[package] firewall: run ifdown hotplug events synchronized, fixes a racecondition...
[openwrt/svn-archive/archive.git] / package / firewall / files / lib / core.sh
1 # Copyright (C) 2009-2010 OpenWrt.org
2
3 FW_LIBDIR=${FW_LIBDIR:-/lib/firewall}
4
5 . $FW_LIBDIR/fw.sh
6 include /lib/network
7
8 fw_start() {
9 fw_init
10
11 FW_DEFAULTS_APPLIED=
12
13 fw_is_loaded && {
14 echo "firewall already loaded" >&2
15 exit 1
16 }
17
18 uci_set_state firewall core "" firewall_state
19
20 fw_clear DROP
21
22 fw_callback pre core
23
24 echo "Loading defaults"
25 fw_config_once fw_load_defaults defaults
26
27 echo "Loading zones"
28 config_foreach fw_load_zone zone
29
30 echo "Loading forwardings"
31 config_foreach fw_load_forwarding forwarding
32
33 echo "Loading redirects"
34 config_foreach fw_load_redirect redirect
35
36 echo "Loading rules"
37 config_foreach fw_load_rule rule
38
39 echo "Loading includes"
40 config_foreach fw_load_include include
41
42 [ -z "$FW_NOTRACK_DISABLED" ] && {
43 echo "Optimizing conntrack"
44 config_foreach fw_load_notrack_zone zone
45 }
46
47 echo "Loading interfaces"
48 config_foreach fw_configure_interface interface add
49
50 fw_callback post core
51
52 uci_set_state firewall core zones "$FW_ZONES"
53 uci_set_state firewall core loaded 1
54 }
55
56 fw_stop() {
57 fw_init
58
59 fw_callback pre stop
60
61 local z n i
62 config_get z core zones
63 for z in $z; do
64 config_get n core "${z}_networks"
65 for n in $n; do
66 config_get i core "${n}_ifname"
67 [ -n "$i" ] && env -i ACTION=remove ZONE="$z" \
68 INTERFACE="$n" DEVICE="$i" /sbin/hotplug-call firewall
69 done
70 done
71
72 fw_clear ACCEPT
73
74 fw_callback post stop
75
76 uci_revert_state firewall
77 config_clear
78
79 local h
80 for h in $FW_HOOKS; do unset $h; done
81
82 unset FW_HOOKS
83 unset FW_INITIALIZED
84 }
85
86 fw_restart() {
87 fw_stop
88 fw_start
89 }
90
91 fw_reload() {
92 fw_restart
93 }
94
95 fw_is_loaded() {
96 local bool=$(uci_get_state firewall.core.loaded)
97 return $((! ${bool:-0}))
98 }
99
100
101 fw_die() {
102 echo "Error:" "$@" >&2
103 fw_log error "$@"
104 fw_stop
105 exit 1
106 }
107
108 fw_log() {
109 local level="$1"
110 [ -n "$2" ] || {
111 shift
112 level=notice
113 }
114 logger -t firewall -p user.$level "$@"
115 }
116
117
118 fw_init() {
119 [ -z "$FW_INITIALIZED" ] || return 0
120
121 . $FW_LIBDIR/config.sh
122
123 scan_interfaces
124 fw_config_append firewall
125
126 local hooks="core stop defaults zone notrack synflood"
127 local file lib hk pp
128 for file in $FW_LIBDIR/core_*.sh; do
129 . $file
130 hk=$(basename $file .sh)
131 hk=${hk#core_}
132 append hooks $hk
133 done
134 for file in $FW_LIBDIR/*.sh; do
135 lib=$(basename $file .sh)
136 lib=${lib##[0-9][0-9]_}
137 case $lib in
138 core*|fw|config|uci_firewall) continue ;;
139 esac
140 . $file
141 for hk in $hooks; do
142 for pp in pre post; do
143 type ${lib}_${pp}_${hk}_cb >/dev/null && {
144 append FW_CB_${pp}_${hk} ${lib}
145 append FW_HOOKS FW_CB_${pp}_${hk}
146 }
147 done
148 done
149 done
150
151 fw_callback post init
152
153 FW_INITIALIZED=1
154 return 0
155 }