* Added backend for firewall / portforwarding

diff --git a/contrib/init.d/luci_fw b/contrib/init.d/luci_fw
new file mode 100644 (file)
index 0000000..f393719
--- /dev/null
+++ b/contrib/init.d/luci_fw
@@ -0,0 +1,120 @@
+#!/bin/sh /etc/rc.common
+START=46
+
+apply_portfw() {
+       local cfg="$1"
+       config_get proto "$cfg" proto
+       config_get dport "$cfg" dport
+       config_get iface "$cfg" iface
+       config_get to    "$cfg" to
+
+       ports=$(echo $to | cut -sd: -f2)
+       [ -n "$ports" ] && ports="--dport $(echo $ports | sed -e 's/-/:/')"
+
+       ip=$(echo $to | cut -d: -f1)
+       
+       if ([ "$proto" == "tcpudp" ] || [ "$proto" == "tcp" ]); then
+               iptables -t nat -A luci_prerouting -i "$iface" -p tcp --dport "$dport" -j DNAT --to "$to"
+               iptables -A luci_forward -i "$iface" -p tcp -d "$ip" "$ports" -j ACCEPT
+       fi
+
+       if ([ "$proto" == "tcpudp" ] || [ "$proto" == "udp" ]); then
+               iptables -t nat -A luci_prerouting -i "$iface" -p udp --dport "$dport" -j DNAT --to "$to"
+               iptables -A luci_forward -i "$iface" -p udp -d "$ip" "$ports" -j ACCEPT
+       fi
+}
+
+apply_rule() {
+       local cfg="$1"
+       local cmd=""
+
+       config_get chain "$cfg" chain
+       [ -n "$chain" ] || return 0
+       [ "$chain" == "forward" ] && cmd="$cmd -A luci_forward"
+       [ "$chain" == "input" ] && cmd="$cmd -A luci_input"
+       [ "$chain" == "output" ] && cmd="$cmd -A luci_output"
+       [ "$chain" == "prerouting" ] && cmd="$cmd -t nat -A luci_prerouting"
+       [ "$chain" == "postrouting" ] && cmd="$cmd -t nat -A luci_postrouting"
+       
+       config_get iface "$cfg" iface
+       [ -n "$iface" ] && cmd="$cmd -i $iface" 
+
+       config_get oface "$cfg" oface
+       [ -n "$oface" ] && cmd="$cmd -o $oface" 
+
+       config_get proto "$cfg" proto
+       [ -n "$proto" ] && cmd="$cmd -p $proto" 
+
+       config_get source "$cfg" source
+       [ -n "$source" ] && cmd="$cmd -s $source"       
+
+       config_get destination "$cfg" destination
+       [ -n "$destination" ] && cmd="$cmd -d $destination"     
+
+       config_get sport "$cfg" sport
+       [ -n "$sport" ] && cmd="$cmd --sport $sport"    
+
+       config_get dport "$cfg" dport
+       [ -n "$dport" ] && cmd="$cmd --dport $dport"    
+       
+       config_get todest "$cfg" todest
+       [ -n "$todest" ] && cmd="$cmd --to-destination $todest" 
+
+       config_get tosrc "$cfg" tosrc
+       [ -n "$tosrc" ] && cmd="$cmd --to-source $tosrc"        
+
+       config_get jump "$cfg" jump
+       [ -n "$jump" ] && cmd="$cmd -j $jump"   
+
+       config_get state "$cfg" state
+       [ -n "$state" ] && cmd="$cmd -m state --state $state"   
+
+       config_get command "$cfg" command
+       [ -n "$command" ] && cmd="$cmd $command"        
+
+       iptables $cmd
+}
+
+start() {
+       ### Create subchains
+       iptables -N luci_input
+       iptables -N luci_output
+       iptables -N luci_forward
+       iptables -t nat -N luci_prerouting
+       iptables -t nat -N luci_postrouting
+       
+       ### Hook in the chains
+       iptables -A input_rule -j luci_input
+       iptables -A output_rule -j luci_output
+       iptables -A forwarding_rule -j luci_forward
+       iptables -t nat -A prerouting_rule -j luci_prerouting
+       iptables -t nat -A postrouting_rule -j luci_postrouting
+       
+       ### Read chains from config
+       config_load luci_fw
+       config_foreach apply_portfw portfw
+       config_foreach apply_rule rule
+}
+
+stop() {
+       ### Hook out the chains
+       iptables -D input_rule -j luci_input
+       iptables -D output_rule -j luci_output
+       iptables -D forwarding_rule -j luci_forward
+       iptables -t nat -D prerouting_rule -j luci_prerouting
+       iptables -t nat -D postrouting_rule -j luci_postrouting 
+       
+       ### Clear subchains
+       iptables -F luci_input
+       iptables -F luci_output
+       iptables -F luci_forward
+       iptables -t nat -F luci_prerouting
+       iptables -t nat -F luci_postrouting
+       
+       ### Delete subchains
+       iptables -X luci_input
+       iptables -X luci_output
+       iptables -X luci_forward
+       iptables -t nat -X luci_prerouting
+       iptables -t nat -X luci_postrouting
+}

diff --git a/contrib/package/ffluci/Makefile b/contrib/package/ffluci/Makefile
index 8854110..42fffb6 100644 (file)
--- a/contrib/package/ffluci/Makefile
+++ b/contrib/package/ffluci/Makefile
@@ -39,6 +39,8 @@ define Package/ffluci/install
        $(INSTALL_DIR) $(1)/www/cgi-bin
        $(INSTALL_DIR) $(1)/www/ffluci
        $(INSTALL_DIR) $(1)/etc/config
+       $(INSTALL_DIR) $(1)/etc/init.d
+       $(INSTALL_BIN) $(PKG_BUILD_DIR)/contrib/init.d/luci_fw $(1)/etc/init.d/luci_fw
        $(CP) $(PKG_BUILD_DIR)/dist/* $(1)/usr/lib/lua/ -R
        $(CP) $(PKG_BUILD_DIR)/contrib/media $(1)/www/ffluci/ -R
        $(INSTALL_BIN) $(PKG_BUILD_DIR)/contrib/ffluci $(1)/www/cgi-bin

diff --git a/src/ffluci/model/cbi/admin_network/firewall.lua b/src/ffluci/model/cbi/admin_network/firewall.lua
index fc7bea6..a30bac7 100644 (file)
--- a/src/ffluci/model/cbi/admin_network/firewall.lua
+++ b/src/ffluci/model/cbi/admin_network/firewall.lua
@@ -13,12 +13,34 @@ chain:value("postrouting", "Postrouting")
 
 s:option(Value, "iface", "Eingangsschnittstelle").optional = true
 s:option(Value, "oface", "Ausgangsschnittstelle").optional = true
-s:option(Value, "proto", "Protokoll").optional = true
+
+proto = s:option(ListValue, "proto", "Protokoll")
+proto.optional = true
+proto:value("")
+proto:value("tcp", "TCP")
+proto:value("udp", "UDP")
+
 s:option(Value, "source", "Quelladresse").optional = true
 s:option(Value, "destination", "Zieladresse").optional = true
-s:option(Value, "sport", "Quellports").optional = true
-s:option(Value, "dport", "Zielports").optional = true
-s:option(Value, "to", "Neues Ziel").optional = true
+
+sport = s:option(Value, "sport", "Quellport")
+sport.optional = true
+sport:depends("proto", "tcp")
+sport:depends("proto", "udp")
+
+dport = s:option(Value, "dport", "Zielport")
+dport.optional = true
+dport:depends("proto", "tcp")
+dport:depends("proto", "udp")
+
+tosrc = s:option(Value, "tosrc", "Neue Quelladresse [SNAT]")
+tosrc.optional = true
+tosrc:depends("jump", "SNAT")
+
+tosrc = s:option(Value, "todest", "Neue Zieladresse [DNAT]")
+tosrc.optional = true
+tosrc:depends("jump", "DNAT")
+
 
 state = s:option(MultiValue, "state", "Status")
 state.optional  = true
@@ -28,10 +50,20 @@ state:value("ESTABLISHED", "etabliert")
 state:value("RELATED", "zugehörig")
 state:value("INVALID", "ungültig")
 
-s:option(Value, "jump", "Aktion", "ACCEPT, REJECT, DROP, MASQUERADE, DNAT, SNAT, ...").optional = true
+jump = s:option(ListValue, "jump", "Aktion")
+jump.rmempty = true
+jump:value("", "")
+jump:value("ACCEPT", "annehmen (ACCEPT)")
+jump:value("REJECT", "zurückweisen (REJECT)")
+jump:value("DROP", "verwerfen (DROP)")
+jump:value("LOG", "protokollieren (LOG)")
+jump:value("DNAT", "Ziel umschreiben (DNAT) [nur Prerouting]")
+jump:value("MASQUERADE", "maskieren (MASQUERADE) [nur Postrouting]")
+jump:value("SNAT", "Quelle umschreiben (SNAT) [nur Postrouting]")
 
 
-add = s:option(Value, "command", "Befehl")
+add = s:option(Value, "command", "Eigener Befehl")
 add.size = 50
+add.rmempty = true
 
-return m
\ No newline at end of file
+return m

diff --git a/src/ffluci/model/cbi/admin_network/portfw.lua b/src/ffluci/model/cbi/admin_network/portfw.lua
index 6f8822a..70a1749 100644 (file)
--- a/src/ffluci/model/cbi/admin_network/portfw.lua
+++ b/src/ffluci/model/cbi/admin_network/portfw.lua
@@ -1,18 +1,24 @@
 -- ToDo: Translate, Add descriptions and help texts
+require("ffluci.sys")
 m = Map("luci_fw", "Portweiterleitung")
 
 s = m:section(TypedSection, "portfw")
 s.addremove = true
 s.anonymous = true
 
-iface = s:option(Value, "in_interface", "Externes Interface")
+iface = s:option(ListValue, "iface", "Externes Interface")
+iface:value("")
+for k,v in pairs(ffluci.sys.net.devices()) do
+       iface:value(v)
+end
 
 proto = s:option(ListValue, "proto", "Protokoll")
 proto:value("tcp", "TCP")
 proto:value("udp", "UDP")
+proto:value("tcpudp", "TCP+UDP")
 
 dport = s:option(Value, "dport", "Externer Port", "Port[:Endport]")
 
 to = s:option(Value, "to", "Interne Adresse", "IP-Adresse[:Zielport[-Zielendport]]")
 
-return m
\ No newline at end of file
+return m