[package] firewall: move include sourcing into a subshell, this makes the firewall...
[openwrt/svn-archive/archive.git] / package / firewall / files / lib / core_init.sh
1 # Copyright (C) 2009-2010 OpenWrt.org
2 # Copyright (C) 2008 John Crispin <blogic@openwrt.org>
3
4 FW_INITIALIZED=
5
6 FW_ZONES=
7 FW_ZONES4=
8 FW_ZONES6=
9 FW_CONNTRACK_ZONES=
10 FW_NOTRACK_DISABLED=
11
12 FW_DEFAULTS_APPLIED=
13 FW_ADD_CUSTOM_CHAINS=
14 FW_ACCEPT_REDIRECTS=
15 FW_ACCEPT_SRC_ROUTE=
16
17 FW_DEFAULT_INPUT_POLICY=REJECT
18 FW_DEFAULT_OUTPUT_POLICY=REJECT
19 FW_DEFAULT_FORWARD_POLICY=REJECT
20
21 FW_DISABLE_IPV4=0
22 FW_DISABLE_IPV6=0
23
24
25 fw_load_defaults() {
26 fw_config_get_section "$1" defaults { \
27 string input $FW_DEFAULT_INPUT_POLICY \
28 string output $FW_DEFAULT_OUTPUT_POLICY \
29 string forward $FW_DEFAULT_FORWARD_POLICY \
30 boolean drop_invalid 0 \
31 boolean syn_flood 0 \
32 boolean synflood_protect 0 \
33 string synflood_rate 25 \
34 string synflood_burst 50 \
35 boolean tcp_syncookies 1 \
36 boolean tcp_ecn 0 \
37 boolean tcp_westwood 0 \
38 boolean tcp_window_scaling 1 \
39 boolean accept_redirects 0 \
40 boolean accept_source_route 0 \
41 boolean custom_chains 1 \
42 boolean disable_ipv6 0 \
43 } || return
44 [ -n "$FW_DEFAULTS_APPLIED" ] && {
45 fw_log error "duplicate defaults section detected, skipping"
46 return 1
47 }
48 FW_DEFAULTS_APPLIED=1
49
50 FW_DEFAULT_INPUT_POLICY=$defaults_input
51 FW_DEFAULT_OUTPUT_POLICY=$defaults_output
52 FW_DEFAULT_FORWARD_POLICY=$defaults_forward
53
54 FW_ADD_CUSTOM_CHAINS=$defaults_custom_chains
55
56 FW_ACCEPT_REDIRECTS=$defaults_accept_redirects
57 FW_ACCEPT_SRC_ROUTE=$defaults_accept_source_route
58
59 FW_DISABLE_IPV6=$defaults_disable_ipv6
60
61 fw_callback pre defaults
62
63 # Seems like there are only one sysctl for both IP versions.
64 for s in syncookies ecn westwood window_scaling; do
65 eval "sysctl -e -w net.ipv4.tcp_${s}=\$defaults_tcp_${s}" >/dev/null
66 done
67 fw_sysctl_interface all
68
69 [ $defaults_drop_invalid == 1 ] && {
70 fw add i f INPUT DROP { -m state --state INVALID }
71 fw add i f OUTPUT DROP { -m state --state INVALID }
72 fw add i f FORWARD DROP { -m state --state INVALID }
73 FW_NOTRACK_DISABLED=1
74 }
75
76 fw add i f INPUT ACCEPT { -m state --state RELATED,ESTABLISHED }
77 fw add i f OUTPUT ACCEPT { -m state --state RELATED,ESTABLISHED }
78 fw add i f FORWARD ACCEPT { -m state --state RELATED,ESTABLISHED }
79
80 fw add i f INPUT ACCEPT { -i lo }
81 fw add i f OUTPUT ACCEPT { -o lo }
82
83 # Compatibility to old 'syn_flood' parameter
84 [ $defaults_syn_flood == 1 ] && \
85 defaults_synflood_protect=1
86
87 [ "${defaults_synflood_rate%/*}" == "$defaults_synflood_rate" ] && \
88 defaults_synflood_rate="$defaults_synflood_rate/second"
89
90 [ $defaults_synflood_protect == 1 ] && {
91 echo "Loading synflood protection"
92 fw_callback pre synflood
93 fw add i f syn_flood
94 fw add i f syn_flood RETURN { \
95 -p tcp --syn \
96 -m limit --limit "${defaults_synflood_rate}" --limit-burst "${defaults_synflood_burst}" \
97 }
98 fw add i f syn_flood DROP
99 fw add i f INPUT syn_flood { -p tcp --syn }
100 fw_callback post synflood
101 }
102
103 [ $defaults_custom_chains == 1 ] && {
104 echo "Adding custom chains"
105 fw add i f input_rule
106 fw add i f output_rule
107 fw add i f forwarding_rule
108 fw add i n prerouting_rule
109 fw add i n postrouting_rule
110
111 fw add i f INPUT input_rule
112 fw add i f OUTPUT output_rule
113 fw add i f FORWARD forwarding_rule
114 fw add i n PREROUTING prerouting_rule
115 fw add i n POSTROUTING postrouting_rule
116 }
117
118 fw add i f input
119 fw add i f output
120 fw add i f forward
121
122 fw add i f INPUT input
123 fw add i f OUTPUT output
124 fw add i f FORWARD forward
125
126 fw add i f reject
127 fw add i f reject REJECT { --reject-with tcp-reset -p tcp }
128 fw add i f reject REJECT { --reject-with port-unreach }
129
130 fw_set_filter_policy
131
132 fw_callback post defaults
133 }
134
135
136 fw_config_get_zone() {
137 [ "${zone_NAME}" != "$1" ] || return
138 fw_config_get_section "$1" zone { \
139 string name "$1" \
140 string network "" \
141 string input "$FW_DEFAULT_INPUT_POLICY" \
142 string output "$FW_DEFAULT_OUTPUT_POLICY" \
143 string forward "$FW_DEFAULT_FORWARD_POLICY" \
144 boolean masq 0 \
145 string masq_src "" \
146 string masq_dest "" \
147 boolean conntrack 0 \
148 boolean mtu_fix 0 \
149 boolean custom_chains "$FW_ADD_CUSTOM_CHAINS" \
150 boolean log 0 \
151 string log_limit 10 \
152 string family "" \
153 } || return
154 [ -n "$zone_name" ] || zone_name=$zone_NAME
155 [ -n "$zone_network" ] || zone_network=$zone_name
156 }
157
158 fw_load_zone() {
159 fw_config_get_zone "$1"
160
161 list_contains FW_ZONES $zone_name && {
162 fw_log error "zone ${zone_name}: duplicated zone, skipping"
163 return 0
164 }
165 append FW_ZONES $zone_name
166
167 fw_callback pre zone
168
169 [ $zone_conntrack = 1 -o $zone_masq = 1 ] && \
170 append FW_CONNTRACK_ZONES "$zone_name"
171
172 local mode
173 case "$zone_family" in
174 *4)
175 mode=4
176 append FW_ZONES4 $zone_name
177 uci_set_state firewall core ${zone_name}_ipv4 1
178 ;;
179 *6)
180 mode=6
181 append FW_ZONES6 $zone_name
182 uci_set_state firewall core ${zone_name}_ipv6 1
183 ;;
184 *)
185 mode=i
186 append FW_ZONES4 $zone_name
187 append FW_ZONES6 $zone_name
188 uci_set_state firewall core ${zone_name}_ipv4 1
189 uci_set_state firewall core ${zone_name}_ipv6 1
190 ;;
191 esac
192
193 local chain=zone_${zone_name}
194
195 fw add $mode f ${chain}_ACCEPT
196 fw add $mode f ${chain}_DROP
197 fw add $mode f ${chain}_REJECT
198 fw add $mode f ${chain}_MSSFIX
199
200 # TODO: Rename to ${chain}_input
201 fw add $mode f ${chain}
202 fw add $mode f ${chain} ${chain}_${zone_input} $
203
204 fw add $mode f ${chain}_forward
205 fw add $mode f ${chain}_forward ${chain}_${zone_forward} $
206
207 # TODO: add ${chain}_output
208 fw add $mode f output ${chain}_${zone_output} $
209
210 # TODO: Rename to ${chain}_MASQUERADE
211 fw add $mode n ${chain}_nat
212 fw add $mode n ${chain}_prerouting
213
214 fw add $mode r ${chain}_notrack
215
216 [ $zone_mtu_fix == 1 ] && \
217 fw add $mode f FORWARD ${chain}_MSSFIX ^
218
219 [ $zone_custom_chains == 1 ] && {
220 [ $FW_ADD_CUSTOM_CHAINS == 1 ] || \
221 fw_die "zone ${zone_name}: custom_chains globally disabled"
222
223 fw add $mode f input_${zone_name}
224 fw add $mode f ${chain} input_${zone_name} ^
225
226 fw add $mode f forwarding_${zone_name}
227 fw add $mode f ${chain}_forward forwarding_${zone_name} ^
228
229 fw add $mode n prerouting_${zone_name}
230 fw add $mode n ${chain}_prerouting prerouting_${zone_name} ^
231 }
232
233 [ "$zone_log" == 1 ] && {
234 [ "${zone_log_limit%/*}" == "$zone_log_limit" ] && \
235 zone_log_limit="$zone_log_limit/minute"
236
237 local t
238 for t in REJECT DROP MSSFIX; do
239 fw add $mode f ${chain}_${t} LOG ^ \
240 { -m limit --limit $zone_log_limit --log-prefix "$t($zone_name): " }
241 done
242 }
243
244 # NB: if MASQUERADING for IPv6 becomes available we'll need a family check here
245 if [ "$zone_masq" == 1 ]; then
246 local msrc mdst
247 for msrc in ${zone_masq_src:-0.0.0.0/0}; do
248 fw_get_negation msrc '-s' "$msrc"
249 for mdst in ${zone_masq_dest:-0.0.0.0/0}; do
250 fw_get_negation mdst '-d' "$mdst"
251 fw add $mode n ${chain}_nat MASQUERADE $ { $msrc $mdst }
252 done
253 done
254 fi
255
256 fw_callback post zone
257 }
258
259 fw_load_notrack_zone() {
260 fw_config_get_zone "$1"
261 list_contains FW_CONNTRACK_ZONES "${zone_name}" && return
262
263 fw_callback pre notrack
264
265 fw add i r zone_${zone_name}_notrack NOTRACK $
266
267 fw_callback post notrack
268 }
269
270
271 fw_load_include() {
272 local name="$1"
273
274 local path
275 config_get path ${name} path
276
277 [ -e $path ] && ( . $path )
278 }
279
280
281 fw_clear() {
282 local policy=$1
283
284 fw_set_filter_policy $policy
285
286 local tab
287 for tab in f n r; do
288 fw del i $tab
289 done
290 }
291
292 fw_set_filter_policy() {
293 local policy=$1
294
295 local chn tgt
296 for chn in INPUT OUTPUT FORWARD; do
297 eval "tgt=\${policy:-\${FW_DEFAULT_${chn}_POLICY}}"
298 [ $tgt == "REJECT" ] && tgt=reject
299 [ $tgt == "ACCEPT" -o $tgt == "DROP" ] || {
300 fw add i f $chn $tgt $
301 tgt=DROP
302 }
303 fw policy i f $chn $tgt
304 done
305 }
306
307
308 fw_callback() {
309 local pp=$1
310 local hk=$2
311
312 local libs lib
313 eval "libs=\$FW_CB_${pp}_${hk}"
314 [ -n "$libs" ] || return
315 for lib in $libs; do
316 ${lib}_${pp}_${hk}_cb
317 done
318 }