package/firewall/files/uci_firewall.sh

   1 #!/bin/sh
   2 # Copyright (C) 2008 John Crispin <blogic@openwrt.org>
   3
   4 . /etc/functions.sh
   5
   6 IPTABLES="echo iptables"
   7 IPTABLES=iptables
   8
   9 config_clear
  10 include /lib/network
  11 scan_interfaces
  12
  13 CONFIG_APPEND=1
  14 config_load firewall
  15
  16 config fw_zones
  17 ZONE_LIST=$CONFIG_SECTION
  18
  19 CUSTOM_CHAINS=1
  20 DEF_INPUT=DROP
  21 DEF_OUTPUT=DROP
  22 DEF_FORWARD=DROP
  23 CONNTRACK_ZONES=
  24 NOTRACK_DISABLED=
  25
  26 find_item() {
  27         local item="$1"; shift
  28         for i in "$@"; do
  29                 [ "$i" = "$item" ] && return 0
  30         done
  31         return 1
  32 }
  33
  34 load_policy() {
  35         config_get input $1 input
  36         config_get output $1 output
  37         config_get forward $1 forward
  38
  39         DEF_INPUT="${input:-$DEF_INPUT}"
  40         DEF_OUTPUT="${output:-$DEF_OUTPUT}"
  41         DEF_FORWARD="${forward:-$DEF_FORWARD}"
  42 }
  43
  44 create_zone() {
  45         local exists
  46
  47         [ "$1" == "loopback" ] && return
  48
  49         config_get exists $ZONE_LIST $1
  50         [ -n "$exists" ] && return
  51         config_set $ZONE_LIST $1 1
  52
  53         $IPTABLES -N zone_$1
  54         $IPTABLES -N zone_$1_MSSFIX
  55         $IPTABLES -N zone_$1_ACCEPT
  56         $IPTABLES -N zone_$1_DROP
  57         $IPTABLES -N zone_$1_REJECT
  58         $IPTABLES -N zone_$1_forward
  59         [ "$5" ] && $IPTABLES -A zone_$1_forward -j zone_$1_$5
  60         [ "$3" ] && $IPTABLES -A zone_$1 -j zone_$1_$3
  61         [ "$4" ] && $IPTABLES -A output -j zone_$1_$4
  62         $IPTABLES -N zone_$1_nat -t nat
  63         $IPTABLES -N zone_$1_prerouting -t nat
  64         $IPTABLES -t raw -N zone_$1_notrack
  65         [ "$6" == "1" ] && $IPTABLES -t nat -A POSTROUTING -j zone_$1_nat
  66         [ "$7" == "1" ] && $IPTABLES -I FORWARD 1 -j zone_$1_MSSFIX
  67 }
  68
  69 addif() {
  70         local network="$1"
  71         local ifname="$2"
  72         local zone="$3"
  73
  74         local n_if n_zone
  75         config_get n_if core "${network}_ifname"
  76         config_get n_zone core "${network}_zone"
  77         [ -n "$n_zone" ] && {
  78                 if [ "$n_zone" != "$zone" ]; then
  79                         delif "$network" "$n_if" "$n_zone"
  80                 else
  81                         return
  82                 fi
  83         }
  84
  85         logger "adding $network ($ifname) to firewall zone $zone"
  86         $IPTABLES -A input -i "$ifname" -j zone_${zone}
  87         $IPTABLES -I zone_${zone}_MSSFIX 1 -o "$ifname" -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
  88         $IPTABLES -I zone_${zone}_ACCEPT 1 -o "$ifname" -j ACCEPT
  89         $IPTABLES -I zone_${zone}_DROP 1 -o "$ifname" -j DROP
  90         $IPTABLES -I zone_${zone}_REJECT 1 -o "$ifname" -j reject
  91         $IPTABLES -I zone_${zone}_ACCEPT 1 -i "$ifname" -j ACCEPT
  92         $IPTABLES -I zone_${zone}_DROP 1 -i "$ifname" -j DROP
  93         $IPTABLES -I zone_${zone}_REJECT 1 -i "$ifname" -j reject
  94         $IPTABLES -I zone_${zone}_nat 1 -t nat -o "$ifname" -j MASQUERADE
  95         $IPTABLES -I PREROUTING 1 -t nat -i "$ifname" -j zone_${zone}_prerouting
  96         $IPTABLES -A forward -i "$ifname" -j zone_${zone}_forward
  97         $IPTABLES -t raw -I PREROUTING 1 -i "$ifname" -j zone_${zone}_notrack
  98         uci_set_state firewall core "${network}_ifname" "$ifname"
  99         uci_set_state firewall core "${network}_zone" "$zone"
 100         ACTION=add ZONE="$zone" INTERFACE="$network" DEVICE="$ifname" /sbin/hotplug-call firewall
 101 }
 102
 103 delif() {
 104         local network="$1"
 105         local ifname="$2"
 106         local zone="$3"
 107
 108         logger "removing $network ($ifname) from firewall zone $zone"
 109         $IPTABLES -D input -i "$ifname" -j zone_$zone
 110         $IPTABLES -D zone_${zone}_MSSFIX -o "$ifname" -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
 111         $IPTABLES -D zone_${zone}_ACCEPT -o "$ifname" -j ACCEPT
 112         $IPTABLES -D zone_${zone}_DROP -o "$ifname" -j DROP
 113         $IPTABLES -D zone_${zone}_REJECT -o "$ifname" -j reject
 114         $IPTABLES -D zone_${zone}_ACCEPT -i "$ifname" -j ACCEPT
 115         $IPTABLES -D zone_${zone}_DROP -i "$ifname" -j DROP
 116         $IPTABLES -D zone_${zone}_REJECT -i "$ifname" -j reject
 117         $IPTABLES -D zone_${zone}_nat -t nat -o "$ifname" -j MASQUERADE
 118         $IPTABLES -D PREROUTING -t nat -i "$ifname" -j zone_${zone}_prerouting
 119         $IPTABLES -D forward -i "$ifname" -j zone_${zone}_forward
 120         uci_revert_state firewall core "${network}_ifname"
 121         uci_revert_state firewall core "${network}_zone"
 122         ACTION=remove ZONE="$zone" INTERFACE="$network" DEVICE="$ifname" /sbin/hotplug-call firewall
 123 }
 124
 125 load_synflood() {
 126         local rate=${1:-25}
 127         local burst=${2:-50}
 128         echo "Loading synflood protection"
 129         $IPTABLES -N syn_flood
 130         $IPTABLES -A syn_flood -p tcp --syn -m limit --limit $rate/second --limit-burst $burst -j RETURN
 131         $IPTABLES -A syn_flood -j DROP
 132         $IPTABLES -A INPUT -p tcp --syn -j syn_flood
 133 }
 134
 135 fw_set_chain_policy() {
 136         local chain=$1
 137         local target=$2
 138         [ "$target" == "REJECT" ] && {
 139                 $IPTABLES -A $chain -j reject
 140                 target=DROP
 141         }
 142         $IPTABLES -P $chain $target
 143 }
 144
 145 fw_clear() {
 146         $IPTABLES -F
 147         $IPTABLES -t nat -F
 148         $IPTABLES -t nat -X
 149         $IPTABLES -t raw -F
 150         $IPTABLES -t raw -X
 151         $IPTABLES -X
 152 }
 153
 154 fw_defaults() {
 155         [ -n "$DEFAULTS_APPLIED" ] && {
 156                 echo "Error: multiple defaults sections detected"
 157                 return;
 158         }
 159         DEFAULTS_APPLIED=1
 160
 161         load_policy "$1"
 162
 163         echo 1 > /proc/sys/net/ipv4/tcp_syncookies
 164         for f in /proc/sys/net/ipv4/conf/*/accept_redirects
 165         do
 166                 echo 0 > $f
 167         done
 168         for f in /proc/sys/net/ipv4/conf/*/accept_source_route
 169         do
 170                 echo 0 > $f
 171         done
 172
 173         uci_revert_state firewall core
 174         uci_set_state firewall core "" firewall_state
 175
 176         $IPTABLES -P INPUT DROP
 177         $IPTABLES -P OUTPUT DROP
 178         $IPTABLES -P FORWARD DROP
 179
 180         fw_clear
 181         config_get_bool drop_invalid $1 drop_invalid 0
 182
 183         [ "$drop_invalid" -gt 0 ] && {
 184                 $IPTABLES -A INPUT -m state --state INVALID -j DROP
 185                 $IPTABLES -A OUTPUT -m state --state INVALID -j DROP
 186                 $IPTABLES -A FORWARD -m state --state INVALID -j DROP
 187                 NOTRACK_DISABLED=1
 188         }
 189
 190         $IPTABLES -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
 191         $IPTABLES -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
 192         $IPTABLES -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
 193
 194         $IPTABLES -A INPUT -i lo -j ACCEPT
 195         $IPTABLES -A OUTPUT -o lo -j ACCEPT
 196
 197         config_get syn_flood $1 syn_flood
 198         config_get syn_rate $1 syn_rate
 199         config_get syn_burst $1 syn_burst
 200         [ "$syn_flood" == "1" ] && load_synflood $syn_rate $syn_burst
 201
 202         echo "Adding custom chains"
 203         fw_custom_chains
 204
 205         $IPTABLES -N input
 206         $IPTABLES -N output
 207         $IPTABLES -N forward
 208
 209         $IPTABLES -A INPUT -j input
 210         $IPTABLES -A OUTPUT -j output
 211         $IPTABLES -A FORWARD -j forward
 212
 213         $IPTABLES -N reject
 214         $IPTABLES -A reject -p tcp -j REJECT --reject-with tcp-reset
 215         $IPTABLES -A reject -j REJECT --reject-with icmp-port-unreachable
 216
 217         fw_set_chain_policy INPUT "$DEF_INPUT"
 218         fw_set_chain_policy OUTPUT "$DEF_OUTPUT"
 219         fw_set_chain_policy FORWARD "$DEF_FORWARD"
 220 }
 221
 222 fw_zone() {
 223         local name
 224         local network
 225         local masq
 226
 227         config_get name $1 name
 228         config_get network $1 network
 229         config_get_bool masq $1 masq "0"
 230         config_get_bool conntrack $1 conntrack "0"
 231         config_get_bool mtu_fix $1 mtu_fix 0
 232
 233         load_policy $1
 234         [ "$conntrack" = "1" -o "$masq" = "1" ] && append CONNTRACK_ZONES "$name"
 235         [ -z "$network" ] && network=$name
 236         create_zone "$name" "$network" "$input" "$output" "$forward" "$masq" "$mtu_fix"
 237         fw_custom_chains_zone "$name"
 238 }
 239
 240 fw_rule() {
 241         local src
 242         local src_ip
 243         local src_mac
 244         local src_port
 245         local src_mac
 246         local dest
 247         local dest_ip
 248         local dest_port
 249         local proto
 250         local icmp_type
 251         local target
 252         local ruleset
 253
 254         config_get src $1 src
 255         config_get src_ip $1 src_ip
 256         config_get src_mac $1 src_mac
 257         config_get src_port $1 src_port
 258         config_get dest $1 dest
 259         config_get dest_ip $1 dest_ip
 260         config_get dest_port $1 dest_port
 261         config_get proto $1 proto
 262         config_get icmp_type $1 icmp_type
 263         config_get target $1 target
 264         config_get ruleset $1 ruleset
 265
 266         src_port_first=${src_port%-*}
 267         src_port_last=${src_port#*-}
 268         [ "$src_port_first" -ne "$src_port_last" ] && { \
 269                 src_port="$src_port_first:$src_port_last"; }
 270
 271         dest_port_first=${dest_port%-*}
 272         dest_port_last=${dest_port#*-}
 273         [ "$dest_port_first" -ne "$dest_port_last" ] && { \
 274                 dest_port="$dest_port_first:$dest_port_last"; }
 275
 276         ZONE=input
 277         TARGET=$target
 278         [ -z "$target" ] && target=DROP
 279         [ -n "$src" -a -z "$dest" ] && ZONE=zone_$src
 280         [ -n "$src" -a -n "$dest" ] && ZONE=zone_${src}_forward
 281         [ -n "$dest" ] && TARGET=zone_${dest}_$target
 282         add_rule() {
 283                 $IPTABLES -I $ZONE 1 \
 284                         ${proto:+-p $proto} \
 285                         ${icmp_type:+--icmp-type $icmp_type} \
 286                         ${src_ip:+-s $src_ip} \
 287                         ${src_port:+--sport $src_port} \
 288                         ${src_mac:+-m mac --mac-source $src_mac} \
 289                         ${dest_ip:+-d $dest_ip} \
 290                         ${dest_port:+--dport $dest_port} \
 291                         -j $TARGET
 292         }
 293         [ "$proto" == "tcpudp" -o -z "$proto" ] && {
 294                 proto=tcp
 295                 add_rule
 296                 proto=udp
 297                 add_rule
 298                 return
 299         }
 300         add_rule
 301 }
 302
 303 fw_forwarding() {
 304         local src
 305         local dest
 306         local masq
 307
 308         config_get src $1 src
 309         config_get dest $1 dest
 310         [ -n "$src" ] && z_src=zone_${src}_forward || z_src=forward
 311         [ -n "$dest" ] && z_dest=zone_${dest}_ACCEPT || z_dest=ACCEPT
 312         $IPTABLES -I $z_src 1 -j $z_dest
 313
 314         # propagate masq zone flag
 315         find_item "$src" $CONNTRACK_ZONES && append CONNTRACK_ZONES $dest
 316         find_item "$dest" $CONNTRACK_ZONES && append CONNTRACK_ZONES $src
 317 }
 318
 319 fw_redirect() {
 320         local src
 321         local src_ip
 322         local src_port
 323         local src_dport
 324         local src_mac
 325         local dest_ip
 326         local dest_port dest_port2
 327         local proto
 328
 329         config_get src $1 src
 330         config_get src_ip $1 src_ip
 331         config_get src_port $1 src_port
 332         config_get src_dport $1 src_dport
 333         config_get src_mac $1 src_mac
 334         config_get dest_ip $1 dest_ip
 335         config_get dest_port $1 dest_port
 336         config_get proto $1 proto
 337         [ -z "$src" -o -z "$dest_ip" ] && { \
 338                 echo "redirect needs src and dest_ip"; return ; }
 339
 340         src_port_first=${src_port%-*}
 341         src_port_last=${src_port#*-}
 342         [ "$src_port_first" -ne "$src_port_last" ] && { \
 343                 src_port="$src_port_first:$src_port_last"; }
 344
 345         src_dport_first=${src_dport%-*}
 346         src_dport_last=${src_dport#*-}
 347         [ "$src_dport_first" -ne "$src_dport_last" ] && { \
 348                 src_dport="$src_dport_first:$src_dport_last"; }
 349
 350         dest_port2=$dest_port
 351         dest_port_first=${dest_port2%-*}
 352         dest_port_last=${dest_port2#*-}
 353         [ "$dest_port_first" -ne "$dest_port_last" ] && { \
 354                 dest_port2="$dest_port_first:$dest_port_last"; }
 355
 356         add_rule() {
 357                 $IPTABLES -A zone_${src}_prerouting -t nat \
 358                         ${proto:+-p $proto} \
 359                         ${src_ip:+-s $src_ip} \
 360                         ${src_port:+--sport $src_port} \
 361                         ${src_dport:+--dport $src_dport} \
 362                         ${src_mac:+-m mac --mac-source $src_mac} \
 363                         -j DNAT --to-destination $dest_ip${dest_port:+:$dest_port}
 364
 365                 $IPTABLES -I zone_${src}_forward 1 \
 366                         ${proto:+-p $proto} \
 367                         -d $dest_ip \
 368                         ${src_ip:+-s $src_ip} \
 369                         ${src_port:+--sport $src_port} \
 370                         ${dest_port2:+--dport $dest_port2} \
 371                         ${src_mac:+-m mac --mac-source $src_mac} \
 372                         -j ACCEPT
 373         }
 374         [ "$proto" == "tcpudp" -o -z "$proto" ] && {
 375                 proto=tcp
 376                 add_rule
 377                 proto=udp
 378                 add_rule
 379                 return
 380         }
 381         add_rule
 382 }
 383
 384 fw_include() {
 385         local path
 386         config_get path $1 path
 387         [ -e $path ] && . $path
 388 }
 389
 390 fw_addif() {
 391         local up
 392         local ifname
 393         config_get up $1 up
 394         config_get ifname $1 ifname
 395         [ -n "$up" ] || return 0
 396         (ACTION="ifup" INTERFACE="$1" . /etc/hotplug.d/iface/20-firewall)
 397 }
 398
 399 fw_custom_chains() {
 400         [ -n "$CUSTOM_CHAINS" ] || return 0
 401         $IPTABLES -N input_rule
 402         $IPTABLES -N output_rule
 403         $IPTABLES -N forwarding_rule
 404         $IPTABLES -N prerouting_rule -t nat
 405         $IPTABLES -N postrouting_rule -t nat
 406
 407         $IPTABLES -A INPUT -j input_rule
 408         $IPTABLES -A OUTPUT -j output_rule
 409         $IPTABLES -A FORWARD -j forwarding_rule
 410         $IPTABLES -A PREROUTING -t nat -j prerouting_rule
 411         $IPTABLES -A POSTROUTING -t nat -j postrouting_rule
 412 }
 413
 414 fw_custom_chains_zone() {
 415         local zone="$1"
 416
 417         [ -n "$CUSTOM_CHAINS" ] || return 0
 418         $IPTABLES -N input_${zone}
 419         $IPTABLES -N forwarding_${zone}
 420         $IPTABLES -N prerouting_${zone} -t nat
 421         $IPTABLES -I zone_${zone} 1 -j input_${zone}
 422         $IPTABLES -I zone_${zone}_forward 1 -j forwarding_${zone}
 423         $IPTABLES -I zone_${zone}_prerouting 1 -t nat -j prerouting_${zone}
 424 }
 425
 426 fw_check_notrack() {
 427         local zone="$1"
 428         config_get name "$zone" name
 429         [ -n "$NOTRACK_DISABLED" ] || \
 430                 find_item "$name" $CONNTRACK_ZONES || \
 431                 $IPTABLES -t raw -A zone_${name}_notrack -j NOTRACK
 432 }
 433
 434 fw_init() {
 435         DEFAULTS_APPLIED=
 436
 437         echo "Loading defaults"
 438         config_foreach fw_defaults defaults
 439         echo "Loading zones"
 440         config_foreach fw_zone zone
 441         echo "Loading forwarding"
 442         config_foreach fw_forwarding forwarding
 443         echo "Loading redirects"
 444         config_foreach fw_redirect redirect
 445         echo "Loading rules"
 446         config_foreach fw_rule rule
 447         echo "Loading includes"
 448         config_foreach fw_include include
 449         uci_set_state firewall core loaded 1
 450         config_foreach fw_check_notrack zone
 451         unset CONFIG_APPEND
 452         config_load network
 453         config_foreach fw_addif interface
 454 }
 455
 456 fw_stop() {
 457         fw_clear
 458         $IPTABLES -P INPUT ACCEPT
 459         $IPTABLES -P OUTPUT ACCEPT
 460         $IPTABLES -P FORWARD ACCEPT
 461         uci_revert_state firewall
 462 }