package/firewall/files/lib/core_rule.sh

   1 # Copyright (C) 2009-2010 OpenWrt.org
   2
   3 fw_config_get_rule() {
   4         [ "${rule_NAME}" != "$1" ] || return
   5         fw_config_get_section "$1" rule { \
   6                 string _name "$1" \
   7                 string name "" \
   8                 string src "" \
   9                 ipaddr src_ip "" \
  10                 string src_mac "" \
  11                 string src_port "" \
  12                 string dest "" \
  13                 ipaddr dest_ip "" \
  14                 string dest_port "" \
  15                 string icmp_type "" \
  16                 string proto "tcpudp" \
  17                 string target "" \
  18                 string family "" \
  19         } || return
  20         [ -n "$rule_name" ] || rule_name=$rule__name
  21         [ "$rule_proto" == "icmp" ] || rule_icmp_type=
  22 }
  23
  24 fw_load_rule() {
  25         fw_config_get_rule "$1"
  26
  27         fw_callback pre rule
  28
  29         rule_src_port=$(fw_get_port_range $rule_src_port)
  30         rule_dest_port=$(fw_get_port_range $rule_dest_port)
  31
  32         local chain=input
  33         [ -n "$rule_src" ] && {
  34                 [ -z "$rule_dest" ] && {
  35                         chain=zone_${rule_src}
  36                 } || {
  37                         chain=zone_${rule_src}_forward
  38                 }
  39         }
  40
  41         local target=$rule_target
  42         [ -z "$target" ] && {
  43                 target=REJECT
  44         }
  45         [ -n "$dest" ] && {
  46                 target=zone_${rule_dest}_${target}
  47         }
  48
  49         local mode=$(fw_get_family_mode ${rule_family:-x} $rule_src I)
  50
  51         local rule_pos
  52         eval 'rule_pos=$((++FW__RULE_COUNT_'$mode'_'$chain'))'
  53
  54         [ "$rule_proto" == "tcpudp" ] && rule_proto="tcp udp"
  55         for rule_proto in $rule_proto; do
  56                 fw add $mode f $chain $target $rule_pos { $rule_src_ip $rule_dest_ip } { \
  57                         ${rule_proto:+-p $rule_proto} \
  58                         ${rule_src_ip:+-s $rule_src_ip/$rule_src_ip_prefixlen} \
  59                         ${rule_src_port:+--sport $rule_src_port} \
  60                         ${rule_src_mac:+-m mac --mac-source $rule_src_mac} \
  61                         ${rule_dest_ip:+-d $rule_dest_ip/$rule_dest_ip_prefixlen} \
  62                         ${rule_dest_port:+--dport $rule_dest_port} \
  63                         ${rule_icmp_type:+--icmp-type $rule_icmp_type} \
  64                 }
  65         done
  66
  67         fw_callback post rule
  68 }