applications/siitwizzard: also prepare firewall include

[project/luci.git] / applications / luci-siitwizard / luasrc / model / cbi / siitwizard.lua

diff --git a/applications/luci-siitwizard/luasrc/model/cbi/siitwizard.lua b/applications/luci-siitwizard/luasrc/model/cbi/siitwizard.lua
index a6b4050..2d8ad2c 100644 (file)
--- a/applications/luci-siitwizard/luasrc/model/cbi/siitwizard.lua
+++ b/applications/luci-siitwizard/luasrc/model/cbi/siitwizard.lua
@@ -21,8 +21,8 @@ f = SimpleForm("siitwizward", "4over6-Assistent",
  "Dieser Assistent unterstüzt bei der Einrichtung von IPv4-over-IPv6 Translation.")
 
 mode = f:field(ListValue, "mode", "Betriebsmodus")
-mode:value("gateway", "Gateway")
 mode:value("client", "Client")
+mode:value("gateway", "Gateway")
 
 dev = f:field(ListValue, "device", "WLAN-Gerät")
 uci:foreach("wireless", "wifi-device",
@@ -32,11 +32,12 @@ uci:foreach("wireless", "wifi-device",
 
 lanip = f:field(Value, "ipaddr", "LAN IP Adresse")
 lanip.value = "172.23.1.1"
-lanip:depends("mode", "client")
 
-lanmsk = f:field(Value, "netmask", "LAN Netzmaske")
-lanmsk.value = "255.255.0.0"
-lanmsk:depends("mode", "client")
+lanmsk = f:field(Value, "lanmask", "Lokale LAN Netzmaske")
+lanmsk.value = "255.255.255.0"
+
+gv4msk = f:field(Value, "gv4mask", "Globale LAN Netzmaske")
+gv4msk.value = "255.255.0.0"
 
 
 -------------------- Control --------------------
@@ -68,6 +69,17 @@ end
 
 function mode.write(self, section, value)
 
+       -- lan interface
+       local lan_net = luci.ip.IPv4(
+               lanip:formvalue(section) or "192.168.1.1",
+               lanmsk:formvalue(section) or "255.255.255.0"
+       )
+
+       local gv4_net = luci.ip.IPv4(
+               lanip:formvalue(section) or "192.168.1.1",
+               gv4msk:formvalue(section) or "255.255.0.0"
+       )
+
        --
        -- Configure wifi device
        --
@@ -137,11 +149,30 @@ function mode.write(self, section, value)
 
        if value == "gateway" then
 
+
+               -- wan mtu
                uci:set("network", "wan", "mtu", 1400)
 
+               -- lan settings
+               uci:tset("network", "lan", {
+                       mtu     = 1400,
+                       ipaddr  = lan_net:host():string(),
+                       netmask = lan_net:mask():string()
+               })
+
                -- use full siit subnet
                siit_route = luci.ip.IPv6(siit_prefix .. "/96")
 
+               -- v4 <-> siit route
+               uci:delete_all("network", "route",
+                       function(s) return s.interface == "siit0" end)
+
+               uci:section("network", "route", nil, {
+                       interface = "siit0",
+                       target    = gv4_net:network():string(),
+                       netmask   = gv4_net:mask():string()
+               })
+
        --
        -- Client mode
        --
@@ -151,12 +182,8 @@ function mode.write(self, section, value)
        --      * Also, MTU on LAN reduced to 1400.
 
        else
-               -- lan interface
-               local lan_net = luci.ip.IPv4(
-                       lanip:formvalue(section) or "192.168.1.1",
-                       lanmsk:formvalue(section) or "255.255.255.0"
-               )
 
+               -- lan settings
                uci:tset("network", "lan", {
                        mtu     = 1400,
                        ipaddr  = lan_net:host():string(),
@@ -168,8 +195,80 @@ function mode.write(self, section, value)
                        siit_prefix .. "/" .. (96 + lan_net:prefix())
                ):add(lan_net[2])
 
+               -- ipv4 <-> siit route
+               uci:delete_all("network", "route",
+                       function(s) return s.interface == "siit0" end)
+
+               -- XXX: kind of a catch all, gv4_net would be better
+               --      but does not cover non-local v4 space
+               uci:section("network", "route", nil, {
+                       interface = "siit0",
+                       target    = "0.0.0.0",
+                       netmask   = "0.0.0.0"
+               })
        end
 
+       -- setup the firewall
+       uci:delete_all("firewall", "zone",
+               function(s) return (
+                       s['.name'] == "siit0" or s.name == "siit0" or
+                       s.network == "siit0" or s['.name'] == wifi_device or
+                       s.name == wifi_device or s.network == wifi_device
+               ) end)
+
+       uci:delete_all("firewall", "forwarding",
+               function(s) return (
+                       s.src == wifi_device and s.dest == "siit0" or
+                       s.dest == wifi_device and s.src == "siit0" or
+                       s.src == "lan" and s.dest == "siit0" or
+                       s.dest == "lan" and s.src == "siit0"
+               ) end)
+
+       uci:section("firewall", "zone", "siit0", {
+               name    = "siit0",
+               network = "siit0",
+               input   = "ACCEPT",
+               output  = "ACCEPT",
+               forward = "ACCEPT"
+       })
+
+       uci:section("firewall", "zone", wifi_device, {
+               name    = wifi_device,
+               network = wifi_device,
+               input   = "ACCEPT",
+               output  = "ACCEPT",
+               forward = "ACCEPT"
+       })
+
+       uci:section("firewall", "forwarding", nil, {
+               src  = wifi_device,
+               dest = "siit0"
+       })
+
+       uci:section("firewall", "forwarding", nil, {
+               src  = "siit0",
+               dest = wifi_device
+       })
+
+       uci:section("firewall", "forwarding", nil, {
+               src  = "lan",
+               dest = "siit0"
+       })
+
+       uci:section("firewall", "forwarding", nil, {
+               src  = "siit0",
+               dest = "lan"
+       })
+
+       -- firewall include
+       uci:delete_all("firewall", "include",
+               function(s) return s.path == "/etc/firewall.user" end)
+
+       uci:section("firewall", "include", nil, {
+               path = "/etc/firewall.user"
+       })
+
+
        -- siit0 interface
        uci:delete_all("network", "interface",
                function(s) return ( s.ifname == "siit0" ) end)
@@ -224,7 +323,16 @@ function mode.write(self, section, value)
                prefix  = siit_route:prefix()
        })
 
+       -- txtinfo v6
+       uci:foreach("olsrd", "LoadPlugin",
+               function(s)
+                       if s.library == "olsrd_txtinfo.so.0.1" then
+                               uci:set("olsrd", s['.name'], "accept", "::1")
+                       end
+               end)
+
        uci:save("wireless")
+       uci:save("firewall")
        uci:save("network")
        uci:save("olsrd")
 end