Root/package/firewall/files/uci_firewall.sh

1#!/bin/sh
2# Copyright (C) 2008 John Crispin <blogic@openwrt.org>
3
4. /etc/functions.sh
5
6IPTABLES="echo iptables"
7IPTABLES=iptables
8
9config_clear
10include /lib/network
11scan_interfaces
12
13CONFIG_APPEND=1
14config_load firewall
15
16config fw_zones
17ZONE_LIST=$CONFIG_SECTION
18
19CUSTOM_CHAINS=1
20DEF_INPUT=DROP
21DEF_OUTPUT=DROP
22DEF_FORWARD=DROP
23CONNTRACK_ZONES=
24NOTRACK_DISABLED=
25
26find_item() {
27    local item="$1"; shift
28    for i in "$@"; do
29        [ "$i" = "$item" ] && return 0
30    done
31    return 1
32}
33
34get_portrange() {
35    local _var="$1"
36    local _range="$2"
37    local _delim="${3:-:}"
38
39    local _min="${_range%%[:-]*}"
40    local _max="${_range##*[:-]}"
41
42    [ -n "$_min" ] && [ -n "$_max" ] && [ "$_min" != "$_max" ] && \
43        export -n -- "$_var=$_min$_delim$_max" || \
44        export -n -- "$_var=${_min:-$_max}"
45}
46
47load_policy() {
48    config_get input $1 input
49    config_get output $1 output
50    config_get forward $1 forward
51
52    DEF_INPUT="${input:-$DEF_INPUT}"
53    DEF_OUTPUT="${output:-$DEF_OUTPUT}"
54    DEF_FORWARD="${forward:-$DEF_FORWARD}"
55}
56
57create_zone() {
58    local name="$1"
59    local network="$2"
60    local input="$3"
61    local output="$4"
62    local forward="$5"
63    local mtu_fix="$6"
64    local masq="$7"
65    local masq_src="$8"
66    local masq_dest="$9"
67
68    local exists
69
70    [ "$name" == "loopback" ] && return
71
72    config_get exists $ZONE_LIST $name
73    [ -n "$exists" ] && return
74    config_set $ZONE_LIST $name 1
75
76    $IPTABLES -N zone_${name}
77    $IPTABLES -N zone_${name}_MSSFIX
78    $IPTABLES -N zone_${name}_ACCEPT
79    $IPTABLES -N zone_${name}_DROP
80    $IPTABLES -N zone_${name}_REJECT
81    $IPTABLES -N zone_${name}_forward
82    [ "$output" ] && $IPTABLES -A output -j zone_${name}_${output}
83    $IPTABLES -N zone_${name}_nat -t nat
84    $IPTABLES -N zone_${name}_prerouting -t nat
85    $IPTABLES -t raw -N zone_${name}_notrack
86    [ "$mtu_fix" == "1" ] && $IPTABLES -I FORWARD 1 -j zone_${name}_MSSFIX
87
88    if [ "$masq" == "1" ]; then
89        local msrc mdst
90        for msrc in ${masq_src:-0.0.0.0/0}; do
91            [ "${msrc#!}" != "$msrc" ] && msrc="! -s ${msrc#!}" || msrc="-s $msrc"
92            for mdst in ${masq_dest:-0.0.0.0/0}; do
93                [ "${mdst#!}" != "$mdst" ] && mdst="! -d ${mdst#!}" || mdst="-d $mdst"
94                $IPTABLES -A zone_${name}_nat -t nat $msrc $mdst -j MASQUERADE
95            done
96        done
97    fi
98}
99
100
101addif() {
102    local network="$1"
103    local ifname="$2"
104    local zone="$3"
105
106    local n_if n_zone
107    config_get n_if core "${network}_ifname"
108    config_get n_zone core "${network}_zone"
109    [ -n "$n_zone" ] && {
110        if [ "$n_zone" != "$zone" ]; then
111            delif "$network" "$n_if" "$n_zone"
112        else
113            return
114        fi
115    }
116
117    logger "adding $network ($ifname) to firewall zone $zone"
118    $IPTABLES -A input -i "$ifname" -j zone_${zone}
119    $IPTABLES -I zone_${zone}_MSSFIX 1 -o "$ifname" -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
120    $IPTABLES -I zone_${zone}_ACCEPT 1 -o "$ifname" -j ACCEPT
121    $IPTABLES -I zone_${zone}_DROP 1 -o "$ifname" -j DROP
122    $IPTABLES -I zone_${zone}_REJECT 1 -o "$ifname" -j reject
123    $IPTABLES -I zone_${zone}_ACCEPT 1 -i "$ifname" -j ACCEPT
124    $IPTABLES -I zone_${zone}_DROP 1 -i "$ifname" -j DROP
125    $IPTABLES -I zone_${zone}_REJECT 1 -i "$ifname" -j reject
126
127    $IPTABLES -I PREROUTING 1 -t nat -i "$ifname" -j zone_${zone}_prerouting
128    $IPTABLES -I POSTROUTING 1 -t nat -o "$ifname" -j zone_${zone}_nat
129    $IPTABLES -A forward -i "$ifname" -j zone_${zone}_forward
130    $IPTABLES -I PREROUTING 1 -t raw -i "$ifname" -j zone_${zone}_notrack
131
132    uci_set_state firewall core "${network}_ifname" "$ifname"
133    uci_set_state firewall core "${network}_zone" "$zone"
134
135    ACTION=add ZONE="$zone" INTERFACE="$network" DEVICE="$ifname" /sbin/hotplug-call firewall
136}
137
138delif() {
139    local network="$1"
140    local ifname="$2"
141    local zone="$3"
142
143    logger "removing $network ($ifname) from firewall zone $zone"
144    $IPTABLES -D input -i "$ifname" -j zone_$zone
145    $IPTABLES -D zone_${zone}_MSSFIX -o "$ifname" -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
146    $IPTABLES -D zone_${zone}_ACCEPT -o "$ifname" -j ACCEPT
147    $IPTABLES -D zone_${zone}_DROP -o "$ifname" -j DROP
148    $IPTABLES -D zone_${zone}_REJECT -o "$ifname" -j reject
149    $IPTABLES -D zone_${zone}_ACCEPT -i "$ifname" -j ACCEPT
150    $IPTABLES -D zone_${zone}_DROP -i "$ifname" -j DROP
151    $IPTABLES -D zone_${zone}_REJECT -i "$ifname" -j reject
152
153    $IPTABLES -D PREROUTING -t nat -i "$ifname" -j zone_${zone}_prerouting
154    $IPTABLES -D POSTROUTING -t nat -o "$ifname" -j zone_${zone}_nat
155    $IPTABLES -D forward -i "$ifname" -j zone_${zone}_forward
156    $IPTABLES -D PREROUTING -t raw -i "$ifname" -j zone_${zone}_notrack
157
158    uci_revert_state firewall core "${network}_ifname"
159    uci_revert_state firewall core "${network}_zone"
160
161    ACTION=remove ZONE="$zone" INTERFACE="$network" DEVICE="$ifname" /sbin/hotplug-call firewall
162}
163
164load_synflood() {
165    local rate=${1:-25}
166    local burst=${2:-50}
167    echo "Loading synflood protection"
168    $IPTABLES -N syn_flood
169    $IPTABLES -A syn_flood -p tcp --syn -m limit --limit $rate/second --limit-burst $burst -j RETURN
170    $IPTABLES -A syn_flood -j DROP
171    $IPTABLES -A INPUT -p tcp --syn -j syn_flood
172}
173
174fw_set_chain_policy() {
175    local chain=$1
176    local target=$2
177    [ "$target" == "REJECT" ] && {
178        $IPTABLES -A $chain -j reject
179        target=DROP
180    }
181    $IPTABLES -P $chain $target
182}
183
184fw_clear() {
185    $IPTABLES -F
186    $IPTABLES -t nat -F
187    $IPTABLES -t nat -X
188    $IPTABLES -t raw -F
189    $IPTABLES -t raw -X
190    $IPTABLES -X
191}
192
193fw_defaults() {
194    [ -n "$DEFAULTS_APPLIED" ] && {
195        echo "Error: multiple defaults sections detected"
196        return;
197    }
198    DEFAULTS_APPLIED=1
199
200    load_policy "$1"
201
202    echo 1 > /proc/sys/net/ipv4/tcp_syncookies
203    for f in /proc/sys/net/ipv4/conf/*/accept_redirects
204    do
205        echo 0 > $f
206    done
207    for f in /proc/sys/net/ipv4/conf/*/accept_source_route
208    do
209        echo 0 > $f
210    done
211
212    uci_revert_state firewall core
213    uci_set_state firewall core "" firewall_state
214
215    $IPTABLES -P INPUT DROP
216    $IPTABLES -P OUTPUT DROP
217    $IPTABLES -P FORWARD DROP
218
219    fw_clear
220    config_get_bool drop_invalid $1 drop_invalid 0
221
222    [ "$drop_invalid" -gt 0 ] && {
223        $IPTABLES -A INPUT -m state --state INVALID -j DROP
224        $IPTABLES -A OUTPUT -m state --state INVALID -j DROP
225        $IPTABLES -A FORWARD -m state --state INVALID -j DROP
226        NOTRACK_DISABLED=1
227    }
228
229    $IPTABLES -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
230    $IPTABLES -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
231    $IPTABLES -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
232
233    $IPTABLES -A INPUT -i lo -j ACCEPT
234    $IPTABLES -A OUTPUT -o lo -j ACCEPT
235
236    config_get syn_flood $1 syn_flood
237    config_get syn_rate $1 syn_rate
238    config_get syn_burst $1 syn_burst
239    [ "$syn_flood" == "1" ] && load_synflood $syn_rate $syn_burst
240
241    echo "Adding custom chains"
242    fw_custom_chains
243
244    $IPTABLES -N input
245    $IPTABLES -N output
246    $IPTABLES -N forward
247
248    $IPTABLES -A INPUT -j input
249    $IPTABLES -A OUTPUT -j output
250    $IPTABLES -A FORWARD -j forward
251
252    $IPTABLES -N reject
253    $IPTABLES -A reject -p tcp -j REJECT --reject-with tcp-reset
254    $IPTABLES -A reject -j REJECT --reject-with icmp-port-unreachable
255
256    fw_set_chain_policy INPUT "$DEF_INPUT"
257    fw_set_chain_policy OUTPUT "$DEF_OUTPUT"
258    fw_set_chain_policy FORWARD "$DEF_FORWARD"
259}
260
261fw_zone_defaults() {
262    local name
263    local network
264    local masq
265
266    config_get name $1 name
267    config_get network $1 network
268    config_get_bool masq $1 masq "0"
269    config_get_bool conntrack $1 conntrack "0"
270    config_get_bool mtu_fix $1 mtu_fix 0
271
272    load_policy $1
273    [ "$forward" ] && $IPTABLES -A zone_${name}_forward -j zone_${name}_${forward}
274    [ "$input" ] && $IPTABLES -A zone_${name} -j zone_${name}_${input}
275}
276
277fw_zone() {
278    local name
279    local network
280    local mtu_fix
281    local conntrack
282    local masq
283    local masq_src
284    local masq_dest
285
286    config_get name $1 name
287    config_get network $1 network
288    config_get_bool masq $1 masq "0"
289    config_get_bool conntrack $1 conntrack "0"
290    config_get_bool mtu_fix $1 mtu_fix 0
291    config_get masq_src $1 masq_src
292    config_get masq_dest $1 masq_dest
293
294    load_policy $1
295    [ "$conntrack" = "1" -o "$masq" = "1" ] && append CONNTRACK_ZONES "$name"
296    [ -z "$network" ] && network=$name
297
298    create_zone "$name" "$network" "$input" "$output" "$forward" "$mtu_fix" \
299        "$masq" "$masq_src" "$masq_dest"
300
301    fw_custom_chains_zone "$name"
302}
303
304fw_rule() {
305    local src
306    local src_ip
307    local src_mac
308    local src_port
309    local src_mac
310    local dest
311    local dest_ip
312    local dest_port
313    local proto
314    local icmp_type
315    local target
316    local ruleset
317
318    config_get src $1 src
319    config_get src_ip $1 src_ip
320    config_get src_mac $1 src_mac
321    config_get src_port $1 src_port
322    config_get dest $1 dest
323    config_get dest_ip $1 dest_ip
324    config_get dest_port $1 dest_port
325    config_get proto $1 proto
326    config_get icmp_type $1 icmp_type
327    config_get target $1 target
328    config_get ruleset $1 ruleset
329
330    local srcports destports
331    get_portrange srcports "$src_port" ":"
332    get_portrange destports "$dest_port" ":"
333
334    ZONE=input
335    TARGET=$target
336    [ -z "$target" ] && target=DROP
337    [ -n "$src" -a -z "$dest" ] && ZONE=zone_$src
338    [ -n "$src" -a -n "$dest" ] && ZONE=zone_${src}_forward
339    [ -n "$dest" ] && TARGET=zone_${dest}_$target
340
341    eval 'RULE_COUNT=$((++RULE_COUNT_'$ZONE'))'
342
343    add_rule() {
344        $IPTABLES -I $ZONE $RULE_COUNT \
345            ${proto:+-p $proto} \
346            ${icmp_type:+--icmp-type $icmp_type} \
347            ${src_ip:+-s $src_ip} \
348            ${srcports:+--sport $srcports} \
349            ${src_mac:+-m mac --mac-source $src_mac} \
350            ${dest_ip:+-d $dest_ip} \
351            ${destports:+--dport $destports} \
352            -j $TARGET
353    }
354
355    [ "$proto" == "tcpudp" ] && proto="tcp udp"
356    for proto in ${proto:-tcp udp}; do
357        add_rule
358    done
359}
360
361fw_forwarding() {
362    local src
363    local dest
364    local masq
365
366    config_get src $1 src
367    config_get dest $1 dest
368    [ -n "$src" ] && z_src=zone_${src}_forward || z_src=forward
369    [ -n "$dest" ] && z_dest=zone_${dest}_ACCEPT || z_dest=ACCEPT
370    $IPTABLES -I $z_src 1 -j $z_dest
371
372    # propagate masq zone flag
373    find_item "$src" $CONNTRACK_ZONES && append CONNTRACK_ZONES $dest
374    find_item "$dest" $CONNTRACK_ZONES && append CONNTRACK_ZONES $src
375}
376
377fw_redirect() {
378    local src
379    local src_ip
380    local src_dip
381    local src_port
382    local src_dport
383    local src_mac
384    local dest
385    local dest_ip
386    local dest_port
387    local proto
388    local target
389
390    config_get src $1 src
391    config_get src_ip $1 src_ip
392    config_get src_dip $1 src_dip
393    config_get src_port $1 src_port
394    config_get src_dport $1 src_dport
395    config_get src_mac $1 src_mac
396    config_get dest $1 dest
397    config_get dest_ip $1 dest_ip
398    config_get dest_port $1 dest_port
399    config_get proto $1 proto
400    config_get target $1 target
401
402    local fwdchain natchain natopt nataddr natports srcdaddr srcdports
403    if [ "${target:-DNAT}" == "DNAT" ]; then
404        [ -n "$src" -a -n "$dest_ip$dest_port" ] || {
405            echo "DNAT redirect needs src and dest_ip or dest_port"
406            return
407        }
408
409        fwdchain="zone_${src}_forward"
410
411        natopt="--to-destination"
412        natchain="zone_${src}_prerouting"
413        nataddr="$dest_ip"
414        get_portrange natports "$dest_port" "-"
415
416        srcdaddr="$src_dip"
417        get_portrange srcdports "$src_dport" ":"
418
419        find_item "$src" $CONNTRACK_ZONES || \
420            append CONNTRACK_ZONES "$src"
421
422    elif [ "$target" == "SNAT" ]; then
423        [ -n "$dest" -a -n "$src_dip" ] || {
424            echo "SNAT redirect needs dest and src_dip"
425            return
426        }
427
428        fwdchain="${src:+zone_${src}_forward}"
429
430        natopt="--to-source"
431        natchain="zone_${dest}_nat"
432        nataddr="$src_dip"
433        get_portrange natports "$src_dport" "-"
434
435        srcdaddr="$dest_ip"
436        get_portrange srcdports "$dest_port" ":"
437
438        find_item "$dest" $CONNTRACK_ZONES || \
439            append CONNTRACK_ZONES "$dest"
440
441    else
442        echo "redirect target must be either DNAT or SNAT"
443        return
444    fi
445
446    local srcports destports
447    get_portrange srcports "$src_port" ":"
448    get_portrange destports "${dest_port-$src_dport}" ":"
449
450    add_rule() {
451        $IPTABLES -I $natchain 1 -t nat \
452            ${proto:+-p $proto} \
453            ${src_ip:+-s $src_ip} \
454            ${srcports:+--sport $srcports} \
455            ${srcdaddr:+-d $srcdaddr} \
456            ${srcdports:+--dport $srcdports} \
457            ${src_mac:+-m mac --mac-source $src_mac} \
458            -j ${target:-DNAT} $natopt $nataddr${natports:+:$natports}
459
460        [ -n "$dest_ip" ] && \
461        $IPTABLES -I ${fwdchain:-forward} 1 \
462            ${proto:+-p $proto} \
463            ${src_ip:+-s $src_ip} \
464            ${srcports:+--sport $srcports} \
465            ${dest_ip:+-d $dest_ip} \
466            ${destports:+--dport $destports} \
467            ${src_mac:+-m mac --mac-source $src_mac} \
468            -j ACCEPT
469    }
470
471    [ "$proto" == "tcpudp" ] && proto="tcp udp"
472    for proto in ${proto:-tcp udp}; do
473        add_rule
474    done
475}
476
477fw_include() {
478    local path
479    config_get path $1 path
480    [ -e $path ] && . $path
481}
482
483get_interface_zones() {
484    local interface="$2"
485    local name
486    local network
487    local masq_src
488    local masq_dest
489    config_get name $1 name
490    config_get network $1 network
491    config_get masq_src $1 masq_src
492    config_get masq_dest $1 masq_dest
493    [ -z "$network" ] && network=$name
494    for n in $network; do
495        [ "$n" = "$interface" ] && {
496            append add_zone "$name"
497            append add_masq_src "$masq_src"
498            append add_masq_dest "$masq_dest"
499        }
500    done
501}
502
503fw_event() {
504    local action="$1"
505    local interface="$2"
506    local ifname="$(sh -c ". /etc/functions.sh; include /lib/network; scan_interfaces; config_get "$interface" ifname")"
507    local add_zone=
508    local add_masq_src=
509    local add_masq_dest=
510    local up
511
512    [ -z "$ifname" ] && return 0
513    config_foreach get_interface_zones zone "$interface"
514    [ -z "$add_zone" ] && return 0
515
516    case "$action" in
517        ifup)
518            for z in $add_zone; do
519                local loaded masq_src masq_dest
520                config_get loaded core loaded
521                [ -n "$loaded" ] && addif "$interface" "$ifname" "$z" "$add_masq_src" "$add_masq_dest"
522            done
523        ;;
524        ifdown)
525            config_get up "$interface" up
526
527            for z in $ZONE; do
528                local masq_src masq_dest
529                config_get masq_src core "${z}_masq_src"
530                config_get masq_dest core "${z}_masq_dest"
531                [ "$up" == "1" ] && delif "$interface" "$ifname" "$z" "$masq_src" "$masq_dest"
532            done
533        ;;
534    esac
535}
536
537fw_addif() {
538    local up
539    local ifname
540    config_get up $1 up
541    [ -n "$up" ] || return 0
542    fw_event ifup "$1"
543}
544
545fw_custom_chains() {
546    [ -n "$CUSTOM_CHAINS" ] || return 0
547    $IPTABLES -N input_rule
548    $IPTABLES -N output_rule
549    $IPTABLES -N forwarding_rule
550    $IPTABLES -N prerouting_rule -t nat
551    $IPTABLES -N postrouting_rule -t nat
552
553    $IPTABLES -A INPUT -j input_rule
554    $IPTABLES -A OUTPUT -j output_rule
555    $IPTABLES -A FORWARD -j forwarding_rule
556    $IPTABLES -A PREROUTING -t nat -j prerouting_rule
557    $IPTABLES -A POSTROUTING -t nat -j postrouting_rule
558}
559
560fw_custom_chains_zone() {
561    local zone="$1"
562
563    [ -n "$CUSTOM_CHAINS" ] || return 0
564    $IPTABLES -N input_${zone}
565    $IPTABLES -N forwarding_${zone}
566    $IPTABLES -N prerouting_${zone} -t nat
567    $IPTABLES -I zone_${zone} 1 -j input_${zone}
568    $IPTABLES -I zone_${zone}_forward 1 -j forwarding_${zone}
569    $IPTABLES -I zone_${zone}_prerouting 1 -t nat -j prerouting_${zone}
570}
571
572fw_check_notrack() {
573    local zone="$1"
574    config_get name "$zone" name
575    [ -n "$NOTRACK_DISABLED" ] || \
576        find_item "$name" $CONNTRACK_ZONES || \
577        $IPTABLES -t raw -A zone_${name}_notrack -j NOTRACK
578}
579
580fw_init() {
581    DEFAULTS_APPLIED=
582
583    echo "Loading defaults"
584    config_foreach fw_defaults defaults
585    echo "Loading zones"
586    config_foreach fw_zone zone
587    echo "Loading forwarding"
588    config_foreach fw_forwarding forwarding
589    echo "Loading redirects"
590    config_foreach fw_redirect redirect
591    echo "Loading rules"
592    config_foreach fw_rule rule
593    echo "Loading includes"
594    config_foreach fw_include include
595    echo "Loading zone defaults"
596    config_foreach fw_zone_defaults zone
597    uci_set_state firewall core loaded 1
598    config_set core loaded 1
599    config_foreach fw_check_notrack zone
600    INTERFACES="$(sh -c '
601        . /etc/functions.sh; config_load network
602        echo_up() { local up; config_get_bool up "$1" up 0; [ $up = 1 ] && echo "$1"; }
603        config_foreach echo_up interface
604    ')"
605    for interface in $INTERFACES; do
606        fw_event ifup "$interface"
607    done
608}
609
610fw_stop() {
611    fw_clear
612    $IPTABLES -P INPUT ACCEPT
613    $IPTABLES -P OUTPUT ACCEPT
614    $IPTABLES -P FORWARD ACCEPT
615    uci_revert_state firewall
616}
617

Archive Download this file

Branches:
backfire
history
master
release_2010-11-17
release_2010-12-14
release_2011-02-23
release_2011-05-28
release_2011-08-27
release_2011-11-13
release_2012-03-18
release_2012-04-09
release_2012-10-11
uclibc_nptl



interactive