[package] fix typo in the uci firewall script
[openwrt/svn-archive/archive.git] / package / firewall / files / uci_firewall.sh
1 #!/bin/sh
2 # Copyright (C) 2008 John Crispin <blogic@openwrt.org>
3
4 . /etc/functions.sh
5
6 IPTABLES="echo iptables"
7 IPTABLES=iptables
8
9 config_clear
10 include /lib/network
11 scan_interfaces
12
13 CONFIG_APPEND=1
14 config_load firewall
15
16 config fw_zones
17 ZONE_LIST=$CONFIG_SECTION
18
19 CUSTOM_CHAINS=1
20 DEF_INPUT=DROP
21 DEF_OUTPUT=DROP
22 DEF_FORWARD=DROP
23 CONNTRACK_ZONES=
24 NOTRACK_DISABLED=
25
26 find_item() {
27 local item="$1"; shift
28 for i in "$@"; do
29 [ "$i" = "$item" ] && return 0
30 done
31 return 1
32 }
33
34 load_policy() {
35 config_get input $1 input
36 config_get output $1 output
37 config_get forward $1 forward
38
39 DEF_INPUT="${input:-$DEF_INPUT}"
40 DEF_OUTPUT="${output:-$DEF_OUTPUT}"
41 DEF_FORWARD="${forward:-$DEF_FORWARD}"
42 }
43
44 create_zone() {
45 local exists
46
47 [ "$1" == "loopback" ] && return
48
49 config_get exists $ZONE_LIST $1
50 [ -n "$exists" ] && return
51 config_set $ZONE_LIST $1 1
52
53 $IPTABLES -N zone_$1
54 $IPTABLES -N zone_$1_MSSFIX
55 $IPTABLES -N zone_$1_ACCEPT
56 $IPTABLES -N zone_$1_DROP
57 $IPTABLES -N zone_$1_REJECT
58 $IPTABLES -N zone_$1_forward
59 $IPTABLES -A zone_$1_forward -j zone_$1_$5
60 $IPTABLES -A zone_$1 -j zone_$1_$3
61 $IPTABLES -A output -j zone_$1_$4
62 $IPTABLES -N zone_$1_nat -t nat
63 $IPTABLES -N zone_$1_prerouting -t nat
64 $IPTABLES -t raw -N zone_$1_notrack
65 [ "$6" == "1" ] && $IPTABLES -t nat -A POSTROUTING -j zone_$1_nat
66 }
67
68 addif() {
69 local network="$1"
70 local ifname="$2"
71 local zone="$3"
72
73 local n_if n_zone
74 config_get n_if core "${network}_ifname"
75 config_get n_zone core "${network}_zone"
76 [ -n "$n_zone" ] && {
77 if [ "$n_zone" != "$zone" ]; then
78 delif "$network" "$n_if" "$n_zone"
79 else
80 return
81 fi
82 }
83
84 logger "adding $network ($ifname) to firewall zone $zone"
85 $IPTABLES -A input -i "$ifname" -j zone_${zone}
86 $IPTABLES -I zone_${zone}_MSSFIX 1 -o "$ifname" -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
87 $IPTABLES -I zone_${zone}_ACCEPT 1 -o "$ifname" -j ACCEPT
88 $IPTABLES -I zone_${zone}_DROP 1 -o "$ifname" -j DROP
89 $IPTABLES -I zone_${zone}_REJECT 1 -o "$ifname" -j reject
90 $IPTABLES -I zone_${zone}_ACCEPT 1 -i "$ifname" -j ACCEPT
91 $IPTABLES -I zone_${zone}_DROP 1 -i "$ifname" -j DROP
92 $IPTABLES -I zone_${zone}_REJECT 1 -i "$ifname" -j reject
93 $IPTABLES -I zone_${zone}_nat 1 -t nat -o "$ifname" -j MASQUERADE
94 $IPTABLES -I PREROUTING 1 -t nat -i "$ifname" -j zone_${zone}_prerouting
95 $IPTABLES -A forward -i "$ifname" -j zone_${zone}_forward
96 $IPTABLES -t raw -I PREROUTING 1 -i "$ifname" -j zone_${zone}_notrack
97 uci_set_state firewall core "${network}_ifname" "$ifname"
98 uci_set_state firewall core "${network}_zone" "$zone"
99 }
100
101 delif() {
102 local network="$1"
103 local ifname="$2"
104 local zone="$3"
105
106 logger "removing $network ($ifname) from firewall zone $zone"
107 $IPTABLES -D input -i "$ifname" -j zone_$zone
108 $IPTABLES -D zone_${zone}_MSSFIX -o "$ifname" -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
109 $IPTABLES -D zone_${zone}_ACCEPT -o "$ifname" -j ACCEPT
110 $IPTABLES -D zone_${zone}_DROP -o "$ifname" -j DROP
111 $IPTABLES -D zone_${zone}_REJECT -o "$ifname" -j reject
112 $IPTABLES -D zone_${zone}_ACCEPT -i "$ifname" -j ACCEPT
113 $IPTABLES -D zone_${zone}_DROP -i "$ifname" -j DROP
114 $IPTABLES -D zone_${zone}_REJECT -i "$ifname" -j reject
115 $IPTABLES -D zone_${zone}_nat -t nat -o "$ifname" -j MASQUERADE
116 $IPTABLES -D PREROUTING -t nat -i "$ifname" -j zone_${zone}_prerouting
117 $IPTABLES -D forward -i "$ifname" -j zone_${zone}_forward
118 uci_revert_state firewall core "${network}_ifname"
119 uci_revert_state firewall core "${network}_zone"
120 }
121
122 load_synflood() {
123 local rate=${1:-25}
124 local burst=${2:-50}
125 echo "Loading synflood protection"
126 $IPTABLES -N syn_flood
127 $IPTABLES -A syn_flood -p tcp --syn -m limit --limit $rate/second --limit-burst $burst -j RETURN
128 $IPTABLES -A syn_flood -j DROP
129 $IPTABLES -A INPUT -p tcp --syn -j syn_flood
130 }
131
132 fw_set_chain_policy() {
133 local chain=$1
134 local target=$2
135 [ "$target" == "REJECT" ] && {
136 $IPTABLES -A $chain -j reject
137 target=DROP
138 }
139 $IPTABLES -P $chain $target
140 }
141
142 fw_clear() {
143 $IPTABLES -F
144 $IPTABLES -t nat -F
145 $IPTABLES -t nat -X
146 $IPTABLES -t raw -F
147 $IPTABLES -t raw -X
148 $IPTABLES -X
149 }
150
151 fw_defaults() {
152 [ -n "$DEFAULTS_APPLIED" ] && {
153 echo "Error: multiple defaults sections detected"
154 return;
155 }
156 DEFAULTS_APPLIED=1
157
158 load_policy "$1"
159
160 echo 1 > /proc/sys/net/ipv4/tcp_syncookies
161 for f in /proc/sys/net/ipv4/conf/*/accept_redirects
162 do
163 echo 0 > $f
164 done
165 for f in /proc/sys/net/ipv4/conf/*/accept_source_route
166 do
167 echo 0 > $f
168 done
169
170 uci_revert_state firewall core
171 uci_set_state firewall core "" firewall_state
172
173 $IPTABLES -P INPUT DROP
174 $IPTABLES -P OUTPUT DROP
175 $IPTABLES -P FORWARD DROP
176
177 fw_clear
178 config_get_bool drop_invalid $1 drop_invalid 0
179
180 [ "$drop_invalid" -gt 0 ] && {
181 $IPTABLES -A INPUT -m state --state INVALID -j DROP
182 $IPTABLES -A OUTPUT -m state --state INVALID -j DROP
183 $IPTABLES -A FORWARD -m state --state INVALID -j DROP
184 NOTRACK_DISABLED=1
185 }
186
187 $IPTABLES -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
188 $IPTABLES -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
189 $IPTABLES -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
190
191 $IPTABLES -A INPUT -i lo -j ACCEPT
192 $IPTABLES -A OUTPUT -o lo -j ACCEPT
193
194 config_get syn_flood $1 syn_flood
195 config_get syn_rate $1 syn_rate
196 config_get syn_burst $1 syn_burst
197 [ "$syn_flood" == "1" ] && load_synflood $syn_rate $syn_burst
198
199 echo "Adding custom chains"
200 fw_custom_chains
201
202 $IPTABLES -N input
203 $IPTABLES -N output
204 $IPTABLES -N forward
205
206 $IPTABLES -A INPUT -j input
207 $IPTABLES -A OUTPUT -j output
208 $IPTABLES -A FORWARD -j forward
209
210 $IPTABLES -N reject
211 $IPTABLES -A reject -p tcp -j REJECT --reject-with tcp-reset
212 $IPTABLES -A reject -j REJECT --reject-with icmp-port-unreachable
213
214 fw_set_chain_policy INPUT "$DEF_INPUT"
215 fw_set_chain_policy OUTPUT "$DEF_OUTPUT"
216 fw_set_chain_policy FORWARD "$DEF_FORWARD"
217 }
218
219 fw_zone() {
220 local name
221 local network
222 local masq
223
224 config_get name $1 name
225 config_get network $1 network
226 config_get_bool masq $1 masq "0"
227 config_get_bool conntrack $1 conntrack "0"
228
229 load_policy $1
230 [ "$conntrack" = "1" -o "$masq" = "1" ] && append CONNTRACK_ZONES "$name"
231 [ -z "$network" ] && network=$name
232 create_zone "$name" "$network" "$input" "$output" "$forward" "$masq"
233 fw_custom_chains_zone "$name"
234 }
235
236 fw_rule() {
237 local src
238 local src_ip
239 local src_mac
240 local src_port
241 local src_mac
242 local dest
243 local dest_ip
244 local dest_port
245 local proto
246 local target
247 local ruleset
248
249 config_get src $1 src
250 config_get src_ip $1 src_ip
251 config_get src_mac $1 src_mac
252 config_get src_port $1 src_port
253 config_get dest $1 dest
254 config_get dest_ip $1 dest_ip
255 config_get dest_port $1 dest_port
256 config_get proto $1 proto
257 config_get target $1 target
258 config_get ruleset $1 ruleset
259
260 src_port_first=${src_port%-*}
261 src_port_last=${src_port#*-}
262 [ "$src_port_first" -ne "$src_port_last" ] && { \
263 src_port="$src_port_first:$src_port_last"; }
264
265 dest_port_first=${dest_port%-*}
266 dest_port_last=${dest_port#*-}
267 [ "$dest_port_first" -ne "$dest_port_last" ] && { \
268 dest_port="$dest_port_first:$dest_port_last"; }
269
270 ZONE=input
271 TARGET=$target
272 [ -z "$target" ] && target=DROP
273 [ -n "$src" -a -z "$dest" ] && ZONE=zone_$src
274 [ -n "$src" -a -n "$dest" ] && ZONE=zone_${src}_forward
275 [ -n "$dest" ] && TARGET=zone_${dest}_$target
276 add_rule() {
277 $IPTABLES -I $ZONE 1 \
278 ${proto:+-p $proto} \
279 ${src_ip:+-s $src_ip} \
280 ${src_port:+--sport $src_port} \
281 ${src_mac:+-m mac --mac-source $src_mac} \
282 ${dest_ip:+-d $dest_ip} \
283 ${dest_port:+--dport $dest_port} \
284 -j $TARGET
285 }
286 [ "$proto" == "tcpudp" -o -z "$proto" ] && {
287 proto=tcp
288 add_rule
289 proto=udp
290 add_rule
291 return
292 }
293 add_rule
294 }
295
296 fw_forwarding() {
297 local src
298 local dest
299 local masq
300
301 config_get src $1 src
302 config_get dest $1 dest
303 config_get_bool mtu_fix $1 mtu_fix 0
304 [ -n "$src" ] && z_src=zone_${src}_forward || z_src=forward
305 [ -n "$dest" ] && z_dest=zone_${dest}_ACCEPT || z_dest=ACCEPT
306 $IPTABLES -I $z_src 1 -j $z_dest
307 [ "$mtu_fix" -gt 0 -a -n "$dest" ] && $IPTABLES -I $z_src 1 -j zone_${dest}_MSSFIX
308
309 # propagate masq zone flag
310 find_item "$src" $CONNTRACK_ZONES && append CONNTRACK_ZONES $dest
311 find_item "$dest" $CONNTRACK_ZONES && append CONNTRACK_ZONES $src
312 }
313
314 fw_redirect() {
315 local src
316 local src_ip
317 local src_port
318 local src_dport
319 local src_mac
320 local dest_ip
321 local dest_port dest_port2
322 local proto
323
324 config_get src $1 src
325 config_get src_ip $1 src_ip
326 config_get src_port $1 src_port
327 config_get src_dport $1 src_dport
328 config_get src_mac $1 src_mac
329 config_get dest_ip $1 dest_ip
330 config_get dest_port $1 dest_port
331 config_get proto $1 proto
332 [ -z "$src" -o -z "$dest_ip" ] && { \
333 echo "redirect needs src and dest_ip"; return ; }
334
335 src_port_first=${src_port%-*}
336 src_port_last=${src_port#*-}
337 [ "$src_port_first" -ne "$src_port_last" ] && { \
338 src_port="$src_port_first:$src_port_last"; }
339
340 src_dport_first=${src_dport%-*}
341 src_dport_last=${src_dport#*-}
342 [ "$src_dport_first" -ne "$src_dport_last" ] && { \
343 src_dport="$src_dport_first:$src_dport_last"; }
344
345 dest_port2=$dest_port
346 dest_port_first=${dest_port2%-*}
347 dest_port_last=${dest_port2#*-}
348 [ "$dest_port_first" -ne "$dest_port_last" ] && { \
349 dest_port2="$dest_port_first:$dest_port_last"; }
350
351 add_rule() {
352 $IPTABLES -A zone_${src}_prerouting -t nat \
353 ${proto:+-p $proto} \
354 ${src_ip:+-s $src_ip} \
355 ${src_port:+--sport $src_port} \
356 ${src_dport:+--dport $src_dport} \
357 ${src_mac:+-m mac --mac-source $src_mac} \
358 -j DNAT --to-destination $dest_ip${dest_port:+:$dest_port}
359
360 $IPTABLES -I zone_${src}_forward 1 \
361 ${proto:+-p $proto} \
362 -d $dest_ip \
363 ${src_ip:+-s $src_ip} \
364 ${src_port:+--sport $src_port} \
365 ${dest_port2:+--dport $dest_port2} \
366 ${src_mac:+-m mac --mac-source $src_mac} \
367 -j ACCEPT
368 }
369 [ "$proto" == "tcpudp" -o -z "$proto" ] && {
370 proto=tcp
371 add_rule
372 proto=udp
373 add_rule
374 return
375 }
376 add_rule
377 }
378
379 fw_include() {
380 local path
381 config_get path $1 path
382 [ -e $path ] && . $path
383 }
384
385 fw_addif() {
386 local up
387 local ifname
388 config_get up $1 up
389 config_get ifname $1 ifname
390 [ -n "$up" ] || return 0
391 (ACTION="ifup" INTERFACE="$1" . /etc/hotplug.d/iface/20-firewall)
392 }
393
394 fw_custom_chains() {
395 [ -n "$CUSTOM_CHAINS" ] || return 0
396 $IPTABLES -N input_rule
397 $IPTABLES -N output_rule
398 $IPTABLES -N forwarding_rule
399 $IPTABLES -N prerouting_rule -t nat
400 $IPTABLES -N postrouting_rule -t nat
401
402 $IPTABLES -A INPUT -j input_rule
403 $IPTABLES -A OUTPUT -j output_rule
404 $IPTABLES -A FORWARD -j forwarding_rule
405 $IPTABLES -A PREROUTING -t nat -j prerouting_rule
406 $IPTABLES -A POSTROUTING -t nat -j postrouting_rule
407 }
408
409 fw_custom_chains_zone() {
410 local zone="$1"
411
412 [ -n "$CUSTOM_CHAINS" ] || return 0
413 $IPTABLES -N input_${zone}
414 $IPTABLES -N forwarding_${zone}
415 $IPTABLES -N prerouting_${zone} -t nat
416 $IPTABLES -I zone_${zone} 1 -j input_${zone}
417 $IPTABLES -I zone_${zone}_forward 1 -j forwarding_${zone}
418 $IPTABLES -I zone_${zone}_prerouting 1 -t nat -j prerouting_${zone}
419 }
420
421 fw_check_notrack() {
422 local zone="$1"
423 config_get name "$zone" name
424 [ -n "$NOTRACK_DISABLED" ] || \
425 find_item "$name" $CONNTRACK_ZONES || \
426 $IPTABLES -t raw -A zone_${name}_notrack -j NOTRACK
427 }
428
429 fw_init() {
430 DEFAULTS_APPLIED=
431
432 echo "Loading defaults"
433 config_foreach fw_defaults defaults
434 echo "Loading zones"
435 config_foreach fw_zone zone
436 echo "Loading forwarding"
437 config_foreach fw_forwarding forwarding
438 echo "Loading redirects"
439 config_foreach fw_redirect redirect
440 echo "Loading rules"
441 config_foreach fw_rule rule
442 echo "Loading includes"
443 config_foreach fw_include include
444 uci_set_state firewall core loaded 1
445 config_foreach fw_check_notrack zone
446 unset CONFIG_APPEND
447 config_load network
448 config_foreach fw_addif interface
449 }
450
451 fw_stop() {
452 fw_clear
453 $IPTABLES -P INPUT ACCEPT
454 $IPTABLES -P OUTPUT ACCEPT
455 $IPTABLES -P FORWARD ACCEPT
456 uci_revert_state firewall
457 }