$2" == "zoneconf" ]; then
  30                 if [ "$name" == "freifunk" ]; then
  31                         # rename section if unnamed
  32                         if [ -z "${1/cfg[0-9a-fA-F]*/}" ]; then
  33                                 section_rename firewall $1 zone_freifunk
  34                         fi
  35                 else
  36                         if [ -n "$netrenamed" -a -n "$(echo $network | grep $netrenamed)" ] && [ ! "$name" == "freifunk" ]; then
  37                                 echo "    Removed $netrenamed from firewall zone $name."
  38                                 network_new=$(echo $network | sed -e 's/'$netrenamed'//' -e 's/^ //' -e 's/  / /' -e 's/ $//')
  39                                 uci set firewall.$1.network="$network_new"
  40                         fi
  41                 fi
  42         fi
  43 }
  44
  45 config_foreach handle_fwzone zone zoneconf
  46
  47 # setup freifunk firewall zone
  48 # add $netrenamed and if needed ${netrenamed}dhcp to the networks for this zone
  49 config_get network zone_freifunk network
  50
  51 # remove ${netrenamed}dhcp from networks list
  52 [ -n "$network" -a -n "$net" ] && network="${network/${netrenamed}dhcp/}"
  53 network=$(echo $network) # Removes leading and trailing whitespaces
  54
  55 [ -n "$netrenamed" ] && [ -z "$(echo $network | grep $netrenamed)" ] && network="$network $netrenamed"
  56
  57 if [ "$type" == "atheros" -a "$vap" == 1 ]; then
  58         [ -n "$netrenamed" ] && [ "$network" == "${network/${netrenamed}dhcp/}" ] && network="$network ${netrenamed}dhcp"
  59 fi
  60
  61 uci batch << EOF
  62 set firewall.zone_freifunk="zone"
  63 set firewall.zone_freifunk.name="freifunk"
  64 set firewall.zone_freifunk.network="$network"
  65 set firewall.zone_freifunk.input="$zone_freifunk_input"
  66 set firewall.zone_freifunk.forward="$zone_freifunk_forward"
  67 set firewall.zone_freifunk.output="$zone_freifunk_output"
  68 EOF
  69
  70 uci_commitverbose "Setup freifunk firewall zone" firewall
  71
  72 # Usually we need to setup masquerading for lan, except lan is an olsr interface or has an olsr hna
  73
  74 handle_interface() {
  75         config_get interface "$1" interface
  76         if [ "$interface" == "lan" ]; then
  77                 no_masq_lan=1
  78         fi
  79 }
  80 config_load olsrd
  81 config_foreach handle_interface Interface
  82
  83 handle_hna() {
  84         config_get netaddr "$1" netaddr
  85         if [ "$NETWORK" == "$netaddr" ]; then
  86                 no_masq_lan=1
  87         fi
  88 }
  89 config_foreach handle_hna Hna4
  90
  91 currms=$(uci -q get firewall.zone_freifunk.masq_src)
  92 if [ ! "$no_masq_lan" == "1" ]; then
  93         uci set firewall.zone_freifunk.masq="1"
  94         [ -z "$(echo $currms |grep lan)" ] && uci add_list firewall.zone_freifunk.masq_src="lan"
  95 fi
  96
  97 # If wifi-interfaces are outside of the mesh network they should be natted
  98 for i in $networks; do
  99         # Get dhcprange and meshnet
 100         dhcprange=$(uci get meshwizard.netconfig.$i\_dhcprange)
 101         meshnet="$(uci get profile_$community.profile.mesh_network)"
 102         # check if the dhcprange is inside meshnet
 103         dhcpinmesh="$($dir/helpers/check-range-in-range.sh $dhcprange $meshnet)"
 104         if [ ! "$dhcpinmesh" == 1 ]; then
 105                 [ -z "$(echo $currms |grep ${netrenamed}dhcp)" ] && uci add_list firewall.zone_freifunk.masq_src="${netrenamed}dhcp"
 106         fi
 107 done
 108
 109 uci_commitverbose "Setup masquerading rules" firewall
 110
 111 # Rules, Forwardings, advanced config and includes
 112 # Clear firewall configuration
 113
 114 for config in freifunk profile_$community; do
 115
 116         config_load $config
 117
 118         for section in advanced include fw_rule fw_forwarding; do
 119                 handle_firewall() {
 120                         local options=$(uci show $config."$1")
 121                         options=$(echo "$options" | sed -e "s/fw_//g" -e "s/^$config/firewall/g")
 122                         for o in $options; do
 123                                 uci set $o
 124                         done
 125                 }
 126                 config_foreach handle_firewall $section
 127         done
 128 done
 129
 130 uci_commitverbose "Setup rules, forwardings, advanced config and includes." firewall
 131