| 1 | # Copyright (C) 2009-2010 OpenWrt.org |
| 2 | # Copyright (C) 2009 Malte S. Stretz |
| 3 | |
| 4 | export FW_4_ERROR=0 |
| 5 | export FW_6_ERROR=0 |
| 6 | export FW_i_ERROR=0 |
| 7 | export FW_e_ERROR=0 |
| 8 | export FW_a_ERROR=0 |
| 9 | |
| 10 | #TODO: remove this |
| 11 | [ "${-#*x}" == "$-" ] && { |
| 12 | fw() { |
| 13 | fw__exec "$@" |
| 14 | } |
| 15 | } || { |
| 16 | fw() { |
| 17 | local os=$- |
| 18 | set +x |
| 19 | fw__exec "$@" |
| 20 | local rc=$? |
| 21 | set -$os |
| 22 | return $rc |
| 23 | } |
| 24 | } |
| 25 | |
| 26 | fw__exec() { # <action> <family> <table> <chain> <target> <position> { <rules> } |
| 27 | local cmd fam tab chn tgt pos |
| 28 | local i |
| 29 | for i in cmd fam tab chn tgt pos; do |
| 30 | if [ "$1" -a "$1" != '{' ]; then |
| 31 | eval "$i='$1'" |
| 32 | shift |
| 33 | else |
| 34 | eval "$i=-" |
| 35 | fi |
| 36 | done |
| 37 | |
| 38 | fw__rc() { |
| 39 | export FW_${fam#G}_ERROR=$1 |
| 40 | return $1 |
| 41 | } |
| 42 | |
| 43 | fw__dualip() { |
| 44 | fw $cmd 4 $tab $chn $tgt $pos "$@" |
| 45 | fw $cmd 6 $tab $chn $tgt $pos "$@" |
| 46 | fw__rc $((FW_4_ERROR | FW_6_ERROR)) |
| 47 | } |
| 48 | |
| 49 | fw__autoip() { |
| 50 | local ip4 ip6 |
| 51 | shift |
| 52 | while [ "$1" != '}' ]; do |
| 53 | case "$1" in |
| 54 | *:*) ip6=1 ;; |
| 55 | *.*.*.*) ip4=1 ;; |
| 56 | esac |
| 57 | shift |
| 58 | done |
| 59 | shift |
| 60 | if [ "${ip4:-4}" == "${ip6:-6}" ]; then |
| 61 | echo "fw: can't mix ip4 and ip6" >&2 |
| 62 | return 1 |
| 63 | fi |
| 64 | local ver=${ip4:+4}${ip6:+6} |
| 65 | fam=i |
| 66 | fw $cmd ${ver:-i} $tab $chn $tgt $pos "$@" |
| 67 | fw__rc $? |
| 68 | } |
| 69 | |
| 70 | fw__has() { |
| 71 | local tab=${1:-$tab} |
| 72 | if [ $tab == '-' ]; then |
| 73 | type $app > /dev/null 2> /dev/null |
| 74 | fw__rc $(($? & 1)) |
| 75 | return |
| 76 | fi |
| 77 | local mod |
| 78 | eval "mod=\$FW_${fam#G}_${tab}" |
| 79 | if [ "$mod" ]; then |
| 80 | fw__rc $mod |
| 81 | return |
| 82 | fi |
| 83 | case "$fam" in |
| 84 | *4) mod=iptable_${tab} ;; |
| 85 | *6) mod=ip6table_${tab} ;; |
| 86 | *) mod=. ;; |
| 87 | esac |
| 88 | grep -q "^${mod} " /proc/modules |
| 89 | mod=$? |
| 90 | export FW_${fam}_${tab}=$mod |
| 91 | fw__rc $mod |
| 92 | } |
| 93 | |
| 94 | fw__err() { |
| 95 | local err |
| 96 | eval "err=\$FW_${fam}_ERROR" |
| 97 | fw__rc $err |
| 98 | } |
| 99 | |
| 100 | local app= |
| 101 | local pol= |
| 102 | case "$fam" in |
| 103 | *4) [ $FW_DISABLE_IPV4 == 0 ] && app=iptables || return ;; |
| 104 | *6) [ $FW_DISABLE_IPV6 == 0 ] && app=ip6tables || return ;; |
| 105 | i) fw__dualip "$@"; return ;; |
| 106 | I) fw__autoip "$@"; return ;; |
| 107 | e) app=ebtables ;; |
| 108 | a) app=arptables ;; |
| 109 | -) fw $cmd i $tab $chn $tgt $pos "$@"; return ;; |
| 110 | *) return 254 ;; |
| 111 | esac |
| 112 | case "$tab" in |
| 113 | f) tab=filter ;; |
| 114 | m) tab=mangle ;; |
| 115 | n) tab=nat ;; |
| 116 | r) tab=raw ;; |
| 117 | -) tab=filter ;; |
| 118 | esac |
| 119 | case "$cmd:$chn:$tgt:$pos" in |
| 120 | add:*:-:*) cmd=new-chain ;; |
| 121 | add:*:*:-) cmd=append ;; |
| 122 | add:*:*:$) cmd=append ;; |
| 123 | add:*:*:*) cmd=insert ;; |
| 124 | del:-:*:*) cmd=delete-chain; fw flush $fam $tab ;; |
| 125 | del:*:-:*) cmd=delete-chain; fw flush $fam $tab $chn ;; |
| 126 | del:*:*:*) cmd=delete ;; |
| 127 | flush:*) ;; |
| 128 | policy:*) pol=$tgt; tgt=- ;; |
| 129 | has:*) fw__has; return ;; |
| 130 | err:*) fw__err; return ;; |
| 131 | list:*) cmd="numeric --verbose --$cmd" ;; |
| 132 | *) return 254 ;; |
| 133 | esac |
| 134 | case "$chn" in |
| 135 | -) chn= ;; |
| 136 | esac |
| 137 | case "$tgt" in |
| 138 | -) tgt= ;; |
| 139 | esac |
| 140 | case "$pos" in |
| 141 | ^) pos=1 ;; |
| 142 | $) pos= ;; |
| 143 | -) pos= ;; |
| 144 | esac |
| 145 | |
| 146 | if ! fw__has - family || ! fw__has $tab ; then |
| 147 | export FW_${fam}_ERROR=0 |
| 148 | return 0 |
| 149 | fi |
| 150 | |
| 151 | case "$fam" in |
| 152 | G*) shift; while [ $# -gt 0 ] && [ "$1" != "{" ]; do shift; done ;; |
| 153 | esac |
| 154 | |
| 155 | if [ $# -gt 0 ]; then |
| 156 | shift |
| 157 | if [ $cmd == delete ]; then |
| 158 | pos= |
| 159 | fi |
| 160 | fi |
| 161 | |
| 162 | local cmdline="$app --table ${tab} --${cmd} ${chn} ${pol} ${pos} ${tgt:+--jump "$tgt"}" |
| 163 | while [ $# -gt 1 ]; do |
| 164 | case "$app:$1" in |
| 165 | ip6tables:--icmp-type) cmdline="$cmdline --icmpv6-type" ;; |
| 166 | ip6tables:icmp|ip6tables:ICMP) cmdline="$cmdline icmpv6" ;; |
| 167 | iptables:--icmpv6-type) cmdline="$cmdline --icmp-type" ;; |
| 168 | iptables:icmpv6) cmdline="$cmdline icmp" ;; |
| 169 | *) cmdline="$cmdline $1" ;; |
| 170 | esac |
| 171 | shift |
| 172 | done |
| 173 | |
| 174 | [ -n "$FW_TRACE" ] && echo $cmdline >&2 |
| 175 | |
| 176 | $cmdline |
| 177 | |
| 178 | fw__rc $? |
| 179 | } |
| 180 | |
| 181 | fw_get_port_range() { |
| 182 | local _var=$1 |
| 183 | local _ports=$2 |
| 184 | local _delim=${3:-:} |
| 185 | if [ "$4" ]; then |
| 186 | fw_get_port_range $_var "${_ports}-${4}" $_delim |
| 187 | return |
| 188 | fi |
| 189 | |
| 190 | local _first=${_ports%-*} |
| 191 | local _last=${_ports#*-} |
| 192 | if [ "$_first" != "$_last" ]; then |
| 193 | export -- "$_var=$_first$_delim$_last" |
| 194 | else |
| 195 | export -- "$_var=$_first" |
| 196 | fi |
| 197 | } |
| 198 | |
| 199 | fw_get_family_mode() { |
| 200 | local _var="$1" |
| 201 | local _hint="$2" |
| 202 | local _zone="$3" |
| 203 | local _mode="$4" |
| 204 | |
| 205 | local _ipv4 _ipv6 |
| 206 | [ -n "$FW_ZONES4$FW_ZONES6" ] && { |
| 207 | list_contains FW_ZONES4 $_zone && _ipv4=1 || _ipv4=0 |
| 208 | list_contains FW_ZONES6 $_zone && _ipv6=1 || _ipv6=0 |
| 209 | } || { |
| 210 | _ipv4=$(uci_get_state firewall core ${_zone}_ipv4 0) |
| 211 | _ipv6=$(uci_get_state firewall core ${_zone}_ipv6 0) |
| 212 | } |
| 213 | |
| 214 | case "$_hint:$_ipv4:$_ipv6" in |
| 215 | *4:1:*|*:1:0) export -n -- "$_var=G4" ;; |
| 216 | *6:*:1|*:0:1) export -n -- "$_var=G6" ;; |
| 217 | *) export -n -- "$_var=$_mode" ;; |
| 218 | esac |
| 219 | } |
| 220 | |
| 221 | fw_get_negation() { |
| 222 | local _var="$1" |
| 223 | local _flag="$2" |
| 224 | local _ipaddr="$3" |
| 225 | |
| 226 | [ "${_ipaddr#!}" != "$_ipaddr" ] && \ |
| 227 | export -n -- "$_var=! $_flag ${_ipaddr#!}" || \ |
| 228 | export -n -- "$_var=${_ipaddr:+$_flag $_ipaddr}" |
| 229 | } |
| 230 | |
