package/firewall/files/lib/core_rule.sh

   1 # Copyright (C) 2009-2010 OpenWrt.org
   2
   3 fw_config_get_rule() {
   4         [ "${rule_NAME}" != "$1" ] || return
   5         fw_config_get_section "$1" rule { \
   6                 string _name "$1" \
   7                 string name "" \
   8                 string src "" \
   9                 ipaddr src_ip "" \
  10                 string src_mac "" \
  11                 string src_port "" \
  12                 string dest "" \
  13                 ipaddr dest_ip "" \
  14                 string dest_mac "" \
  15                 string dest_port "" \
  16                 string icmp_type "" \
  17                 string proto "tcpudp" \
  18                 string target "" \
  19                 string family "" \
  20         } || return
  21         [ -n "$rule_name" ] || rule_name=$rule__name
  22         [ "$rule_proto" == "icmp" ] || rule_icmp_type=
  23 }
  24
  25 fw_load_rule() {
  26         fw_config_get_rule "$1"
  27
  28         fw_callback pre rule
  29
  30         rule_src_port=$(fw_get_port_range $rule_src_port)
  31         rule_dest_port=$(fw_get_port_range $rule_dest_port)
  32
  33         local chain=input
  34         [ -n "$rule_src" ] && {
  35                 [ -z "$rule_dest" ] && {
  36                         chain=zone_${rule_src}
  37                 } || {
  38                         chain=zone_${rule_src}_forward
  39                 }
  40         }
  41
  42         local target=$rule_target
  43         [ -z "$target" ] && {
  44                 target=REJECT
  45         }
  46         [ -n "$dest" ] && {
  47                 target=zone_${rule_dest}_${target}
  48         }
  49
  50         local mode=$(fw_get_family_mode ${rule_family:-x} $rule_src I)
  51
  52         local rule_pos
  53         eval 'rule_pos=$((++FW__RULE_COUNT_'$mode'_'$chain'))'
  54
  55         [ "$rule_proto" == "tcpudp" ] && rule_proto="tcp udp"
  56         for rule_proto in $rule_proto; do
  57                 fw add $mode f $chain $target $rule_pos { $rule_src_ip $rule_dest_ip } { \
  58                         ${rule_proto:+-p $rule_proto} \
  59                         ${rule_src_ip:+-s $rule_src_ip/$rule_src_ip_prefixlen} \
  60                         ${rule_src_port:+--sport $rule_src_port} \
  61                         ${rule_src_mac:+-m mac --mac-source $rule_src_mac} \
  62                         ${rule_dest_ip:+-d $rule_dest_ip/$rule_dest_ip_prefixlen} \
  63                         ${rule_dest_port:+--dport $rule_dest_port} \
  64                         ${rule_icmp_type:+--icmp-type $rule_icmp_type} \
  65                 }
  66         done
  67
  68         fw_callback post rule
  69 }