package/firewall/files/lib/core_init.sh

   1 # Copyright (C) 2009-2010 OpenWrt.org
   2 # Copyright (C) 2008 John Crispin <blogic@openwrt.org>
   3
   4 FW_INITIALIZED=
   5
   6 FW_ZONES=
   7 FW_CONNTRACK_ZONES=
   8 FW_NOTRACK_DISABLED=
   9
  10 FW_DEFAULTS_APPLIED=
  11 FW_ADD_CUSTOM_CHAINS=
  12 FW_ACCEPT_REDIRECTS=
  13 FW_ACCEPT_SRC_ROUTE=
  14
  15 FW_DEFAULT_INPUT_POLICY=REJECT
  16 FW_DEFAULT_OUTPUT_POLICY=REJECT
  17 FW_DEFAULT_FORWARD_POLICY=REJECT
  18
  19
  20 fw_load_defaults() {
  21         fw_config_get_section "$1" defaults { \
  22                 string input $FW_DEFAULT_INPUT_POLICY \
  23                 string output $FW_DEFAULT_OUTPUT_POLICY \
  24                 string forward $FW_DEFAULT_FORWARD_POLICY \
  25                 boolean drop_invalid 0 \
  26                 boolean syn_flood 0 \
  27                 boolean synflood_protect 0 \
  28                 string synflood_rate 25 \
  29                 string synflood_burst 50 \
  30                 boolean tcp_syncookies 1 \
  31                 boolean tcp_ecn 0 \
  32                 boolean tcp_westwood 0 \
  33                 boolean tcp_window_scaling 1 \
  34                 boolean accept_redirects 0 \
  35                 boolean accept_source_route 0 \
  36                 boolean custom_chains 1 \
  37         } || return
  38         [ -n "$FW_DEFAULTS_APPLIED" ] && {
  39                 echo "Error: multiple defaults sections detected"
  40                 return 1
  41         }
  42         FW_DEFAULTS_APPLIED=1
  43
  44         FW_DEFAULT_INPUT_POLICY=$defaults_input
  45         FW_DEFAULT_OUTPUT_POLICY=$defaults_output
  46         FW_DEFAULT_FORWARD_POLICY=$defaults_forward
  47
  48         FW_ADD_CUSTOM_CHAINS=$defaults_custom_chains
  49
  50         FW_ACCEPT_REDIRECTS=$defaults_accept_redirects
  51         FW_ACCEPT_SRC_ROUTE=$defaults_accept_source_route
  52
  53         fw_callback pre defaults
  54
  55         # Seems like there are only one sysctl for both IP versions.
  56         for s in syncookies ecn westwood window_scaling; do
  57                 eval "sysctl -e -w net.ipv4.tcp_${s}=\$defaults_tcp_${s}" >/dev/null
  58         done
  59         fw_sysctl_interface all
  60
  61         [ $defaults_drop_invalid == 1 ] && {
  62                 fw add i f INPUT   DROP { -m state --state INVALID }
  63                 fw add i f OUTPUT  DROP { -m state --state INVALID }
  64                 fw add i f FORWARD DROP { -m state --state INVALID }
  65                 FW_NOTRACK_DISABLED=1
  66         }
  67
  68         fw add i f INPUT   ACCEPT { -m state --state RELATED,ESTABLISHED }
  69         fw add i f OUTPUT  ACCEPT { -m state --state RELATED,ESTABLISHED }
  70         fw add i f FORWARD ACCEPT { -m state --state RELATED,ESTABLISHED }
  71
  72         fw add i f INPUT  ACCEPT { -i lo }
  73         fw add i f OUTPUT ACCEPT { -o lo }
  74
  75         # Compatibility to old 'syn_flood' parameter
  76         [ $defaults_syn_flood == 1 ] && \
  77                 defaults_synflood_protect=1
  78
  79         [ $defaults_synflood_protect == 1 ] && {
  80                 echo "Loading synflood protection"
  81                 fw_callback pre synflood
  82                 fw add i f syn_flood
  83                 fw add i f syn_flood RETURN { \
  84                         -p tcp --syn \
  85                         -m limit --limit "${defaults_synflood_rate}/second" --limit-burst "${defaults_synflood_burst}" \
  86                 }
  87                 fw add i f syn_flood DROP
  88                 fw add i f INPUT syn_flood { -p tcp --syn }
  89                 fw_callback post synflood
  90         }
  91
  92         [ $defaults_custom_chains == 1 ] && {
  93                 echo "Adding custom chains"
  94                 fw add i f input_rule
  95                 fw add i f output_rule
  96                 fw add i f forwarding_rule
  97                 fw add i n prerouting_rule
  98                 fw add i n postrouting_rule
  99
 100                 fw add i f INPUT       input_rule
 101                 fw add i f OUTPUT      output_rule
 102                 fw add i f FORWARD     forwarding_rule
 103                 fw add i n PREROUTING  prerouting_rule
 104                 fw add i n POSTROUTING postrouting_rule
 105         }
 106
 107         fw add i f input
 108         fw add i f output
 109         fw add i f forward
 110
 111         fw add i f INPUT   input
 112         fw add i f OUTPUT  output
 113         fw add i f FORWARD forward
 114
 115         fw add i f reject
 116         fw add i f reject REJECT { --reject-with tcp-reset -p tcp }
 117         fw add i f reject REJECT { --reject-with port-unreach }
 118
 119         fw_set_filter_policy
 120
 121         fw_callback post defaults
 122 }
 123
 124
 125 fw_config_get_zone() {
 126         [ "${zone_NAME}" != "$1" ] || return
 127         fw_config_get_section "$1" zone { \
 128                 string name "$1" \
 129                 string network "" \
 130                 string input "$FW_DEFAULT_INPUT_POLICY" \
 131                 string output "$FW_DEFAULT_OUTPUT_POLICY" \
 132                 string forward "$FW_DEFAULT_FORWARD_POLICY" \
 133                 boolean masq 0 \
 134                 boolean conntrack 0 \
 135                 boolean mtu_fix 0 \
 136                 boolean custom_chains "$FW_ADD_CUSTOM_CHAINS" \
 137         } || return
 138         [ -n "$zone_name" ] || zone_name=$zone_NAME
 139         [ -n "$zone_network" ] || zone_network=$zone_name
 140 }
 141
 142 fw_load_zone() {
 143         fw_config_get_zone "$1"
 144
 145         list_contains FW_ZONES $zone_name && {
 146                 fw_die "zone ${zone_name}: duplicated zone"
 147         }
 148         append FW_ZONES $zone_name
 149
 150         fw_callback pre zone
 151
 152         [ $zone_conntrack = 1 -o $zone_masq = 1 ] && \
 153                 append FW_CONNTRACK_ZONES "$zone_NAME"
 154
 155         local chain=zone_${zone_name}
 156
 157         fw add i f ${chain}_ACCEPT
 158         fw add i f ${chain}_DROP
 159         fw add i f ${chain}_REJECT
 160         fw add i f ${chain}_MSSFIX
 161
 162         # TODO: Rename to ${chain}_input
 163         fw add i f ${chain}
 164         fw add i f ${chain} ${chain}_${zone_input} $
 165
 166         fw add i f ${chain}_forward
 167         fw add i f ${chain}_forward ${chain}_${zone_forward} $
 168
 169         # TODO: add ${chain}_output
 170         fw add i f output ${chain}_${zone_output} $
 171
 172         # TODO: Rename to ${chain}_MASQUERADE
 173         fw add i n ${chain}_nat
 174         fw add i n ${chain}_prerouting
 175
 176         fw add i r ${chain}_notrack
 177         [ $zone_masq == 1 ] && \
 178                 fw add i n POSTROUTING ${chain}_nat $
 179
 180         [ $zone_mtu_fix == 1 ] && \
 181                 fw add i f FORWARD ${chain}_MSSFIX ^
 182
 183         [ $zone_custom_chains == 1 ] && {
 184                 [ $FW_ADD_CUSTOM_CHAINS == 1 ] || \
 185                         fw_die "zone ${zone_name}: custom_chains globally disabled"
 186
 187                 fw add i f input_${zone_name}
 188                 fw add i f ${chain} input_${zone_name} ^
 189
 190                 fw add i f forwarding_${zone_name}
 191                 fw add i f ${chain}_forward forwarding_${zone_name} ^
 192
 193                 fw add i n prerouting_${zone_name}
 194                 fw add i n ${chain}_prerouting prerouting_${zone_name} ^
 195         }
 196
 197         fw_callback post zone
 198 }
 199
 200 fw_load_notrack_zone() {
 201         list_contains FW_CONNTRACK_ZONES "$1" && return
 202
 203         fw_config_get_zone "$1"
 204
 205         fw_callback pre notrack
 206
 207         fw add i f zone_${zone_name}_notrack NOTRACK $
 208
 209         fw_callback post notrack
 210 }
 211
 212
 213 fw_load_include() {
 214         local name="$1"
 215
 216         local path; config_get path ${name} path
 217         [ -e $path ] && . $path
 218 }
 219
 220
 221 fw_clear() {
 222         local policy=$1
 223
 224         fw_set_filter_policy $policy
 225
 226         local tab
 227         for tab in f n r; do
 228                 fw del i $tab
 229         done
 230 }
 231
 232 fw_set_filter_policy() {
 233         local policy=$1
 234
 235         local chn tgt
 236         for chn in INPUT OUTPUT FORWARD; do
 237                 eval "tgt=\${policy:-\${FW_DEFAULT_${chn}_POLICY}}"
 238                 [ $tgt == "REJECT" ] && tgt=reject
 239                 [ $tgt == "ACCEPT" -o $tgt == "DROP" ] || {
 240                         fw add i f $chn $tgt $
 241                         tgt=DROP
 242                 }
 243                 fw policy i f $chn $tgt
 244         done
 245 }
 246
 247
 248 fw_callback() {
 249         local pp=$1
 250         local hk=$2
 251
 252         local libs lib
 253         eval "libs=\$FW_CB_${pp}_${hk}"
 254         [ -n "$libs" ] || return
 255         for lib in $libs; do
 256                 ${lib}_${pp}_${hk}_cb
 257         done
 258 }