2dd989e4948673b6e725d4e4e1a6faf7685ae36c
[openwrt/svn-archive/archive.git] / package / firewall / files / lib / core_init.sh
1 # Copyright (C) 2009-2010 OpenWrt.org
2 # Copyright (C) 2008 John Crispin <blogic@openwrt.org>
3
4 FW_INITIALIZED=
5
6 FW_ZONES=
7 FW_CONNTRACK_ZONES=
8 FW_NOTRACK_DISABLED=
9
10 FW_DEFAULTS_APPLIED=
11 FW_ADD_CUSTOM_CHAINS=
12 FW_ACCEPT_REDIRECTS=
13 FW_ACCEPT_SRC_ROUTE=
14
15 FW_DEFAULT_INPUT_POLICY=REJECT
16 FW_DEFAULT_OUTPUT_POLICY=REJECT
17 FW_DEFAULT_FORWARD_POLICY=REJECT
18
19 FW_DISABLE_IPV4=0
20 FW_DISABLE_IPV6=0
21
22
23 fw_load_defaults() {
24 fw_config_get_section "$1" defaults { \
25 string input $FW_DEFAULT_INPUT_POLICY \
26 string output $FW_DEFAULT_OUTPUT_POLICY \
27 string forward $FW_DEFAULT_FORWARD_POLICY \
28 boolean drop_invalid 0 \
29 boolean syn_flood 0 \
30 boolean synflood_protect 0 \
31 string synflood_rate 25 \
32 string synflood_burst 50 \
33 boolean tcp_syncookies 1 \
34 boolean tcp_ecn 0 \
35 boolean tcp_westwood 0 \
36 boolean tcp_window_scaling 1 \
37 boolean accept_redirects 0 \
38 boolean accept_source_route 0 \
39 boolean custom_chains 1 \
40 boolean disable_ipv6 0 \
41 } || return
42 [ -n "$FW_DEFAULTS_APPLIED" ] && {
43 echo "Error: multiple defaults sections detected"
44 return 1
45 }
46 FW_DEFAULTS_APPLIED=1
47
48 FW_DEFAULT_INPUT_POLICY=$defaults_input
49 FW_DEFAULT_OUTPUT_POLICY=$defaults_output
50 FW_DEFAULT_FORWARD_POLICY=$defaults_forward
51
52 FW_ADD_CUSTOM_CHAINS=$defaults_custom_chains
53
54 FW_ACCEPT_REDIRECTS=$defaults_accept_redirects
55 FW_ACCEPT_SRC_ROUTE=$defaults_accept_source_route
56
57 FW_DISABLE_IPV6=$defaults_disable_ipv6
58
59 fw_callback pre defaults
60
61 # Seems like there are only one sysctl for both IP versions.
62 for s in syncookies ecn westwood window_scaling; do
63 eval "sysctl -e -w net.ipv4.tcp_${s}=\$defaults_tcp_${s}" >/dev/null
64 done
65 fw_sysctl_interface all
66
67 [ $defaults_drop_invalid == 1 ] && {
68 fw add i f INPUT DROP { -m state --state INVALID }
69 fw add i f OUTPUT DROP { -m state --state INVALID }
70 fw add i f FORWARD DROP { -m state --state INVALID }
71 FW_NOTRACK_DISABLED=1
72 }
73
74 fw add i f INPUT ACCEPT { -m state --state RELATED,ESTABLISHED }
75 fw add i f OUTPUT ACCEPT { -m state --state RELATED,ESTABLISHED }
76 fw add i f FORWARD ACCEPT { -m state --state RELATED,ESTABLISHED }
77
78 fw add i f INPUT ACCEPT { -i lo }
79 fw add i f OUTPUT ACCEPT { -o lo }
80
81 # Compatibility to old 'syn_flood' parameter
82 [ $defaults_syn_flood == 1 ] && \
83 defaults_synflood_protect=1
84
85 [ $defaults_synflood_protect == 1 ] && {
86 echo "Loading synflood protection"
87 fw_callback pre synflood
88 fw add i f syn_flood
89 fw add i f syn_flood RETURN { \
90 -p tcp --syn \
91 -m limit --limit "${defaults_synflood_rate}/second" --limit-burst "${defaults_synflood_burst}" \
92 }
93 fw add i f syn_flood DROP
94 fw add i f INPUT syn_flood { -p tcp --syn }
95 fw_callback post synflood
96 }
97
98 [ $defaults_custom_chains == 1 ] && {
99 echo "Adding custom chains"
100 fw add i f input_rule
101 fw add i f output_rule
102 fw add i f forwarding_rule
103 fw add i n prerouting_rule
104 fw add i n postrouting_rule
105
106 fw add i f INPUT input_rule
107 fw add i f OUTPUT output_rule
108 fw add i f FORWARD forwarding_rule
109 fw add i n PREROUTING prerouting_rule
110 fw add i n POSTROUTING postrouting_rule
111 }
112
113 fw add i f input
114 fw add i f output
115 fw add i f forward
116
117 fw add i f INPUT input
118 fw add i f OUTPUT output
119 fw add i f FORWARD forward
120
121 fw add i f reject
122 fw add i f reject REJECT { --reject-with tcp-reset -p tcp }
123 fw add i f reject REJECT { --reject-with port-unreach }
124
125 fw_set_filter_policy
126
127 fw_callback post defaults
128 }
129
130
131 fw_config_get_zone() {
132 [ "${zone_NAME}" != "$1" ] || return
133 fw_config_get_section "$1" zone { \
134 string name "$1" \
135 string network "" \
136 string input "$FW_DEFAULT_INPUT_POLICY" \
137 string output "$FW_DEFAULT_OUTPUT_POLICY" \
138 string forward "$FW_DEFAULT_FORWARD_POLICY" \
139 boolean masq 0 \
140 boolean conntrack 0 \
141 boolean mtu_fix 0 \
142 boolean custom_chains "$FW_ADD_CUSTOM_CHAINS" \
143 } || return
144 [ -n "$zone_name" ] || zone_name=$zone_NAME
145 [ -n "$zone_network" ] || zone_network=$zone_name
146 }
147
148 fw_load_zone() {
149 fw_config_get_zone "$1"
150
151 list_contains FW_ZONES $zone_name && {
152 fw_die "zone ${zone_name}: duplicated zone"
153 }
154 append FW_ZONES $zone_name
155
156 fw_callback pre zone
157
158 [ $zone_conntrack = 1 -o $zone_masq = 1 ] && \
159 append FW_CONNTRACK_ZONES "$zone_NAME"
160
161 local chain=zone_${zone_name}
162
163 fw add i f ${chain}_ACCEPT
164 fw add i f ${chain}_DROP
165 fw add i f ${chain}_REJECT
166 fw add i f ${chain}_MSSFIX
167
168 # TODO: Rename to ${chain}_input
169 fw add i f ${chain}
170 fw add i f ${chain} ${chain}_${zone_input} $
171
172 fw add i f ${chain}_forward
173 fw add i f ${chain}_forward ${chain}_${zone_forward} $
174
175 # TODO: add ${chain}_output
176 fw add i f output ${chain}_${zone_output} $
177
178 # TODO: Rename to ${chain}_MASQUERADE
179 fw add i n ${chain}_nat
180 fw add i n ${chain}_prerouting
181
182 fw add i r ${chain}_notrack
183 [ $zone_masq == 1 ] && \
184 fw add i n POSTROUTING ${chain}_nat $
185
186 [ $zone_mtu_fix == 1 ] && \
187 fw add i f FORWARD ${chain}_MSSFIX ^
188
189 [ $zone_custom_chains == 1 ] && {
190 [ $FW_ADD_CUSTOM_CHAINS == 1 ] || \
191 fw_die "zone ${zone_name}: custom_chains globally disabled"
192
193 fw add i f input_${zone_name}
194 fw add i f ${chain} input_${zone_name} ^
195
196 fw add i f forwarding_${zone_name}
197 fw add i f ${chain}_forward forwarding_${zone_name} ^
198
199 fw add i n prerouting_${zone_name}
200 fw add i n ${chain}_prerouting prerouting_${zone_name} ^
201 }
202
203 fw_callback post zone
204 }
205
206 fw_load_notrack_zone() {
207 list_contains FW_CONNTRACK_ZONES "$1" && return
208
209 fw_config_get_zone "$1"
210
211 fw_callback pre notrack
212
213 fw add i f zone_${zone_name}_notrack NOTRACK $
214
215 fw_callback post notrack
216 }
217
218
219 fw_load_include() {
220 local name="$1"
221
222 local path; config_get path ${name} path
223 [ -e $path ] && . $path
224 }
225
226
227 fw_clear() {
228 local policy=$1
229
230 fw_set_filter_policy $policy
231
232 local tab
233 for tab in f n r; do
234 fw del i $tab
235 done
236 }
237
238 fw_set_filter_policy() {
239 local policy=$1
240
241 local chn tgt
242 for chn in INPUT OUTPUT FORWARD; do
243 eval "tgt=\${policy:-\${FW_DEFAULT_${chn}_POLICY}}"
244 [ $tgt == "REJECT" ] && tgt=reject
245 [ $tgt == "ACCEPT" -o $tgt == "DROP" ] || {
246 fw add i f $chn $tgt $
247 tgt=DROP
248 }
249 fw policy i f $chn $tgt
250 done
251 }
252
253
254 fw_callback() {
255 local pp=$1
256 local hk=$2
257
258 local libs lib
259 eval "libs=\$FW_CB_${pp}_${hk}"
260 [ -n "$libs" ] || return
261 for lib in $libs; do
262 ${lib}_${pp}_${hk}_cb
263 done
264 }