[package] firewall:
[openwrt/svn-archive/archive.git] / package / firewall / files / lib / fw.sh
1 # Copyright (C) 2009-2010 OpenWrt.org
2 # Copyright (C) 2009 Malte S. Stretz
3
4 export FW_4_ERROR=0
5 export FW_6_ERROR=0
6 export FW_i_ERROR=0
7 export FW_e_ERROR=0
8 export FW_a_ERROR=0
9
10 #TODO: remove this
11 [ "${-#*x}" == "$-" ] && {
12 fw() {
13 fw__exec "$@"
14 }
15 } || {
16 fw() {
17 local os=$-
18 set +x
19 fw__exec "$@"
20 local rc=$?
21 set -$os
22 return $rc
23 }
24 }
25
26 fw__exec() { # <action> <family> <table> <chain> <target> <position> { <rules> }
27 local cmd fam tab chn tgt pos
28 local i
29 for i in cmd fam tab chn tgt pos; do
30 if [ "$1" -a "$1" != '{' ]; then
31 eval "$i='$1'"
32 shift
33 else
34 eval "$i=-"
35 fi
36 done
37
38 fw__rc() {
39 export FW_${fam#G}_ERROR=$1
40 return $1
41 }
42
43 fw__dualip() {
44 fw $cmd 4 $tab $chn $tgt $pos "$@"
45 fw $cmd 6 $tab $chn $tgt $pos "$@"
46 fw__rc $((FW_4_ERROR | FW_6_ERROR))
47 }
48
49 fw__autoip() {
50 local ip4 ip6
51 shift
52 while [ "$1" != '}' ]; do
53 case "$1" in
54 *:*) ip6=1 ;;
55 *.*.*.*) ip4=1 ;;
56 esac
57 shift
58 done
59 shift
60 if [ "${ip4:-4}" == "${ip6:-6}" ]; then
61 echo "fw: can't mix ip4 and ip6" >&2
62 return 1
63 fi
64 local ver=${ip4:+4}${ip6:+6}
65 fam=i
66 fw $cmd ${ver:-i} $tab $chn $tgt $pos "$@"
67 fw__rc $?
68 }
69
70 fw__has() {
71 local tab=${1:-$tab}
72 if [ $tab == '-' ]; then
73 type $app > /dev/null 2> /dev/null
74 fw__rc $(($? & 1))
75 return
76 fi
77 local mod
78 eval "mod=\$FW_${fam#G}_${tab}"
79 if [ "$mod" ]; then
80 fw__rc $mod
81 return
82 fi
83 case "$fam" in
84 *4) mod=iptable_${tab} ;;
85 *6) mod=ip6table_${tab} ;;
86 *) mod=. ;;
87 esac
88 grep -q "^${mod} " /proc/modules
89 mod=$?
90 export FW_${fam}_${tab}=$mod
91 fw__rc $mod
92 }
93
94 fw__err() {
95 local err
96 eval "err=\$FW_${fam}_ERROR"
97 fw__rc $err
98 }
99
100 local app=
101 local pol=
102 case "$fam" in
103 *4) [ $FW_DISABLE_IPV4 == 0 ] && app=iptables || return ;;
104 *6) [ $FW_DISABLE_IPV6 == 0 ] && app=ip6tables || return ;;
105 i) fw__dualip "$@"; return ;;
106 I) fw__autoip "$@"; return ;;
107 e) app=ebtables ;;
108 a) app=arptables ;;
109 -) fw $cmd i $tab $chn $tgt $pos "$@"; return ;;
110 *) return 254 ;;
111 esac
112 case "$tab" in
113 f) tab=filter ;;
114 m) tab=mangle ;;
115 n) tab=nat ;;
116 r) tab=raw ;;
117 -) tab=filter ;;
118 esac
119 case "$cmd:$chn:$tgt:$pos" in
120 add:*:-:*) cmd=new-chain ;;
121 add:*:*:-) cmd=append ;;
122 add:*:*:$) cmd=append ;;
123 add:*:*:*) cmd=insert ;;
124 del:-:*:*) cmd=delete-chain; fw flush $fam $tab ;;
125 del:*:-:*) cmd=delete-chain; fw flush $fam $tab $chn ;;
126 del:*:*:*) cmd=delete ;;
127 flush:*) ;;
128 policy:*) pol=$tgt; tgt=- ;;
129 has:*) fw__has; return ;;
130 err:*) fw__err; return ;;
131 list:*) cmd="numeric --verbose --$cmd" ;;
132 *) return 254 ;;
133 esac
134 case "$chn" in
135 -) chn= ;;
136 esac
137 case "$tgt" in
138 -) tgt= ;;
139 esac
140 case "$pos" in
141 ^) pos=1 ;;
142 $) pos= ;;
143 -) pos= ;;
144 esac
145
146 if ! fw__has - family || ! fw__has $tab ; then
147 export FW_${fam}_ERROR=0
148 return 0
149 fi
150
151 case "$fam" in
152 G*) shift; while [ $# -gt 0 ] && [ "$1" != "{" ]; do shift; done ;;
153 esac
154
155 if [ $# -gt 0 ]; then
156 shift
157 if [ $cmd == delete ]; then
158 pos=
159 fi
160 fi
161
162 local cmdline="$app --table ${tab} --${cmd} ${chn} ${pol} ${pos} ${tgt:+--jump "$tgt"}"
163 while [ $# -gt 1 ]; do
164 case "$app:$1" in
165 ip6tables:--icmp-type) cmdline="$cmdline --icmpv6-type" ;;
166 ip6tables:icmp|ip6tables:ICMP) cmdline="$cmdline icmpv6" ;;
167 iptables:--icmpv6-type) cmdline="$cmdline --icmp-type" ;;
168 iptables:icmpv6) cmdline="$cmdline icmp" ;;
169 *) cmdline="$cmdline $1" ;;
170 esac
171 shift
172 done
173
174 [ -n "$FW_TRACE" ] && echo $cmdline >&2
175
176 $cmdline
177
178 fw__rc $?
179 }
180
181 fw_get_port_range() {
182 local _var=$1
183 local _ports=$2
184 local _delim=${3:-:}
185 if [ "$4" ]; then
186 fw_get_port_range $_var "${_ports}-${4}" $_delim
187 return
188 fi
189
190 local _first=${_ports%-*}
191 local _last=${_ports#*-}
192 if [ "$_first" != "$_last" ]; then
193 export -- "$_var=$_first$_delim$_last"
194 else
195 export -- "$_var=$_first"
196 fi
197 }
198
199 fw_get_family_mode() {
200 local _var="$1"
201 local _hint="$2"
202 local _zone="$3"
203 local _mode="$4"
204
205 local _ipv4 _ipv6
206 [ -n "$FW_ZONES4$FW_ZONES6" ] && {
207 list_contains FW_ZONES4 $_zone && _ipv4=1 || _ipv4=0
208 list_contains FW_ZONES6 $_zone && _ipv6=1 || _ipv6=0
209 } || {
210 _ipv4=$(uci_get_state firewall core ${_zone}_ipv4 0)
211 _ipv6=$(uci_get_state firewall core ${_zone}_ipv6 0)
212 }
213
214 case "$_hint:$_ipv4:$_ipv6" in
215 *4:1:*|*:1:0) export -n -- "$_var=G4" ;;
216 *6:*:1|*:0:1) export -n -- "$_var=G6" ;;
217 *) export -n -- "$_var=$_mode" ;;
218 esac
219 }
220