| 1 | # Copyright (C) 2009-2010 OpenWrt.org |
| 2 | |
| 3 | fw_config_get_redirect() { |
| 4 | [ "${redirect_NAME}" != "$1" ] || return |
| 5 | fw_config_get_section "$1" redirect { \ |
| 6 | string _name "$1" \ |
| 7 | string name "" \ |
| 8 | string src "" \ |
| 9 | ipaddr src_ip "" \ |
| 10 | ipaddr src_dip "" \ |
| 11 | string src_mac "" \ |
| 12 | string src_port "" \ |
| 13 | string src_dport "" \ |
| 14 | string dest "" \ |
| 15 | ipaddr dest_ip "" \ |
| 16 | string dest_port "" \ |
| 17 | string proto "tcpudp" \ |
| 18 | string family "" \ |
| 19 | string target "DNAT" \ |
| 20 | string extra "" \ |
| 21 | } || return |
| 22 | [ -n "$redirect_name" ] || redirect_name=$redirect__name |
| 23 | } |
| 24 | |
| 25 | fw_load_redirect() { |
| 26 | fw_config_get_redirect "$1" |
| 27 | |
| 28 | fw_callback pre redirect |
| 29 | |
| 30 | local fwdchain natchain natopt nataddr natports srcdaddr srcdports |
| 31 | if [ "$redirect_target" == "DNAT" ]; then |
| 32 | [ -n "${redirect_src#*}" -a -n "$redirect_dest_ip$redirect_dest_port" ] || { |
| 33 | fw_log error "DNAT redirect ${redirect_name}: needs src and dest_ip or dest_port, skipping" |
| 34 | return 0 |
| 35 | } |
| 36 | |
| 37 | fwdopt="" |
| 38 | fwdchain="" |
| 39 | |
| 40 | # Check whether only ports are given or whether the given dest ip is local, |
| 41 | # in this case match only DNATed traffic and allow it on input, not forward |
| 42 | if [ -z "$redirect_dest_ip" ] || /sbin/ifconfig | grep -qE "addr:${redirect_dest_ip//./\\.}\b"; then |
| 43 | fwdopt="-m conntrack --ctstate DNAT" |
| 44 | fwdchain="zone_${redirect_src}" |
| 45 | else |
| 46 | fwdchain="zone_${redirect_src}_forward" |
| 47 | fi |
| 48 | |
| 49 | natopt="--to-destination" |
| 50 | natchain="zone_${redirect_src}_prerouting" |
| 51 | nataddr="$redirect_dest_ip" |
| 52 | fw_get_port_range natports "${redirect_dest_port#!}" "-" |
| 53 | |
| 54 | fw_get_negation srcdaddr '-d' "${redirect_src_dip:+$redirect_src_dip/$redirect_src_dip_prefixlen}" |
| 55 | fw_get_port_range srcdports "$redirect_src_dport" ":" |
| 56 | fw_get_negation srcdports '--dport' "$srcdports" |
| 57 | |
| 58 | list_contains FW_CONNTRACK_ZONES $redirect_src || \ |
| 59 | append FW_CONNTRACK_ZONES $redirect_src |
| 60 | |
| 61 | elif [ "$redirect_target" == "SNAT" ]; then |
| 62 | [ -n "${redirect_dest#*}" -a -n "$redirect_src_dip" ] || { |
| 63 | fw_log error "SNAT redirect ${redirect_name}: needs dest and src_dip, skipping" |
| 64 | return 0 |
| 65 | } |
| 66 | |
| 67 | fwdchain="${redirect_src:+zone_${redirect_src}_forward}" |
| 68 | |
| 69 | natopt="--to-source" |
| 70 | natchain="zone_${redirect_dest}_nat" |
| 71 | nataddr="$redirect_src_dip" |
| 72 | fw_get_port_range natports "${redirect_src_dport#!}" "-" |
| 73 | |
| 74 | fw_get_negation srcdaddr '-d' "${redirect_dest_ip:+$redirect_dest_ip/$redirect_dest_ip_prefixlen}" |
| 75 | fw_get_port_range srcdports "$redirect_dest_port" ":" |
| 76 | fw_get_negation srcdports '--dport' "$srcdports" |
| 77 | |
| 78 | list_contains FW_CONNTRACK_ZONES $redirect_dest || \ |
| 79 | append FW_CONNTRACK_ZONES $redirect_dest |
| 80 | |
| 81 | else |
| 82 | fw_log error "redirect ${redirect_name}: target must be either DNAT or SNAT, skipping" |
| 83 | return 0 |
| 84 | fi |
| 85 | |
| 86 | local mode |
| 87 | fw_get_family_mode mode ${redirect_family:-x} ${redirect_src:-$redirect_dest} I |
| 88 | |
| 89 | local srcaddr |
| 90 | fw_get_negation srcaddr '-s' "${redirect_src_ip:+$redirect_src_ip/$redirect_src_ip_prefixlen}" |
| 91 | |
| 92 | local srcports |
| 93 | fw_get_port_range srcports "$redirect_src_port" ":" |
| 94 | fw_get_negation srcports '--sport' "$srcports" |
| 95 | |
| 96 | local destaddr |
| 97 | fw_get_negation destaddr '-d' "${redirect_dest_ip:+$redirect_dest_ip/$redirect_dest_ip_prefixlen}" |
| 98 | |
| 99 | local destports |
| 100 | fw_get_port_range destports "${redirect_dest_port:-$redirect_src_dport}" ":" |
| 101 | fw_get_negation destports '--dport' "$destports" |
| 102 | |
| 103 | [ "$redirect_proto" == "tcpudp" ] && redirect_proto="tcp udp" |
| 104 | local pr; for pr in $redirect_proto; do |
| 105 | fw_get_negation pr '-p' "$pr" |
| 106 | local sm; for sm in ${redirect_src_mac:-""}; do |
| 107 | fw_get_negation sm '--mac-source' "$sm" |
| 108 | fw add $mode n $natchain $redirect_target + \ |
| 109 | { $redirect_src_ip $redirect_dest_ip } { \ |
| 110 | $srcaddr $srcdaddr $pr \ |
| 111 | $srcports $srcdports \ |
| 112 | ${sm:+-m mac $sm} \ |
| 113 | $natopt $nataddr${natports:+:$natports} \ |
| 114 | $redirect_options \ |
| 115 | } |
| 116 | |
| 117 | fw add $mode f ${fwdchain:-forward} ACCEPT + \ |
| 118 | { $redirect_src_ip $redirect_dest_ip } { \ |
| 119 | $srcaddr $destaddr \ |
| 120 | $pr \ |
| 121 | $srcports $destports \ |
| 122 | ${sm:+-m mac $sm} \ |
| 123 | $fwdopt \ |
| 124 | $redirect_extra \ |
| 125 | } |
| 126 | done |
| 127 | done |
| 128 | |
| 129 | fw_callback post redirect |
| 130 | } |
| 131 | |
