PKG_NAME:=firewall
PKG_VERSION:=2
-PKG_RELEASE:=57
+PKG_RELEASE:=58
include $(INCLUDE_DIR)/package.mk
fw_callback pre forwarding
- local chain=forward
+ local chain=delegate_forward
[ -n "$forwarding_src" ] && {
chain=zone_${forwarding_src}_forward
}
local target=ACCEPT
[ -n "$forwarding_dest" ] && {
- target=zone_${forwarding_dest}_ACCEPT
+ target=zone_${forwarding_dest}_dest_ACCEPT
}
local mode
fw add i n POSTROUTING postrouting_rule
}
- fw add i f input
- fw add i f output
- fw add i f forward
+ fw add i f delegate_input
+ fw add i f delegate_output
+ fw add i f delegate_forward
- fw add i f INPUT input
- fw add i f OUTPUT output
- fw add i f FORWARD forward
+ fw add i f INPUT delegate_input
+ fw add i f OUTPUT delegate_output
+ fw add i f FORWARD delegate_forward
fw add i f reject
fw add i f reject REJECT { --reject-with tcp-reset -p tcp }
fw_config_get_section "$1" zone { \
string name "$1" \
string network "" \
+ string device "" \
+ string subnet "" \
string input "$FW_DEFAULT_INPUT_POLICY" \
string output "$FW_DEFAULT_OUTPUT_POLICY" \
string forward "$FW_DEFAULT_FORWARD_POLICY" \
boolean masq 0 \
string masq_src "" \
string masq_dest "" \
+ string extra "" \
+ string extra_src "" \
+ string extra_dest "" \
boolean conntrack 0 \
boolean mtu_fix 0 \
- boolean custom_chains "$FW_ADD_CUSTOM_CHAINS" \
+ boolean custom_chains 0 \
boolean log 0 \
string log_limit 10 \
string family "" \
} || return
[ -n "$zone_name" ] || zone_name=$zone_NAME
- [ -n "$zone_network" ] || zone_network=$zone_name
+ [ -n "$zone_extra_src" ] || zone_extra_src="$zone_extra"
+ [ -n "$zone_extra_dest" ] || zone_extra_dest="$zone_extra"
+ [ -n "$zone_network$zone_subnet$zone_device$zone_extra_src$zone_extra_dest" ] || zone_network=$zone_name
}
fw_load_zone() {
local chain=zone_${zone_name}
- fw add $mode f ${chain}_ACCEPT
- fw add $mode f ${chain}_DROP
- fw add $mode f ${chain}_REJECT
+ fw add $mode f ${chain}_src_ACCEPT
+ fw add $mode f ${chain}_src_DROP
+ fw add $mode f ${chain}_src_REJECT
- # TODO: Rename to ${chain}_input
- fw add $mode f ${chain}
- fw add $mode f ${chain} ${chain}_${zone_input} $
+ fw add $mode f ${chain}_dest_ACCEPT
+ fw add $mode f ${chain}_dest_DROP
+ fw add $mode f ${chain}_dest_REJECT
+
+ fw add $mode f ${chain}_input
+ fw add $mode f ${chain}_input ${chain}_src_${zone_input} $
fw add $mode f ${chain}_forward
- fw add $mode f ${chain}_forward ${chain}_${zone_forward} $
+ fw add $mode f ${chain}_forward ${chain}_dest_${zone_forward} $
- # TODO: add ${chain}_output
- fw add $mode f output ${chain}_${zone_output} $
+ fw add $mode f ${chain}_output
+ fw add $mode f ${chain}_output ${chain}_dest_${zone_output} $
# TODO: Rename to ${chain}_MASQUERADE
fw add $mode n ${chain}_nat
fw_die "zone ${zone_name}: custom_chains globally disabled"
fw add $mode f input_${zone_name}
- fw add $mode f ${chain} input_${zone_name} ^
+ fw add $mode f ${chain}_input input_${zone_name} ^
fw add $mode f forwarding_${zone_name}
fw add $mode f ${chain}_forward forwarding_${zone_name} ^
local t
for t in REJECT DROP; do
- fw add $mode f ${chain}_${t} LOG ^ \
- { -m limit --limit $zone_log_limit --log-prefix "$t($zone_name): " }
+ local d
+ for d in src dest; do
+ fw add $mode f ${chain}_${d}_${t} LOG ^ \
+ { -m limit --limit $zone_log_limit --log-prefix "$t($d $zone_name): " }
+ done
done
[ $zone_mtu_fix == 1 ] && \
fw add $mode m ${chain}_MSSFIX LOG ^ \
- { -m limit --limit $zone_log_limit --log-prefix "MSSFIX($zone_name): " }
+ { -p tcp --tcp-flags SYN,RST SYN -m limit --limit $zone_log_limit --log-prefix "MSSFIX($zone_name): " }
}
# NB: if MASQUERADING for IPv6 becomes available we'll need a family check here
done
fi
+ local dev
+ for dev in ${zone_device:-""}; do
+ local net
+ for net in ${zone_subnet:-""}; do
+ [ -n "$dev" ] || [ -n "$net" ] || continue
+ fw_do_interface_rules add "${zone_name}" "$dev" "$net" \
+ "${zone_extra_src}" "${zone_extra_dest}"
+ done
+ done
+
fw_callback post zone
}
fw_log error "You cannot use UCI in firewall includes!" >&2
exit 1
}
- . $path
+ . $path
)
}
-# Copyright (C) 2009-2012 OpenWrt.org
+# Copyright (C) 2009-2013 OpenWrt.org
fw__uci_state_add() {
local var="$1"
uci_toggle_state firewall core $var "$rest"
}
+fw_do_interface_rules() {
+ local action=$1
+ local zone=$2
+ local chain=zone_${zone}
+ local ifname=$3
+ local subnet=$4
+ local extra_src="$5"
+ local extra_dest="$6"
+
+ local idev odev inet onet mode
+ fw_get_family_mode mode x $zone i
+
+ fw_get_negation idev '-i' "$ifname"
+ fw_get_negation odev '-o' "$ifname"
+
+ case "$mode/$subnet" in
+ # Zone supports v6 only or dual, need v6
+ G6/*:*|i/*:*)
+ fw_get_negation inet '-s' "$subnet"
+ fw_get_negation onet '-d' "$subnet"
+ mode=6
+ ;;
+
+ # Zone supports v4 only or dual, need v4
+ G4/*.*.*.*|i/*.*.*.*)
+ fw_get_negation inet '-s' "$subnet"
+ fw_get_negation onet '-d' "$subnet"
+ mode=4
+ ;;
+
+ # Need v6 while zone is v4
+ */*:*) fw_log info "zone $zone does not support IPv6 address family, skipping"; return ;;
+
+ # Need v4 while zone is v6
+ */*.*) fw_log info "zone $zone does not support IPv4 address family, skipping"; return ;;
+
+ # Strip prefix
+ *) mode="${mode#G}" ;;
+ esac
+
+ lock /var/run/firewall-interface.lock
+
+ fw $action $mode f ${chain}_dest_ACCEPT ACCEPT $ { $odev $onet $extra_dest }
+ fw $action $mode f ${chain}_src_ACCEPT ACCEPT $ { $idev $inet $extra_src }
+ fw $action $mode f ${chain}_dest_DROP DROP $ { $odev $onet $extra_dest }
+ fw $action $mode f ${chain}_src_DROP DROP $ { $idev $inet $extra_src }
+ fw $action $mode f ${chain}_dest_REJECT reject $ { $odev $onet $extra_dest }
+ fw $action $mode f ${chain}_src_REJECT reject $ { $idev $inet $extra_src }
+
+ [ "$(uci_get_state firewall core "${zone}_tcpmss")" == 1 ] && \
+ fw $action $mode m ${chain}_MSSFIX TCPMSS $ \
+ { $odev -p tcp --tcp-flags SYN,RST SYN --clamp-mss-to-pmtu $onet $extra_dest }
+
+ fw $action $mode f delegate_input ${chain}_input $ { $idev $inet $extra_src }
+ fw $action $mode f delegate_forward ${chain}_forward $ { $idev $inet $extra_src }
+ fw $action $mode f delegate_output ${chain}_output $ { $odev $onet $extra_dest }
+
+ fw $action $mode n PREROUTING ${chain}_prerouting $ { $idev $inet $extra_src }
+ fw $action $mode r PREROUTING ${chain}_notrack $ { $idev $inet $extra_src }
+ fw $action $mode n POSTROUTING ${chain}_nat $ { $odev $onet $extra_dest }
+
+ # Flush conntrack table
+ echo f >/proc/net/nf_conntrack 2>/dev/null
+
+ lock -u /var/run/firewall-interface.lock
+}
+
fw_configure_interface() {
local iface=$1
local action=$2
fw_callback pre interface
- fw__do_rules() {
- local action=$1
- local zone=$2
- local chain=zone_${zone}
- local ifname=$3
- local subnet=$4
-
- local inet onet mode
- fw_get_family_mode mode x $zone i
-
- case "$mode/$subnet" in
- # Zone supports v6 only or dual, need v6
- G6/*:*|i/*:*)
- inet="-s $subnet -d ::/0"
- onet="-s ::/0 -d $subnet"
- mode=6
- ;;
-
- # Zone supports v4 only or dual, need v4
- G4/*.*.*.*|i/*.*.*.*)
- inet="-s $subnet -d 0.0.0.0/0"
- onet="-s 0.0.0.0/0 -d $subnet"
- mode=4
- ;;
-
- # Need v6 while zone is v4
- */*:*) fw_log info "zone $zone does not support IPv6 address family, skipping"; return ;;
-
- # Need v4 while zone is v6
- */*.*) fw_log info "zone $zone does not support IPv4 address family, skipping"; return ;;
-
- # Strip prefix
- *) mode="${mode#G}" ;;
- esac
-
- lock /var/run/firewall-interface.lock
-
- fw $action $mode f ${chain}_ACCEPT ACCEPT $ { -o "$ifname" $onet }
- fw $action $mode f ${chain}_ACCEPT ACCEPT $ { -i "$ifname" $inet }
- fw $action $mode f ${chain}_DROP DROP $ { -o "$ifname" $onet }
- fw $action $mode f ${chain}_DROP DROP $ { -i "$ifname" $inet }
- fw $action $mode f ${chain}_REJECT reject $ { -o "$ifname" $onet }
- fw $action $mode f ${chain}_REJECT reject $ { -i "$ifname" $inet }
-
- [ "$(uci_get_state firewall core "${zone}_tcpmss")" == 1 ] && \
- fw $action $mode m ${chain}_MSSFIX TCPMSS $ \
- { -o "$ifname" -p tcp --tcp-flags SYN,RST SYN --clamp-mss-to-pmtu $onet }
-
- fw $action $mode f input ${chain} $ { -i "$ifname" $inet }
- fw $action $mode f forward ${chain}_forward $ { -i "$ifname" $inet }
- fw $action $mode n PREROUTING ${chain}_prerouting $ { -i "$ifname" $inet }
- fw $action $mode r PREROUTING ${chain}_notrack $ { -i "$ifname" $inet }
- fw $action $mode n POSTROUTING ${chain}_nat $ { -o "$ifname" $onet }
-
- # Flush conntrack table
- echo f >/proc/net/nf_conntrack 2>/dev/null
-
- lock -u /var/run/firewall-interface.lock
- }
-
local old_zones old_ifname old_subnets
config_get old_zones core "${iface}_zone"
[ -n "$old_zones" ] && {
local n
for n in ${old_subnets:-""}; do
fw_log info "removing $iface ($old_ifname${n:+ alias $n}) from zone $z"
- fw__do_rules del $z $old_ifname $n
+ fw_do_interface_rules del $z $old_ifname $n
done
[ -n "$old_subnets" ] || {
list_contains zone_network "$iface" || return
fw_log info "adding $iface ($ifname${aliasnet:+ alias $aliasnet}) to zone $zone_name"
- fw__do_rules add ${zone_name} "$ifname" "$aliasnet"
+ fw_do_interface_rules add ${zone_name} "$ifname" "$aliasnet"
append new_zones $zone_name
[ -n "$aliasnet" ] || {
sysctl -w net.ipv6.conf.${ifname}.accept_source_route=$FW_ACCEPT_SRC_ROUTE
} >/dev/null 2>/dev/null
}
-
# in this case match only DNATed traffic and allow it on input, not forward
if [ -z "$redirect_dest_ip" ] || /sbin/ifconfig | grep -qE "addr:${redirect_dest_ip//./\\.}\b"; then
fwdopt="-m conntrack --ctstate DNAT"
- fwdchain="zone_${redirect_src}"
+ fwdchain="zone_${redirect_src}_input"
else
fwdchain="zone_${redirect_src}_forward"
fi
$redirect_options \
}
- fw add $mode f ${fwdchain:-forward} ACCEPT + \
+ fw add $mode f ${fwdchain:-delegate_forward} ACCEPT + \
{ $redirect_src_ip $redirect_dest_ip } { \
$srcaddr $destaddr \
$pr \
fw_callback pre rule
local table=f
- local chain=input
+ local chain=delegate_output
local target="${rule_target:-REJECT}"
if [ "$target" == "NOTRACK" ]; then
table=r
else
if [ -n "$rule_src" ]; then
if [ "$rule_src" != "*" ]; then
- chain="zone_${rule_src}${rule_dest:+_forward}"
+ if [ -n "$rule_dest" ]; then
+ chain="zone_${rule_src}_forward"
+ else
+ chain="zone_${rule_src}_input"
+ fi
else
- chain="${rule_dest:+forward}"
- chain="${chain:-input}"
+ chain="${rule_dest:+delegate_forward}"
+ chain="${chain:-delegate_input}"
fi
fi
if [ -n "$rule_dest" ]; then
if [ "$rule_dest" != "*" ]; then
- target="zone_${rule_dest}_${target}"
+ target="zone_${rule_dest}_dest_${target}"
+ if [ -z "$rule_src" ]; then
+ chain="zone_${rule_dest}_output"
+ fi
elif [ "$target" = REJECT ]; then
target=reject
fi
fw_log info "ICMP type '$2' is not valid for $fam address family, skipping rule"
return 1
fi
- shift
+ shift
;;
*) cmdline="$cmdline $1" ;;
esac
projects / openwrt / staging / adrian.git / commitdiff