package/firewall/files/lib/core_init.sh

   1 # Copyright (C) 2009-2010 OpenWrt.org
   2 # Copyright (C) 2008 John Crispin <blogic@openwrt.org>
   3
   4 FW_INITIALIZED=
   5
   6 FW_ZONES=
   7 FW_CONNTRACK_ZONES=
   8 FW_NOTRACK_DISABLED=
   9
  10 FW_DEFAULTS_APPLIED=
  11 FW_ADD_CUSTOM_CHAINS=
  12 FW_ACCEPT_REDIRECTS=
  13 FW_ACCEPT_SRC_ROUTE=
  14
  15 FW_DEFAULT_INPUT_POLICY=REJECT
  16 FW_DEFAULT_OUTPUT_POLICY=REJECT
  17 FW_DEFAULT_FORWARD_POLICY=REJECT
  18
  19 FW_DISABLE_IPV4=0
  20 FW_DISABLE_IPV6=0
  21
  22
  23 fw_load_defaults() {
  24         fw_config_get_section "$1" defaults { \
  25                 string input $FW_DEFAULT_INPUT_POLICY \
  26                 string output $FW_DEFAULT_OUTPUT_POLICY \
  27                 string forward $FW_DEFAULT_FORWARD_POLICY \
  28                 boolean drop_invalid 0 \
  29                 boolean syn_flood 0 \
  30                 boolean synflood_protect 0 \
  31                 string synflood_rate 25 \
  32                 string synflood_burst 50 \
  33                 boolean tcp_syncookies 1 \
  34                 boolean tcp_ecn 0 \
  35                 boolean tcp_westwood 0 \
  36                 boolean tcp_window_scaling 1 \
  37                 boolean accept_redirects 0 \
  38                 boolean accept_source_route 0 \
  39                 boolean custom_chains 1 \
  40                 boolean disable_ipv6 0 \
  41         } || return
  42         [ -n "$FW_DEFAULTS_APPLIED" ] && {
  43                 echo "Error: multiple defaults sections detected"
  44                 return 1
  45         }
  46         FW_DEFAULTS_APPLIED=1
  47
  48         FW_DEFAULT_INPUT_POLICY=$defaults_input
  49         FW_DEFAULT_OUTPUT_POLICY=$defaults_output
  50         FW_DEFAULT_FORWARD_POLICY=$defaults_forward
  51
  52         FW_ADD_CUSTOM_CHAINS=$defaults_custom_chains
  53
  54         FW_ACCEPT_REDIRECTS=$defaults_accept_redirects
  55         FW_ACCEPT_SRC_ROUTE=$defaults_accept_source_route
  56
  57         FW_DISABLE_IPV6=$defaults_disable_ipv6
  58
  59         fw_callback pre defaults
  60
  61         # Seems like there are only one sysctl for both IP versions.
  62         for s in syncookies ecn westwood window_scaling; do
  63                 eval "sysctl -e -w net.ipv4.tcp_${s}=\$defaults_tcp_${s}" >/dev/null
  64         done
  65         fw_sysctl_interface all
  66
  67         [ $defaults_drop_invalid == 1 ] && {
  68                 fw add i f INPUT   DROP { -m state --state INVALID }
  69                 fw add i f OUTPUT  DROP { -m state --state INVALID }
  70                 fw add i f FORWARD DROP { -m state --state INVALID }
  71                 FW_NOTRACK_DISABLED=1
  72         }
  73
  74         fw add i f INPUT   ACCEPT { -m state --state RELATED,ESTABLISHED }
  75         fw add i f OUTPUT  ACCEPT { -m state --state RELATED,ESTABLISHED }
  76         fw add i f FORWARD ACCEPT { -m state --state RELATED,ESTABLISHED }
  77
  78         fw add i f INPUT  ACCEPT { -i lo }
  79         fw add i f OUTPUT ACCEPT { -o lo }
  80
  81         # Compatibility to old 'syn_flood' parameter
  82         [ $defaults_syn_flood == 1 ] && \
  83                 defaults_synflood_protect=1
  84
  85         [ $defaults_synflood_protect == 1 ] && {
  86                 echo "Loading synflood protection"
  87                 fw_callback pre synflood
  88                 fw add i f syn_flood
  89                 fw add i f syn_flood RETURN { \
  90                         -p tcp --syn \
  91                         -m limit --limit "${defaults_synflood_rate}/second" --limit-burst "${defaults_synflood_burst}" \
  92                 }
  93                 fw add i f syn_flood DROP
  94                 fw add i f INPUT syn_flood { -p tcp --syn }
  95                 fw_callback post synflood
  96         }
  97
  98         [ $defaults_custom_chains == 1 ] && {
  99                 echo "Adding custom chains"
 100                 fw add i f input_rule
 101                 fw add i f output_rule
 102                 fw add i f forwarding_rule
 103                 fw add i n prerouting_rule
 104                 fw add i n postrouting_rule
 105
 106                 fw add i f INPUT       input_rule
 107                 fw add i f OUTPUT      output_rule
 108                 fw add i f FORWARD     forwarding_rule
 109                 fw add i n PREROUTING  prerouting_rule
 110                 fw add i n POSTROUTING postrouting_rule
 111         }
 112
 113         fw add i f input
 114         fw add i f output
 115         fw add i f forward
 116
 117         fw add i f INPUT   input
 118         fw add i f OUTPUT  output
 119         fw add i f FORWARD forward
 120
 121         fw add i f reject
 122         fw add i f reject REJECT { --reject-with tcp-reset -p tcp }
 123         fw add i f reject REJECT { --reject-with port-unreach }
 124
 125         fw_set_filter_policy
 126
 127         fw_callback post defaults
 128 }
 129
 130
 131 fw_config_get_zone() {
 132         [ "${zone_NAME}" != "$1" ] || return
 133         fw_config_get_section "$1" zone { \
 134                 string name "$1" \
 135                 string network "" \
 136                 string input "$FW_DEFAULT_INPUT_POLICY" \
 137                 string output "$FW_DEFAULT_OUTPUT_POLICY" \
 138                 string forward "$FW_DEFAULT_FORWARD_POLICY" \
 139                 boolean masq 0 \
 140                 boolean conntrack 0 \
 141                 boolean mtu_fix 0 \
 142                 boolean custom_chains "$FW_ADD_CUSTOM_CHAINS" \
 143         } || return
 144         [ -n "$zone_name" ] || zone_name=$zone_NAME
 145         [ -n "$zone_network" ] || zone_network=$zone_name
 146 }
 147
 148 fw_load_zone() {
 149         fw_config_get_zone "$1"
 150
 151         list_contains FW_ZONES $zone_name && {
 152                 fw_die "zone ${zone_name}: duplicated zone"
 153         }
 154         append FW_ZONES $zone_name
 155
 156         fw_callback pre zone
 157
 158         [ $zone_conntrack = 1 -o $zone_masq = 1 ] && \
 159                 append FW_CONNTRACK_ZONES "$zone_NAME"
 160
 161         local chain=zone_${zone_name}
 162
 163         fw add i f ${chain}_ACCEPT
 164         fw add i f ${chain}_DROP
 165         fw add i f ${chain}_REJECT
 166         fw add i f ${chain}_MSSFIX
 167
 168         # TODO: Rename to ${chain}_input
 169         fw add i f ${chain}
 170         fw add i f ${chain} ${chain}_${zone_input} $
 171
 172         fw add i f ${chain}_forward
 173         fw add i f ${chain}_forward ${chain}_${zone_forward} $
 174
 175         # TODO: add ${chain}_output
 176         fw add i f output ${chain}_${zone_output} $
 177
 178         # TODO: Rename to ${chain}_MASQUERADE
 179         fw add i n ${chain}_nat
 180         fw add i n ${chain}_prerouting
 181
 182         fw add i r ${chain}_notrack
 183         [ $zone_masq == 1 ] && \
 184                 fw add i n POSTROUTING ${chain}_nat $
 185
 186         [ $zone_mtu_fix == 1 ] && \
 187                 fw add i f FORWARD ${chain}_MSSFIX ^
 188
 189         [ $zone_custom_chains == 1 ] && {
 190                 [ $FW_ADD_CUSTOM_CHAINS == 1 ] || \
 191                         fw_die "zone ${zone_name}: custom_chains globally disabled"
 192
 193                 fw add i f input_${zone_name}
 194                 fw add i f ${chain} input_${zone_name} ^
 195
 196                 fw add i f forwarding_${zone_name}
 197                 fw add i f ${chain}_forward forwarding_${zone_name} ^
 198
 199                 fw add i n prerouting_${zone_name}
 200                 fw add i n ${chain}_prerouting prerouting_${zone_name} ^
 201         }
 202
 203         fw_callback post zone
 204 }
 205
 206 fw_load_notrack_zone() {
 207         list_contains FW_CONNTRACK_ZONES "$1" && return
 208
 209         fw_config_get_zone "$1"
 210
 211         fw_callback pre notrack
 212
 213         fw add i f zone_${zone_name}_notrack NOTRACK $
 214
 215         fw_callback post notrack
 216 }
 217
 218
 219 fw_load_include() {
 220         local name="$1"
 221
 222         local path; config_get path ${name} path
 223         [ -e $path ] && . $path
 224 }
 225
 226
 227 fw_clear() {
 228         local policy=$1
 229
 230         fw_set_filter_policy $policy
 231
 232         local tab
 233         for tab in f n r; do
 234                 fw del i $tab
 235         done
 236 }
 237
 238 fw_set_filter_policy() {
 239         local policy=$1
 240
 241         local chn tgt
 242         for chn in INPUT OUTPUT FORWARD; do
 243                 eval "tgt=\${policy:-\${FW_DEFAULT_${chn}_POLICY}}"
 244                 [ $tgt == "REJECT" ] && tgt=reject
 245                 [ $tgt == "ACCEPT" -o $tgt == "DROP" ] || {
 246                         fw add i f $chn $tgt $
 247                         tgt=DROP
 248                 }
 249                 fw policy i f $chn $tgt
 250         done
 251 }
 252
 253
 254 fw_callback() {
 255         local pp=$1
 256         local hk=$2
 257
 258         local libs lib
 259         eval "libs=\$FW_CB_${pp}_${hk}"
 260         [ -n "$libs" ] || return
 261         for lib in $libs; do
 262                 ${lib}_${pp}_${hk}_cb
 263         done
 264 }