Root/package/firewall/files/lib/core_init.sh

1# Copyright (C) 2009-2011 OpenWrt.org
2# Copyright (C) 2008 John Crispin <blogic@openwrt.org>
3
4FW_INITIALIZED=
5
6FW_ZONES=
7FW_ZONES4=
8FW_ZONES6=
9FW_CONNTRACK_ZONES=
10FW_NOTRACK_DISABLED=
11
12FW_DEFAULTS_APPLIED=
13FW_ADD_CUSTOM_CHAINS=
14FW_ACCEPT_REDIRECTS=
15FW_ACCEPT_SRC_ROUTE=
16
17FW_DEFAULT_INPUT_POLICY=REJECT
18FW_DEFAULT_OUTPUT_POLICY=REJECT
19FW_DEFAULT_FORWARD_POLICY=REJECT
20
21FW_DISABLE_IPV4=0
22FW_DISABLE_IPV6=0
23
24
25fw_load_defaults() {
26    fw_config_get_section "$1" defaults { \
27        string input $FW_DEFAULT_INPUT_POLICY \
28        string output $FW_DEFAULT_OUTPUT_POLICY \
29        string forward $FW_DEFAULT_FORWARD_POLICY \
30        boolean drop_invalid 0 \
31        boolean syn_flood 0 \
32        boolean synflood_protect 0 \
33        string synflood_rate 25 \
34        string synflood_burst 50 \
35        boolean tcp_syncookies 1 \
36        boolean tcp_ecn 0 \
37        boolean tcp_westwood 0 \
38        boolean tcp_window_scaling 1 \
39        boolean accept_redirects 0 \
40        boolean accept_source_route 0 \
41        boolean custom_chains 1 \
42        boolean disable_ipv6 0 \
43    } || return
44    [ -n "$FW_DEFAULTS_APPLIED" ] && {
45        fw_log error "duplicate defaults section detected, skipping"
46        return 1
47    }
48    FW_DEFAULTS_APPLIED=1
49
50    FW_DEFAULT_INPUT_POLICY=$defaults_input
51    FW_DEFAULT_OUTPUT_POLICY=$defaults_output
52    FW_DEFAULT_FORWARD_POLICY=$defaults_forward
53
54    FW_ADD_CUSTOM_CHAINS=$defaults_custom_chains
55
56    FW_ACCEPT_REDIRECTS=$defaults_accept_redirects
57    FW_ACCEPT_SRC_ROUTE=$defaults_accept_source_route
58
59    FW_DISABLE_IPV6=$defaults_disable_ipv6
60
61    fw_callback pre defaults
62
63    # Seems like there are only one sysctl for both IP versions.
64    for s in syncookies ecn westwood window_scaling; do
65        eval "sysctl -e -w net.ipv4.tcp_${s}=\$defaults_tcp_${s}" >/dev/null
66    done
67    fw_sysctl_interface all
68
69    fw add i f INPUT ACCEPT { -m conntrack --ctstate RELATED,ESTABLISHED }
70    fw add i f OUTPUT ACCEPT { -m conntrack --ctstate RELATED,ESTABLISHED }
71    fw add i f FORWARD ACCEPT { -m conntrack --ctstate RELATED,ESTABLISHED }
72
73    [ $defaults_drop_invalid == 1 ] && {
74        fw add i f INPUT DROP { -m conntrack --ctstate INVALID }
75        fw add i f OUTPUT DROP { -m conntrack --ctstate INVALID }
76        fw add i f FORWARD DROP { -m conntrack --ctstate INVALID }
77        FW_NOTRACK_DISABLED=1
78    }
79
80    fw add i f INPUT ACCEPT { -i lo }
81    fw add i f OUTPUT ACCEPT { -o lo }
82
83    # Compatibility to old 'syn_flood' parameter
84    [ $defaults_syn_flood == 1 ] && \
85        defaults_synflood_protect=1
86
87    [ "${defaults_synflood_rate%/*}" == "$defaults_synflood_rate" ] && \
88        defaults_synflood_rate="$defaults_synflood_rate/second"
89
90    [ $defaults_synflood_protect == 1 ] && {
91        echo "Loading synflood protection"
92        fw_callback pre synflood
93        fw add i f syn_flood
94        fw add i f syn_flood RETURN { \
95            -p tcp --syn \
96            -m limit --limit "${defaults_synflood_rate}" --limit-burst "${defaults_synflood_burst}" \
97        }
98        fw add i f syn_flood DROP
99        fw add i f INPUT syn_flood { -p tcp --syn }
100        fw_callback post synflood
101    }
102
103    [ $defaults_custom_chains == 1 ] && {
104        echo "Adding custom chains"
105        fw add i f input_rule
106        fw add i f output_rule
107        fw add i f forwarding_rule
108        fw add i n prerouting_rule
109        fw add i n postrouting_rule
110
111        fw add i f INPUT input_rule
112        fw add i f OUTPUT output_rule
113        fw add i f FORWARD forwarding_rule
114        fw add i n PREROUTING prerouting_rule
115        fw add i n POSTROUTING postrouting_rule
116    }
117
118    fw add i f input
119    fw add i f output
120    fw add i f forward
121
122    fw add i f INPUT input
123    fw add i f OUTPUT output
124    fw add i f FORWARD forward
125
126    fw add i f reject
127    fw add i f reject REJECT { --reject-with tcp-reset -p tcp }
128    fw add i f reject REJECT { --reject-with port-unreach }
129
130    fw_set_filter_policy
131
132    fw_callback post defaults
133}
134
135
136fw_config_get_zone() {
137    [ "${zone_NAME}" != "$1" ] || return
138    fw_config_get_section "$1" zone { \
139        string name "$1" \
140        string network "" \
141        string input "$FW_DEFAULT_INPUT_POLICY" \
142        string output "$FW_DEFAULT_OUTPUT_POLICY" \
143        string forward "$FW_DEFAULT_FORWARD_POLICY" \
144        boolean masq 0 \
145        string masq_src "" \
146        string masq_dest "" \
147        boolean conntrack 0 \
148        boolean mtu_fix 0 \
149        boolean custom_chains "$FW_ADD_CUSTOM_CHAINS" \
150        boolean log 0 \
151        string log_limit 10 \
152        string family "" \
153    } || return
154    [ -n "$zone_name" ] || zone_name=$zone_NAME
155    [ -n "$zone_network" ] || zone_network=$zone_name
156}
157
158fw_load_zone() {
159    fw_config_get_zone "$1"
160
161    list_contains FW_ZONES $zone_name && {
162        fw_log error "zone ${zone_name}: duplicated zone, skipping"
163        return 0
164    }
165    append FW_ZONES $zone_name
166
167    fw_callback pre zone
168
169    [ $zone_conntrack = 1 -o $zone_masq = 1 ] && \
170        append FW_CONNTRACK_ZONES "$zone_name"
171
172    local mode
173    case "$zone_family" in
174        *4)
175            mode=4
176            append FW_ZONES4 $zone_name
177            uci_set_state firewall core ${zone_name}_ipv4 1
178        ;;
179        *6)
180            mode=6
181            append FW_ZONES6 $zone_name
182            uci_set_state firewall core ${zone_name}_ipv6 1
183        ;;
184        *)
185            mode=i
186            append FW_ZONES4 $zone_name
187            append FW_ZONES6 $zone_name
188            uci_set_state firewall core ${zone_name}_ipv4 1
189            uci_set_state firewall core ${zone_name}_ipv6 1
190        ;;
191    esac
192
193    local chain=zone_${zone_name}
194
195    fw add $mode f ${chain}_ACCEPT
196    fw add $mode f ${chain}_DROP
197    fw add $mode f ${chain}_REJECT
198
199    # TODO: Rename to ${chain}_input
200    fw add $mode f ${chain}
201    fw add $mode f ${chain} ${chain}_${zone_input} $
202
203    fw add $mode f ${chain}_forward
204    fw add $mode f ${chain}_forward ${chain}_${zone_forward} $
205
206    # TODO: add ${chain}_output
207    fw add $mode f output ${chain}_${zone_output} $
208
209    # TODO: Rename to ${chain}_MASQUERADE
210    fw add $mode n ${chain}_nat
211    fw add $mode n ${chain}_prerouting
212
213    fw add $mode r ${chain}_notrack
214
215    [ $zone_mtu_fix == 1 ] && {
216        fw add $mode m ${chain}_MSSFIX
217        fw add $mode m FORWARD ${chain}_MSSFIX ^
218        uci_set_state firewall core ${zone_name}_tcpmss 1
219    }
220
221    [ $zone_custom_chains == 1 ] && {
222        [ $FW_ADD_CUSTOM_CHAINS == 1 ] || \
223            fw_die "zone ${zone_name}: custom_chains globally disabled"
224
225        fw add $mode f input_${zone_name}
226        fw add $mode f ${chain} input_${zone_name} ^
227
228        fw add $mode f forwarding_${zone_name}
229        fw add $mode f ${chain}_forward forwarding_${zone_name} ^
230
231        fw add $mode n prerouting_${zone_name}
232        fw add $mode n ${chain}_prerouting prerouting_${zone_name} ^
233    }
234
235    [ "$zone_log" == 1 ] && {
236        [ "${zone_log_limit%/*}" == "$zone_log_limit" ] && \
237            zone_log_limit="$zone_log_limit/minute"
238
239        local t
240        for t in REJECT DROP; do
241            fw add $mode f ${chain}_${t} LOG ^ \
242                { -m limit --limit $zone_log_limit --log-prefix "$t($zone_name): " }
243        done
244
245        [ $zone_mtu_fix == 1 ] && \
246            fw add $mode m ${chain}_MSSFIX LOG ^ \
247                { -m limit --limit $zone_log_limit --log-prefix "MSSFIX($zone_name): " }
248    }
249
250    # NB: if MASQUERADING for IPv6 becomes available we'll need a family check here
251    if [ "$zone_masq" == 1 ]; then
252        local msrc mdst
253        for msrc in ${zone_masq_src:-0.0.0.0/0}; do
254            case "$msrc" in
255                *.*) fw_get_negation msrc '-s' "$msrc" ;;
256                *) fw_get_subnet4 msrc '-s' "$msrc" || break ;;
257            esac
258
259            for mdst in ${zone_masq_dest:-0.0.0.0/0}; do
260                case "$mdst" in
261                    *.*) fw_get_negation mdst '-d' "$mdst" ;;
262                    *) fw_get_subnet4 mdst '-d' "$mdst" || break ;;
263                esac
264
265                fw add $mode n ${chain}_nat MASQUERADE $ { $msrc $mdst }
266            done
267        done
268    fi
269
270    fw_callback post zone
271}
272
273fw_load_notrack_zone() {
274    fw_config_get_zone "$1"
275    list_contains FW_CONNTRACK_ZONES "${zone_name}" && return
276
277    fw_callback pre notrack
278
279    fw add i r zone_${zone_name}_notrack NOTRACK $
280
281    fw_callback post notrack
282}
283
284
285fw_load_include() {
286    local name="$1"
287
288    local path
289    config_get path ${name} path
290
291    [ -e $path ] && (
292        config() {
293            fw_log error "You cannot use UCI in firewall includes!" >&2
294            exit 1
295        }
296        . $path
297    )
298}
299
300
301fw_clear() {
302    local policy=$1
303
304    fw_set_filter_policy $policy
305
306    local tab
307    for tab in f n r; do
308        fw del i $tab
309    done
310}
311
312fw_set_filter_policy() {
313    local policy=$1
314
315    local chn tgt
316    for chn in INPUT OUTPUT FORWARD; do
317        eval "tgt=\${policy:-\${FW_DEFAULT_${chn}_POLICY}}"
318        [ $tgt == "REJECT" ] && tgt=reject
319        [ $tgt == "ACCEPT" -o $tgt == "DROP" ] || {
320            fw add i f $chn $tgt $
321            tgt=DROP
322        }
323        fw policy i f $chn $tgt
324    done
325}
326
327
328fw_callback() {
329    local pp=$1
330    local hk=$2
331
332    local libs lib
333    eval "libs=\$FW_CB_${pp}_${hk}"
334    [ -n "$libs" ] || return
335    for lib in $libs; do
336        ${lib}_${pp}_${hk}_cb
337    done
338}
339

Archive Download this file

Branches:
backfire
history
master
release_2010-11-17
release_2010-12-14
release_2011-02-23
release_2011-05-28
release_2011-08-27
release_2011-11-13
release_2012-03-18
release_2012-04-09
release_2012-10-11
uclibc_nptl



interactive