contrib/package/meshwizard/files/usr/bin/meshwizard/helpers/setup_firewall.sh

   1 #!/bin/sh
   2 # Add "freifunk" firewall zone
   3 # If wan/lan is used for olsr then remove these networks from wan/lan zones
   4 # Also setup rules defined in /etc/config/freifunk and /etc/config/profile_<community>
   5
   6 . /lib/functions.sh
   7 . $dir/functions.sh
   8
   9 wan_is_olsr=$(uci -q get meshwizard.netconfig.wan_config)
  10
  11 config_load firewall
  12
  13 # Rename firewall zone for freifunk if unnamed
  14 # If wan is used for olsr then set network for the firewall zone wan to ' ' to remove the wan interface from it, else add local restrict to it
  15 # If lan is used for olsr then set network for the firewall zone lan to ' ' to remove the lan interface from it
  16
  17 handle_fwzone() {
  18         config_get name "$1" name
  19         config_get network "$1" network
  20
  21         if [ "$name" == "freifunk" ]; then
  22                 # rename section if unnamed
  23                 if [ -z "${1/cfg[0-9a-fA-F]*/}" ]; then
  24                         section_rename firewall $1 zone_freifunk
  25                 fi
  26         fi
  27
  28         if [ "$name" == "wan" ]; then
  29                 if  [ "$wan_is_olsr" == 1 ]; then
  30                         uci set firewall.$1.network=' ' && uci_commitverbose "WAN is used for olsr, removed the wan interface from zone wan" firewall
  31                 else
  32                         uci set firewall.$1.local_restrict=1 && uci_commitverbose "Enable local_restrict for zone wan" firewall
  33                 fi
  34         fi
  35
  36         if [ "$name" == "lan" ] && [ "$lan_is_olsr" == "1" ]; then
  37                         uci set firewall.$1.network=' ' && uci_commitverbose "LAN is used for olsr, removed the lan interface from zone lan" firewall
  38         fi
  39 }
  40
  41 config_foreach handle_fwzone zone
  42
  43 uci batch << EOF
  44         set firewall.zone_freifunk="zone"
  45         set firewall.zone_freifunk.name="freifunk"
  46         set firewall.zone_freifunk.input="$zone_freifunk_input"
  47         set firewall.zone_freifunk.forward="$zone_freifunk_forward"
  48         set firewall.zone_freifunk.output="$zone_freifunk_output"
  49 EOF
  50
  51 uci_commitverbose "Setup firewall zones" firewall
  52
  53 # Usually we need to setup masquerading for lan, except lan is an olsr interface or has an olsr hna-entry
  54
  55 handle_interface() {
  56         config_get interface "$1" interface
  57         if [ "$interface" == "lan" ]; then
  58                 no_masq_lan=1
  59         fi
  60 }
  61 config_load olsrd
  62 config_foreach handle_interface Interface
  63
  64 LANIP="$(uci -q get network.lan.ipaddr)"
  65 if [ -n "$LANIP" ]; then
  66         handle_hna() {
  67                 config_get netaddr "$1" netaddr
  68                         if [ "$LANIP" == "$netaddr" ]; then
  69                         no_masq_lan=1
  70                 fi
  71         }
  72         config_foreach handle_hna Hna4
  73 fi
  74
  75 currms=$(uci -q get firewall.zone_freifunk.masq_src)
  76 if [ ! "$no_masq_lan" == "1" ] && [ ! "$(uci -q get meshwizard.netconfig.lan_config)" == 1 ]; then
  77         uci set firewall.zone_freifunk.masq="1"
  78         [ -z "$(echo $currms |grep lan)" ] && uci add_list firewall.zone_freifunk.masq_src="lan"
  79 fi
  80
  81
  82 # Rules, Forwardings, advanced config and includes from freifunk and
  83 # profile_$community config files.
  84
  85 add_fw_rules() {
  86     config_cb() {
  87         local type="$1"
  88         local name="$2"
  89         local allowed_section_types="advanced include fw_rule fw_forwarding"
  90         if is_in_list "$allowed_section_types" $type ; then
  91             uci set firewall.${name}="${type/fw_/}"
  92             option_cb() {
  93                 local option="$1"
  94                 local value="$2"
  95                 uci set firewall.${CONFIG_SECTION}.${option}="$value"
  96             }
  97         else
  98             option_cb() { return; }
  99         fi
 100     }
 101     config_load freifunk
 102     config_load profile_${community}
 103 }
 104 add_fw_rules
 105
 106
 107 # If we use auto-ipv6-dhcp then allow 547/udp on the freifunk zone
 108 if [ "$ipv6_config" = "auto-ipv6-dhcpv6" ]; then
 109         uci batch <<- EOF
 110                 set firewall.dhcpv6=rule
 111                 set firewall.dhcpv6.src=freifunk
 112                 set firewall.dhcpv6.target=ACCEPT
 113                 set firewall.dhcpv6.dest_port=547
 114                 set firewall.dhcpv6.proto=udp
 115         EOF
 116 fi
 117
 118 # Firewall rules to allow incoming ssh and web if enabled
 119
 120 if [ "$wan_allowssh" == 1 ]; then
 121         uci batch <<- EOF
 122                 set firewall.wanssh=rule
 123                 set firewall.wanssh.src=wan
 124                 set firewall.wanssh.target=ACCEPT
 125                 set firewall.wanssh.proto=tcp
 126                 set firewall.wanssh.dest_port=22
 127         EOF
 128 fi
 129
 130 if [ "$wan_allowweb" == 1 ]; then
 131         uci batch <<- EOF
 132                 set firewall.wanweb=rule
 133                 set firewall.wanweb.src=wan
 134                 set firewall.wanweb.target=ACCEPT
 135                 set firewall.wanweb.proto=tcp
 136                 set firewall.wanweb.dest_port=80
 137                 set firewall.wanwebhttps=rule
 138                 set firewall.wanwebhttps.src=wan
 139                 set firewall.wanwebhttps.target=ACCEPT
 140                 set firewall.wanwebhttps.proto=tcp
 141                 set firewall.wanwebhttps.dest_port=443
 142         EOF
 143 fi
 144
 145 uci_commitverbose "Setup rules, forwardings, advanced config and includes." firewall