package/firewall/files/uci_firewall.sh

   1 #!/bin/sh
   2 # Copyright (C) 2008 John Crispin <blogic@openwrt.org>
   3
   4 . /etc/functions.sh
   5
   6 IPTABLES="echo iptables"
   7 IPTABLES=iptables
   8
   9 config_clear
  10 include /lib/network
  11 scan_interfaces
  12
  13 CONFIG_APPEND=1
  14 config_load firewall
  15
  16 config fw_zones
  17 ZONE_LIST=$CONFIG_SECTION
  18
  19 CUSTOM_CHAINS=1
  20 DEF_INPUT=DROP
  21 DEF_OUTPUT=DROP
  22 DEF_FORWARD=DROP
  23
  24 load_policy() {
  25         config_get input $1 input
  26         config_get output $1 output
  27         config_get forward $1 forward
  28
  29         DEF_INPUT="${input:-$DEF_INPUT}"
  30         DEF_OUTPUT="${output:-$DEF_OUTPUT}"
  31         DEF_FORWARD="${forward:-$DEF_FORWARD}"
  32 }
  33
  34 create_zone() {
  35         local exists
  36
  37         [ "$1" == "loopback" ] && return
  38
  39         config_get exists $ZONE_LIST $1
  40         [ -n "$exists" ] && return
  41         config_set $ZONE_LIST $1 1
  42
  43         $IPTABLES -N zone_$1
  44         $IPTABLES -N zone_$1_MSSFIX
  45         $IPTABLES -N zone_$1_ACCEPT
  46         $IPTABLES -N zone_$1_DROP
  47         $IPTABLES -N zone_$1_REJECT
  48         $IPTABLES -N zone_$1_forward
  49         $IPTABLES -A zone_$1_forward -j zone_$1_$5
  50         $IPTABLES -A zone_$1 -j zone_$1_$3
  51         $IPTABLES -A output -j zone_$1_$4
  52         $IPTABLES -N zone_$1_nat -t nat
  53         $IPTABLES -N zone_$1_prerouting -t nat
  54         [ "$6" == "1" ] && $IPTABLES -t nat -A POSTROUTING -j zone_$1_nat
  55 }
  56
  57 addif() {
  58         local network="$1"
  59         local ifname="$2"
  60         local zone="$3"
  61
  62         local n_if n_zone
  63         config_get n_if core "${network}_ifname"
  64         config_get n_zone core "${network}_zone"
  65         [ -n "$n_zone" ] && {
  66                 if [ "$n_zone" != "$zone" ]; then
  67                         delif "$network" "$n_if" "$n_zone"
  68                 else
  69                         return
  70                 fi
  71         }
  72
  73         logger "adding $network ($ifname) to firewall zone $zone"
  74         $IPTABLES -A input -i "$ifname" -j zone_${zone}
  75         $IPTABLES -I zone_${zone}_MSSFIX 1 -o "$ifname" -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
  76         $IPTABLES -I zone_${zone}_ACCEPT 1 -o "$ifname" -j ACCEPT
  77         $IPTABLES -I zone_${zone}_DROP 1 -o "$ifname" -j DROP
  78         $IPTABLES -I zone_${zone}_REJECT 1 -o "$ifname" -j reject
  79         $IPTABLES -I zone_${zone}_ACCEPT 1 -i "$ifname" -j ACCEPT
  80         $IPTABLES -I zone_${zone}_DROP 1 -i "$ifname" -j DROP
  81         $IPTABLES -I zone_${zone}_REJECT 1 -i "$ifname" -j reject
  82         $IPTABLES -I zone_${zone}_nat 1 -t nat -o "$ifname" -j MASQUERADE
  83         $IPTABLES -I PREROUTING 1 -t nat -i "$ifname" -j zone_${zone}_prerouting
  84         $IPTABLES -A forward -i "$ifname" -j zone_${zone}_forward
  85         uci_set_state firewall core "${network}_ifname" "$ifname"
  86         uci_set_state firewall core "${network}_zone" "$zone"
  87 }
  88
  89 delif() {
  90         local network="$1"
  91         local ifname="$2"
  92         local zone="$3"
  93
  94         logger "removing $network ($ifname) from firewall zone $zone"
  95         $IPTABLES -D input -i "$ifname" -j zone_$zone
  96         $IPTABLES -D zone_${zone}_MSSFIX -o "$ifname" -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
  97         $IPTABLES -D zone_${zone}_ACCEPT -o "$ifname" -j ACCEPT
  98         $IPTABLES -D zone_${zone}_DROP -o "$ifname" -j DROP
  99         $IPTABLES -D zone_${zone}_REJECT -o "$ifname" -j reject
 100         $IPTABLES -D zone_${zone}_ACCEPT -i "$ifname" -j ACCEPT
 101         $IPTABLES -D zone_${zone}_DROP -i "$ifname" -j DROP
 102         $IPTABLES -D zone_${zone}_REJECT -i "$ifname" -j reject
 103         $IPTABLES -D zone_${zone}_nat -t nat -o "$ifname" -j MASQUERADE
 104         $IPTABLES -D PREROUTING -t nat -i "$ifname" -j zone_${zone}_prerouting
 105         $IPTABLES -D forward -i "$ifname" -j zone_${zone}_forward
 106         uci_revert_state firewall core "${network}_ifname"
 107         uci_revert_state firewall core "${network}_zone"
 108 }
 109
 110 load_synflood() {
 111         local rate=${1:-25}
 112         local burst=${2:-50}
 113         echo "Loading synflood protection"
 114         $IPTABLES -N syn_flood
 115         $IPTABLES -A syn_flood -p tcp --syn -m limit --limit $rate/second --limit-burst $burst -j RETURN
 116         $IPTABLES -A syn_flood -j DROP
 117         $IPTABLES -A INPUT -p tcp --syn -j syn_flood
 118 }
 119
 120 fw_set_chain_policy() {
 121         local chain=$1
 122         local target=$2
 123         [ "$target" == "REJECT" ] && {
 124                 $IPTABLES -A $chain -j reject
 125                 target=DROP
 126         }
 127         $IPTABLES -P $chain $target
 128 }
 129
 130 fw_defaults() {
 131         [ -n "$DEFAULTS_APPLIED" ] && {
 132                 echo "Error: multiple defaults sections detected"
 133                 return;
 134         }
 135         DEFAULTS_APPLIED=1
 136
 137         load_policy "$1"
 138
 139         echo 1 > /proc/sys/net/ipv4/tcp_syncookies
 140         for f in /proc/sys/net/ipv4/conf/*/accept_redirects
 141         do
 142                 echo 0 > $f
 143         done
 144         for f in /proc/sys/net/ipv4/conf/*/accept_source_route
 145         do
 146                 echo 0 > $f
 147         done
 148
 149         uci_revert_state firewall core
 150         uci_set_state firewall core "" firewall_state
 151
 152         $IPTABLES -P INPUT DROP
 153         $IPTABLES -P OUTPUT DROP
 154         $IPTABLES -P FORWARD DROP
 155
 156         $IPTABLES -F
 157         $IPTABLES -t mangle -F
 158         $IPTABLES -t nat -F
 159         $IPTABLES -t mangle -X
 160         $IPTABLES -t nat -X
 161         $IPTABLES -X
 162
 163         config_get_bool drop_invalid $1 drop_invalid 1
 164
 165         [ "$drop_invalid" -gt 0 ] && {
 166                 $IPTABLES -A INPUT -m state --state INVALID -j DROP
 167                 $IPTABLES -A OUTPUT -m state --state INVALID -j DROP
 168                 $IPTABLES -A FORWARD -m state --state INVALID -j DROP
 169         }
 170
 171         $IPTABLES -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
 172         $IPTABLES -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
 173         $IPTABLES -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
 174
 175         $IPTABLES -A INPUT -i lo -j ACCEPT
 176         $IPTABLES -A OUTPUT -o lo -j ACCEPT
 177
 178         config_get syn_flood $1 syn_flood
 179         config_get syn_rate $1 syn_rate
 180         config_get syn_burst $1 syn_burst
 181         [ "$syn_flood" == "1" ] && load_synflood $syn_rate $syn_burst
 182
 183         echo "Adding custom chains"
 184         fw_custom_chains
 185
 186         $IPTABLES -N input
 187         $IPTABLES -N output
 188         $IPTABLES -N forward
 189
 190         $IPTABLES -A INPUT -j input
 191         $IPTABLES -A OUTPUT -j output
 192         $IPTABLES -A FORWARD -j forward
 193
 194         $IPTABLES -N reject
 195         $IPTABLES -A reject -p tcp -j REJECT --reject-with tcp-reset
 196         $IPTABLES -A reject -j REJECT --reject-with icmp-port-unreachable
 197
 198         fw_set_chain_policy INPUT "$DEF_INPUT"
 199         fw_set_chain_policy OUTPUT "$DEF_OUTPUT"
 200         fw_set_chain_policy FORWARD "$DEF_FORWARD"
 201 }
 202
 203 fw_zone() {
 204         local name
 205         local network
 206         local masq
 207
 208         config_get name $1 name
 209         config_get network $1 network
 210         config_get masq $1 masq
 211         load_policy $1
 212
 213         [ -z "$network" ] && network=$name
 214         create_zone "$name" "$network" "$input" "$output" "$forward" "$masq"
 215         fw_custom_chains_zone "$name"
 216 }
 217
 218 fw_rule() {
 219         local src
 220         local src_ip
 221         local src_mac
 222         local src_port
 223         local src_mac
 224         local dest
 225         local dest_ip
 226         local dest_port
 227         local proto
 228         local target
 229         local ruleset
 230
 231         config_get src $1 src
 232         config_get src_ip $1 src_ip
 233         config_get src_mac $1 src_mac
 234         config_get src_port $1 src_port
 235         config_get dest $1 dest
 236         config_get dest_ip $1 dest_ip
 237         config_get dest_port $1 dest_port
 238         config_get proto $1 proto
 239         config_get target $1 target
 240         config_get ruleset $1 ruleset
 241
 242         src_port_first=${src_port%-*}
 243         src_port_last=${src_port#*-}
 244         [ "$src_port_first" -ne "$src_port_last" ] && { \
 245                 src_port="$src_port_first:$src_port_last"; }
 246
 247         dest_port_first=${dest_port%-*}
 248         dest_port_last=${dest_port#*-}
 249         [ "$dest_port_first" -ne "$dest_port_last" ] && { \
 250                 dest_port="$dest_port_first:$dest_port_last"; }
 251
 252         ZONE=input
 253         TARGET=$target
 254         [ -z "$target" ] && target=DROP
 255         [ -n "$src" -a -z "$dest" ] && ZONE=zone_$src
 256         [ -n "$src" -a -n "$dest" ] && ZONE=zone_${src}_forward
 257         [ -n "$dest" ] && TARGET=zone_${dest}_$target
 258         add_rule() {
 259                 $IPTABLES -I $ZONE 1 \
 260                         ${proto:+-p $proto} \
 261                         ${src_ip:+-s $src_ip} \
 262                         ${src_port:+--sport $src_port} \
 263                         ${src_mac:+-m mac --mac-source $src_mac} \
 264                         ${dest_ip:+-d $dest_ip} \
 265                         ${dest_port:+--dport $dest_port} \
 266                         -j $TARGET
 267         }
 268         [ "$proto" == "tcpudp" -o -z "$proto" ] && {
 269                 proto=tcp
 270                 add_rule
 271                 proto=udp
 272                 add_rule
 273                 return
 274         }
 275         add_rule
 276 }
 277
 278 fw_forwarding() {
 279         local src
 280         local dest
 281         local masq
 282
 283         config_get src $1 src
 284         config_get dest $1 dest
 285         config_get_bool mtu_fix $1 mtu_fix 0
 286         [ -n "$src" ] && z_src=zone_${src}_forward || z_src=forward
 287         [ -n "$dest" ] && z_dest=zone_${dest}_ACCEPT || z_dest=ACCEPT
 288         $IPTABLES -I $z_src 1 -j $z_dest
 289         [ "$mtu_fix" -gt 0 -a -n "$dest" ] && $IPTABLES -I $z_src 1 -j zone_${dest}_MSSFIX
 290 }
 291
 292 fw_redirect() {
 293         local src
 294         local src_ip
 295         local src_port
 296         local src_dport
 297         local src_mac
 298         local dest_ip
 299         local dest_port dest_port2
 300         local proto
 301
 302         config_get src $1 src
 303         config_get src_ip $1 src_ip
 304         config_get src_port $1 src_port
 305         config_get src_dport $1 src_dport
 306         config_get src_mac $1 src_mac
 307         config_get dest_ip $1 dest_ip
 308         config_get dest_port $1 dest_port
 309         config_get proto $1 proto
 310         [ -z "$src" -o -z "$dest_ip" ] && { \
 311                 echo "redirect needs src and dest_ip"; return ; }
 312
 313         src_port_first=${src_port%-*}
 314         src_port_last=${src_port#*-}
 315         [ "$src_port_first" -ne "$src_port_last" ] && { \
 316                 src_port="$src_port_first:$src_port_last"; }
 317
 318         src_dport_first=${src_dport%-*}
 319         src_dport_last=${src_dport#*-}
 320         [ "$src_dport_first" -ne "$src_dport_last" ] && { \
 321                 src_dport="$src_dport_first:$src_dport_last"; }
 322
 323         dest_port2=$dest_port
 324         dest_port_first=${dest_port2%-*}
 325         dest_port_last=${dest_port2#*-}
 326         [ "$dest_port_first" -ne "$dest_port_last" ] && { \
 327                 dest_port2="$dest_port_first:$dest_port_last"; }
 328
 329         add_rule() {
 330                 $IPTABLES -A zone_${src}_prerouting -t nat \
 331                         ${proto:+-p $proto} \
 332                         ${src_ip:+-s $src_ip} \
 333                         ${src_port:+--sport $src_port} \
 334                         ${src_dport:+--dport $src_dport} \
 335                         ${src_mac:+-m mac --mac-source $src_mac} \
 336                         -j DNAT --to-destination $dest_ip${dest_port:+:$dest_port}
 337
 338                 $IPTABLES -I zone_${src}_forward 1 \
 339                         ${proto:+-p $proto} \
 340                         -d $dest_ip \
 341                         ${src_ip:+-s $src_ip} \
 342                         ${src_port:+--sport $src_port} \
 343                         ${dest_port2:+--dport $dest_port2} \
 344                         ${src_mac:+-m mac --mac-source $src_mac} \
 345                         -j ACCEPT
 346         }
 347         [ "$proto" == "tcpudp" -o -z "$proto" ] && {
 348                 proto=tcp
 349                 add_rule
 350                 proto=udp
 351                 add_rule
 352                 return
 353         }
 354         add_rule
 355 }
 356
 357 fw_include() {
 358         local path
 359         config_get path $1 path
 360         [ -e $path ] && . $path
 361 }
 362
 363 fw_addif() {
 364         local up
 365         local ifname
 366         config_get up $1 up
 367         config_get ifname $1 ifname
 368         [ -n "$up" ] || return 0
 369         (ACTION="ifup" INTERFACE="$1" . /etc/hotplug.d/iface/20-firewall)
 370 }
 371
 372 fw_custom_chains() {
 373         [ -n "$CUSTOM_CHAINS" ] || return 0
 374         $IPTABLES -N input_rule
 375         $IPTABLES -N output_rule
 376         $IPTABLES -N forwarding_rule
 377         $IPTABLES -N prerouting_rule -t nat
 378         $IPTABLES -N postrouting_rule -t nat
 379
 380         $IPTABLES -A INPUT -j input_rule
 381         $IPTABLES -A OUTPUT -j output_rule
 382         $IPTABLES -A FORWARD -j forwarding_rule
 383         $IPTABLES -A PREROUTING -t nat -j prerouting_rule
 384         $IPTABLES -A POSTROUTING -t nat -j postrouting_rule
 385 }
 386
 387 fw_custom_chains_zone() {
 388         local zone="$1"
 389
 390         [ -n "$CUSTOM_CHAINS" ] || return 0
 391         $IPTABLES -N input_${zone}
 392         $IPTABLES -N forwarding_${zone}
 393         $IPTABLES -N prerouting_${zone} -t nat
 394         $IPTABLES -I zone_${zone} 1 -j input_${zone}
 395         $IPTABLES -I zone_${zone}_forward 1 -j forwarding_${zone}
 396         $IPTABLES -I zone_${zone}_prerouting 1 -t nat -j prerouting_${zone}
 397 }
 398
 399 fw_init() {
 400         DEFAULTS_APPLIED=
 401
 402         echo "Loading defaults"
 403         config_foreach fw_defaults defaults
 404         echo "Loading zones"
 405         config_foreach fw_zone zone
 406         echo "Loading rules"
 407         config_foreach fw_rule rule
 408         echo "Loading forwarding"
 409         config_foreach fw_forwarding forwarding
 410         echo "Loading redirects"
 411         config_foreach fw_redirect redirect
 412         echo "Loading includes"
 413         config_foreach fw_include include
 414         uci_set_state firewall core loaded 1
 415         unset CONFIG_APPEND
 416         config_load network
 417         config_foreach fw_addif interface
 418 }
 419
 420 fw_stop() {
 421         $IPTABLES -F
 422         $IPTABLES -t mangle -F
 423         $IPTABLES -t nat -F
 424         $IPTABLES -t mangle -X
 425         $IPTABLES -t nat -X
 426         $IPTABLES -X
 427         $IPTABLES -P INPUT ACCEPT
 428         $IPTABLES -P OUTPUT ACCEPT
 429         $IPTABLES -P FORWARD ACCEPT
 430         uci_revert_state firewall core
 431 }