1 # Copyright (C) 2009-2010 OpenWrt.org
2 # Copyright (C) 2009 Malte S. Stretz
11 [ "${-#*x}" == "$-" ] && {
26 fw__exec
() { # <action> <family> <table> <chain> <target> <position> { <rules> }
27 local cmd fam tab chn tgt pos
29 for i
in cmd fam tab chn tgt pos
; do
30 if [ "$1" -a "$1" != '{' ]; then
39 export FW_
${fam#G}_ERROR
=$1
44 fw
$cmd 4 $tab $chn $tgt $pos "$@"
45 fw
$cmd 6 $tab $chn $tgt $pos "$@"
46 fw__rc $
((FW_4_ERROR | FW_6_ERROR
))
52 while [ "$1" != '}' ]; do
60 if [ "${ip4:-4}" == "${ip6:-6}" ]; then
61 echo "fw: can't mix ip4 and ip6" >&2
64 local ver
=${ip4:+4}${ip6:+6}
66 fw
$cmd ${ver:-i} $tab $chn $tgt $pos "$@"
72 if [ $tab == '-' ]; then
73 type $app > /dev
/null
2> /dev
/null
82 eval "err=\$FW_${fam}_ERROR"
89 *4) [ $FW_DISABLE_IPV4 == 0 ] && app
=iptables ||
return ;;
90 *6) [ $FW_DISABLE_IPV6 == 0 ] && app
=ip6tables ||
return ;;
91 i
) fw__dualip
"$@"; return ;;
92 I
) fw__autoip
"$@"; return ;;
95 -) fw
$cmd i
$tab $chn $tgt $pos "$@"; return ;;
105 case "$cmd:$chn:$tgt:$pos" in
106 add
:*:-:*) cmd
=new-chain
;;
107 add
:*:*:-) cmd
=append
;;
108 add
:*:*:$
) cmd
=append
;;
109 add
:*:*:*) cmd
=insert
;;
110 del
:-:*:*) cmd
=delete-chain
; fw flush
$fam $tab ;;
111 del
:*:-:*) cmd
=delete-chain
; fw flush
$fam $tab $chn ;;
112 del
:*:*:*) cmd
=delete
;;
114 policy
:*) pol
=$tgt; tgt
=- ;;
115 has
:*) fw__has
; return ;;
116 err
:*) fw__err
; return ;;
117 list
:*) cmd
="numeric --verbose --$cmd" ;;
132 +) eval "rule_offset=\${FW__RULE_OFS_${app}_${tab}_${chn}:-1}" ;;
135 if ! fw__has
- family ||
! fw__has
$tab ; then
136 export FW_
${fam}_ERROR
=0
141 G
*) shift; while [ $# -gt 0 ] && [ "$1" != "{" ]; do shift; done ;;
144 if [ $# -gt 0 ]; then
146 if [ $cmd == delete
]; then
151 local cmdline
="$app --table ${tab} --${cmd} ${chn} ${pol} ${rule_offset:-${pos}} ${tgt:+--jump "$tgt"}"
152 while [ $# -gt 1 ]; do
153 # special parameter handling
155 -p:icmp
*|
-p:1|
-p:58|
--protocol:icmp
*|
--protocol:1|
--protocol:58)
156 [ "$app" = ip6tables
] && \
157 cmdline
="$cmdline -p icmpv6" || \
158 cmdline
="$cmdline -p icmp"
161 --icmp-type:*|
--icmpv6-type:*)
163 if [ "$app" = ip6tables
] && fw_check_icmptype6 icmp_type
"$2"; then
164 cmdline
="$cmdline $icmp_type"
165 elif [ "$app" = iptables
] && fw_check_icmptype4 icmp_type
"$2"; then
166 cmdline
="$cmdline $icmp_type"
168 local fam
=IPv4
; [ "$app" = ip6tables
] && fam
=IPv6
169 fw_log info
"ICMP type '$2' is not valid for $fam address family, skipping rule"
174 *) cmdline
="$cmdline $1" ;;
179 [ -n "$FW_TRACE" ] && echo $cmdline >&2
184 [ $rv -eq 0 ] && [ -n "$rule_offset" ] && \
185 export -- "FW__RULE_OFS_${app}_${tab}_${chn}=$(($rule_offset + 1))"
189 fw_get_port_range
() {
194 fw_get_port_range
$_var "${_ports}-${4}" $_delim
198 local _first
=${_ports%-*}
199 local _last
=${_ports#*-}
200 if [ "${_first#!}" != "${_last#!}" ]; then
201 export -- "$_var=$_first$_delim${_last#!}"
203 export -- "$_var=$_first"
207 fw_get_family_mode
() {
214 [ -n "$FW_ZONES4$FW_ZONES6" ] && {
215 list_contains FW_ZONES4
$_zone && _ipv4
=1 || _ipv4
=0
216 list_contains FW_ZONES6
$_zone && _ipv6
=1 || _ipv6
=0
218 _ipv4
=$
(uci_get_state firewall core
${_zone}_ipv4
0)
219 _ipv6
=$
(uci_get_state firewall core
${_zone}_ipv6
0)
222 case "$_hint:$_ipv4:$_ipv6" in
223 *4:1:*|
*:1:0) export -n -- "$_var=G4" ;;
224 *6:*:1|
*:0:1) export -n -- "$_var=G6" ;;
225 *) export -n -- "$_var=$_mode" ;;
234 [ "${_value#!}" != "$_value" ] && \
235 export -n -- "$_var=! $_flag ${_value#!}" || \
236 export -n -- "$_var=${_value:+$_flag $_value}"
244 local _ipaddr
="$(uci_get_state network "${_name#!}" ipaddr)"
245 local _netmask
="$(uci_get_state network "${_name#!}" netmask)"
249 [ "${_name#!}" != "$_name" ] && \
250 export -n -- "$_var=! $_flag $_ipaddr/${_netmask:-255.255.255.255}" || \
251 export -n -- "$_var=$_flag $_ipaddr/${_netmask:-255.255.255.255}"
253 *) export -n -- "$_var=" ;;
257 fw_check_icmptype4
() {
261 ![0-9]*) export -n -- "$_var=! --icmp-type ${_type#!}"; return 0 ;;
262 [0-9]*) export -n -- "$_var=--icmp-type $_type"; return 0 ;;
265 [ -z "$FW_ICMP4_TYPES" ] && \
266 export FW_ICMP4_TYPES
=$
(
267 iptables
-p icmp
-h 2>/dev
/null | \
268 sed -n -e '/^Valid ICMP Types:/ {
270 /router-advertisement/d;
271 /router-solicitation/d;
272 s/[()]/ /g; s/[[:space:]]\+/\n/g; p; n; b r
277 for _check
in $FW_ICMP4_TYPES; do
278 if [ "$_check" = "${_type#!}" ]; then
279 [ "${_type#!}" != "$_type" ] && \
280 export -n -- "$_var=! --icmp-type ${_type#!}" || \
281 export -n -- "$_var=--icmp-type $_type"
286 export -n -- "$_var="
290 fw_check_icmptype6
() {
294 ![0-9]*) export -n -- "$_var=! --icmpv6-type ${_type#!}"; return 0 ;;
295 [0-9]*) export -n -- "$_var=--icmpv6-type $_type"; return 0 ;;
298 [ -z "$FW_ICMP6_TYPES" ] && \
299 export FW_ICMP6_TYPES
=$
(
300 ip6tables
-p icmpv6
-h 2>/dev
/null | \
301 sed -n -e '/^Valid ICMPv6 Types:/ {
302 n; :r; s/[()]/ /g; s/[[:space:]]\+/\n/g; p; n; b r
307 for _check
in $FW_ICMP6_TYPES; do
308 if [ "$_check" = "${_type#!}" ]; then
309 [ "${_type#!}" != "$_type" ] && \
310 export -n -- "$_var=! --icmpv6-type ${_type#!}" || \
311 export -n -- "$_var=--icmpv6-type $_type"
316 export -n -- "$_var="