From ff3dddf2da7efbd25e7accc80366480cb3f39611 Mon Sep 17 00:00:00 2001 From: Markus Stenberg Date: Fri, 30 May 2014 13:11:49 +0300 Subject: [PATCH] miniupnpd: Added based on latest 20140523 version + IPv6 pinhole/SSL compilation patches. --- miniupnpd/Makefile | 68 ++++++++ miniupnpd/files/firewall.include | 38 +++++ miniupnpd/files/miniupnpd.defaults | 13 ++ miniupnpd/files/miniupnpd.hotplug | 14 ++ miniupnpd/files/miniupnpd.init | 197 +++++++++++++++++++++++ miniupnpd/files/upnpd.config | 26 +++ miniupnpd/patches/100-no-ssl.patch | 14 ++ miniupnpd/patches/101-ipv6-pinhole.patch | 13 ++ 8 files changed, 383 insertions(+) create mode 100644 miniupnpd/Makefile create mode 100644 miniupnpd/files/firewall.include create mode 100644 miniupnpd/files/miniupnpd.defaults create mode 100644 miniupnpd/files/miniupnpd.hotplug create mode 100644 miniupnpd/files/miniupnpd.init create mode 100644 miniupnpd/files/upnpd.config create mode 100644 miniupnpd/patches/100-no-ssl.patch create mode 100644 miniupnpd/patches/101-ipv6-pinhole.patch diff --git a/miniupnpd/Makefile b/miniupnpd/Makefile new file mode 100644 index 0000000..a26283e --- /dev/null +++ b/miniupnpd/Makefile @@ -0,0 +1,68 @@ +# +# Copyright (C) 2006-2014 OpenWrt.org +# +# This is free software, licensed under the GNU General Public License v2. +# See /LICENSE for more information. +# + +include $(TOPDIR)/rules.mk + +PKG_NAME:=miniupnpd +PKG_VERSION:=1.8.20140523 +PKG_RELEASE:=1 + +PKG_SOURCE_URL:=http://miniupnp.free.fr/files +PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz +PKG_MD5SUM:=fcac89e11da091b1cc61f43d83c9e4f5 + +PKG_MAINTAINER:=Markus Stenberg + +include $(INCLUDE_DIR)/package.mk + +define Package/miniupnpd + SECTION:=net + CATEGORY:=Network + DEPENDS:=+iptables +libip4tc +IPV6:libip6tc +IPV6:ip6tables +libnfnetlink + TITLE:=Lightweight UPnP daemon + SUBMENU:=Firewall + URL:=http://miniupnp.free.fr/ +endef + +define Package/miniupnpd/conffiles +/etc/config/upnpd +endef + +define Package/miniupnpd/postinst +#!/bin/sh + +if [ -z "$$IPKG_INSTROOT" ]; then + ( . /etc/uci-defaults/99-miniupnpd ) + rm -f /etc/uci-defaults/99-miniupnpd +fi + +exit 0 +endef + +define Build/Prepare + $(call Build/Prepare/Default) + echo "OpenWrt/$(OPENWRTVERSION)" | tr \(\)\ _ >$(PKG_BUILD_DIR)/os.openwrt +endef + +MAKE_FLAGS += \ + LIBS="" \ + CC="$(TARGET_CC) -DIPTABLES_143 -lnfnetlink -lip4tc $(if $(CONFIG_IPV6),-lip6tc)" \ + CONFIG_OPTIONS="$(if $(CONFIG_IPV6),--ipv6) --leasefile" \ + -f Makefile.linux \ + miniupnpd + +define Package/miniupnpd/install + $(INSTALL_DIR) $(1)/usr/sbin $(1)/etc/init.d $(1)/etc/config $(1)/etc/uci-defaults $(1)/etc/hotplug.d/iface $(1)/usr/share/miniupnpd + $(INSTALL_BIN) $(PKG_BUILD_DIR)/miniupnpd $(1)/usr/sbin/miniupnpd + $(INSTALL_BIN) ./files/miniupnpd.init $(1)/etc/init.d/miniupnpd + $(INSTALL_CONF) ./files/upnpd.config $(1)/etc/config/upnpd + $(INSTALL_DATA) ./files/miniupnpd.hotplug $(1)/etc/hotplug.d/iface/50-miniupnpd + $(INSTALL_DATA) ./files/miniupnpd.defaults $(1)/etc/uci-defaults/99-miniupnpd + $(INSTALL_DATA) ./files/firewall.include $(1)/usr/share/miniupnpd/firewall.include +endef + +$(eval $(call BuildPackage,miniupnpd)) diff --git a/miniupnpd/files/firewall.include b/miniupnpd/files/firewall.include new file mode 100644 index 0000000..bc108d5 --- /dev/null +++ b/miniupnpd/files/firewall.include @@ -0,0 +1,38 @@ +#!/bin/sh +# miniupnpd integration for firewall3 + +IP6TABLES=/usr/sbin/ip6tables + +iptables -t filter -N MINIUPNPD 2>/dev/null +iptables -t nat -N MINIUPNPD 2>/dev/null + +[ -x $IP6TABLES ] && $IP6TABLES -t filter -N MINIUPNPD 2>/dev/null + +. /lib/functions/network.sh + +add_extzone_rules() { + local ext_zone=$1 + + # IPv4 - due to NAT, need to add both to nat and filter table + iptables -t filter -I zone_${ext_zone}_forward -j MINIUPNPD + iptables -t nat -I zone_${ext_zone}_prerouting -j MINIUPNPD + + # IPv6 if available - filter only + [ -x $IP6TABLES ] && { + $IP6TABLES -t filter -I zone_${ext_zone}_forward -j MINIUPNPD + } +} + +network_find_wan wan_iface +network_get_device wan_device $wan_iface + +for ext_zone in $(fw3 -q device "$wan_device"); do + add_extzone_rules $ext_zone +done + +for ext_iface in $(uci -q get upnpd.config.external_iface); do + for ext_zone in $(fw3 -q network "$ext_iface"); do + add_extzone_rules $ext_zone + done +done + diff --git a/miniupnpd/files/miniupnpd.defaults b/miniupnpd/files/miniupnpd.defaults new file mode 100644 index 0000000..c6bc19a --- /dev/null +++ b/miniupnpd/files/miniupnpd.defaults @@ -0,0 +1,13 @@ +#!/bin/sh + +uci -q batch <<-EOT + delete firewall.miniupnpd + set firewall.miniupnpd=include + set firewall.miniupnpd.type=script + set firewall.miniupnpd.path=/usr/share/miniupnpd/firewall.include + set firewall.miniupnpd.family=IPv4 + set firewall.miniupnpd.reload=1 + commit firewall +EOT + +exit 0 diff --git a/miniupnpd/files/miniupnpd.hotplug b/miniupnpd/files/miniupnpd.hotplug new file mode 100644 index 0000000..71a7f45 --- /dev/null +++ b/miniupnpd/files/miniupnpd.hotplug @@ -0,0 +1,14 @@ +#!/bin/sh + +/etc/init.d/miniupnpd enabled && [ "$ACTION" = "ifup" ] && { + local iface + local ext_iface + + . /lib/functions/network.sh + network_find_wan ext_iface + + for iface in $ext_iface $(uci_get upnpd config internal_iface; uci_get upnpd config external_iface); do + [ "$INTERFACE" = "$iface" ] && /etc/init.d/miniupnpd restart + exit 0 + done +} diff --git a/miniupnpd/files/miniupnpd.init b/miniupnpd/files/miniupnpd.init new file mode 100644 index 0000000..caa69ad --- /dev/null +++ b/miniupnpd/files/miniupnpd.init @@ -0,0 +1,197 @@ +#!/bin/sh /etc/rc.common +# Copyright (C) 2006-2011 OpenWrt.org + +START=95 + +SERVICE_USE_PID=1 + +upnpd_get_port_range() { + local _var="$1"; shift + local _val + + config_get _val "$@" + + case "$_val" in + [0-9]*[:-][0-9]*) + export -n -- "${_var}_start=${_val%%[:-]*}" + export -n -- "${_var}_end=${_val##*[:-]}" + ;; + [0-9]*) + export -n -- "${_var}_start=$_val" + export -n -- "${_var}_end=" + ;; + esac +} + +conf_rule_add() { + local cfg="$1" + local tmpconf="$2" + local action external_port_start external_port_end int_addr + local internal_port_start internal_port_end + + config_get action "$cfg" action "deny" # allow or deny + upnpd_get_port_range "ext" "$cfg" ext_ports "0-65535" # external ports: x, x-y, x:y + config_get int_addr "$cfg" int_addr "0.0.0.0/0" # ip or network and subnet mask (internal) + upnpd_get_port_range "int" "$cfg" int_ports "0-65535" # internal ports: x, x-y, x:y or range + + # Make a single IP IP/32 so that miniupnpd.conf can use it. + case "$int_addr" in + */*) ;; + *) int_addr="$int_addr/32" ;; + esac + + echo "${action} ${ext_start}${ext_end:+-}${ext_end} ${int_addr} ${int_start}${int_end:+-}${int_end}" >>$tmpconf +} + +upnpd_write_bool() { + local opt="$1" + local def="${2:-0}" + local alt="$3" + local val + + config_get_bool val config "$opt" "$def" + if [ "$val" -eq 0 ]; then + echo "${alt:-$opt}=no" >> $tmpconf + else + echo "${alt:-$opt}=yes" >> $tmpconf + fi +} + +boot() { + return +} + +start() { + config_load "upnpd" + local extiface intiface upload download logging secure enabled natpmp + local extip port usesysuptime conffile serial_number model_number + local uuid notify_interval presentation_url enable_upnp + local upnp_lease_file clean_ruleset_threshold clean_ruleset_interval + local ipv6_listening_ip + + config_get extiface config external_iface + config_get intiface config internal_iface + config_get extip config external_ip + config_get port config port 5000 + config_get upload config upload + config_get download config download + config_get_bool logging config log_output 0 + config_get conffile config config_file + config_get serial_number config serial_number + config_get model_number config model_number + config_get uuid config uuid + config_get notify_interval config notify_interval + config_get presentation_url config presentation_url + config_get upnp_lease_file config upnp_lease_file + config_get clean_ruleset_threshold config clean_ruleset_threshold + config_get clean_ruleset_interval config clean_ruleset_interval + config_get ipv6_listening_ip config ipv6_listening_ip + + local args + + . /lib/functions/network.sh + + local ifname + + [ -n "$extiface" ] || network_find_wan extiface + + network_get_device ifname ${extiface} + + if [ -n "$conffile" ]; then + args="-f $conffile" + else + local tmpconf="/var/etc/miniupnpd.conf" + args="-f $tmpconf" + mkdir -p /var/etc + + echo "ext_ifname=$ifname" >$tmpconf + + [ -n "$extip" ] && \ + echo "ext_ip=$extip" >>$tmpconf + + local iface + for iface in ${intiface:-lan}; do + local device + network_get_device device "$iface" && { + echo "listening_ip=$device" >>$tmpconf + } + done + + [ "$port" != "auto" ] && \ + echo "port=$port" >>$tmpconf + + config_load "upnpd" + upnpd_write_bool enable_natpmp 1 + upnpd_write_bool enable_upnp 1 + upnpd_write_bool secure_mode 1 + upnpd_write_bool pcp_allow_thirdparty 0 + upnpd_write_bool system_uptime 1 + + [ -n "$upnp_lease_file" ] && \ + echo "lease_file=$upnp_lease_file" >>$tmpconf + + [ -n "$upload" -a -n "$download" ] && { + echo "bitrate_down=$(($download * 1024 * 8))" >>$tmpconf + echo "bitrate_up=$(($upload * 1024 * 8))" >>$tmpconf + } + + [ -n "${presentation_url}" ] && \ + echo "presentation_url=${presentation_url}" >>$tmpconf + + [ -n "${notify_interval}" ] && \ + echo "notify_interval=${notify_interval}" >>$tmpconf + + [ -n "${clean_ruleset_threshold}" ] && \ + echo "clean_ruleset_threshold=${clean_ruleset_threshold}" >>$tmpconf + + [ -n "${clean_ruleset_interval}" ] && \ + echo "clean_ruleset_interval=${clean_ruleset_interval}" >>$tmpconf + + [ -n "${ipv6_listening_ip}" ] && \ + echo "ipv6_listening_ip=${ipv6_listening_ip}" >>$tmpconf + + [ -z "$uuid" ] && { + uuid="$(cat /proc/sys/kernel/random/uuid)" + uci set upnpd.config.uuid=$uuid + uci commit upnpd + } + + [ "$uuid" = "nocli" ] || \ + echo "uuid=$uuid" >>$tmpconf + + [ -n "${serial_number}" ] && \ + echo "serial=${serial_number}" >>$tmpconf + + [ -n "${model_number}" ] && \ + echo "model_number=${model_number}" >>$tmpconf + + config_foreach conf_rule_add perm_rule "$tmpconf" + fi + + + if [ -n "$ifname" ]; then + # start firewall + iptables -L MINIUPNPD >/dev/null 2>/dev/null || fw3 reload + + if [ "$logging" = "1" ]; then + SERVICE_DAEMONIZE=1 \ + service_start /usr/sbin/miniupnpd $args -d + else + SERVICE_DAEMONIZE= \ + service_start /usr/sbin/miniupnpd $args + fi + else + logger -t "upnp daemon" "external interface not found, not starting" + fi +} + +stop() { + service_stop /usr/sbin/miniupnpd + + iptables -t nat -F MINIUPNPD 2>/dev/null + iptables -t filter -F MINIUPNPD 2>/dev/null + + [ -x /usr/sbin/ip6tables ] && { + ip6tables -t filter -F MINIUPNPD 2>/dev/null + } +} diff --git a/miniupnpd/files/upnpd.config b/miniupnpd/files/upnpd.config new file mode 100644 index 0000000..56cde57 --- /dev/null +++ b/miniupnpd/files/upnpd.config @@ -0,0 +1,26 @@ +config upnpd config + option enable_natpmp 1 + option enable_upnp 1 + option secure_mode 1 + option log_output 0 + option download 1024 + option upload 512 + #by default, looked up dynamically from ubus + #option external_iface wan + option internal_iface lan + option port 5000 + option upnp_lease_file /var/upnp.leases + +config perm_rule + option action allow + option ext_ports 1024-65535 + option int_addr 0.0.0.0/0 # Does not override secure_mode + option int_ports 1024-65535 + option comment "Allow high ports" + +config perm_rule + option action deny + option ext_ports 0-65535 + option int_addr 0.0.0.0/0 + option int_ports 0-65535 + option comment "Default deny" diff --git a/miniupnpd/patches/100-no-ssl.patch b/miniupnpd/patches/100-no-ssl.patch new file mode 100644 index 0000000..f058c3b --- /dev/null +++ b/miniupnpd/patches/100-no-ssl.patch @@ -0,0 +1,14 @@ +diff --git a/Makefile.linux b/Makefile.linux +index bcca779..7946108 100644 +--- a/Makefile.linux ++++ b/Makefile.linux +@@ -147,7 +147,8 @@ LDLIBS += $(shell $(PKG_CONFIG) --static --libs-only-l libmnl) + LDLIBS += $(shell $(PKG_CONFIG) --static --libs-only-l libnetfilter_conntrack) + endif # ($(TEST),1) + +-LDLIBS += $(shell $(PKG_CONFIG) --static --libs-only-l libssl) ++# n/a - we don't enable https server for IGD v2 anyway ++#LDLIBS += $(shell $(PKG_CONFIG) --static --libs-only-l libssl) + + TESTUPNPDESCGENOBJS = testupnpdescgen.o upnpdescgen.o + diff --git a/miniupnpd/patches/101-ipv6-pinhole.patch b/miniupnpd/patches/101-ipv6-pinhole.patch new file mode 100644 index 0000000..0ab4d4d --- /dev/null +++ b/miniupnpd/patches/101-ipv6-pinhole.patch @@ -0,0 +1,13 @@ +diff --git a/netfilter/iptpinhole.c b/netfilter/iptpinhole.c +index 61ed41b..5cb0e0e 100644 +--- a/netfilter/iptpinhole.c ++++ b/netfilter/iptpinhole.c +@@ -206,6 +206,8 @@ int add_pinhole(const char * ifname, + + e = calloc(1, sizeof(struct ip6t_entry)); + e->ipv6.proto = proto; ++ if (proto) ++ e->ipv6.flags |= IP6T_F_PROTO; + + if(ifname) + strncpy(e->ipv6.iniface, ifname, IFNAMSIZ); -- 2.30.2