[packages] firewall: fix nat reflection after netifd status format change

 - use /lib/functions/network.sh
 - simplify nat reflection code

SVN-Revision: 31936

diff --git a/package/firewall/Makefile b/package/firewall/Makefile
index e7a308f3c541c21787b22f8b650b7442343bb097..6d1e2950a1eb44adc13650932837a46d6a61349c 100644 (file)
--- a/package/firewall/Makefile
+++ b/package/firewall/Makefile
@@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
 PKG_NAME:=firewall
 
 PKG_VERSION:=2
 PKG_NAME:=firewall
 
 PKG_VERSION:=2

-PKG_RELEASE:=50
+PKG_RELEASE:=51

 
 include $(INCLUDE_DIR)/package.mk
 
 
 include $(INCLUDE_DIR)/package.mk
 

diff --git a/package/firewall/files/reflection.hotplug b/package/firewall/files/reflection.hotplug
index 62f509729175ba304e393152472fad48d03bf1fc..2da0be9a05675c2eed168d6aad82708892ef3eb2 100644 (file)
--- a/package/firewall/files/reflection.hotplug
+++ b/package/firewall/files/reflection.hotplug
@@ -1,48 +1,11 @@
 #!/bin/sh
 
 #!/bin/sh
 

-. /etc/functions.sh
-. /usr/share/libubox/jshn.sh
-
-find_iface_address()
-{
-       local iface="$1"
-       local ipaddr="$2"
-       local prefix="$3"
-
-       local idx=1
-       local tmp="$(ubus call network.interface."$iface" status 2>/dev/null)"
-
-       json_load "${tmp:-{}}"
-       json_get_type tmp address
-
-       if [ "$tmp" = array ]; then
-               json_select address
-
-               while true; do
-                       json_get_type tmp $idx
-                       [ "$tmp" = object ] || break
-
-                       json_select $((idx++))
-                       json_get_var tmp address
-
-                       case "$tmp" in
-                               *:*) json_select .. ;;
-                               *)
-                                       [ -n "$ipaddr" ] && json_get_var $ipaddr address
-                                       [ -n "$prefix" ] && json_get_var $prefix mask
-                                       return 0 
-                               ;;
-                       esac
-               done
-       fi
-
-       return 1
-}
+. /lib/functions.sh
+. /lib/functions/network.sh

 
 if [ "$ACTION" = "add" ] && [ "$INTERFACE" = "wan" ]; then
        local wanip
 
 if [ "$ACTION" = "add" ] && [ "$INTERFACE" = "wan" ]; then
        local wanip

-       find_iface_address wan wanip
-       [ -n "$wanip" ] || return
+       network_get_ipaddr wanip wan || return

 
        iptables -t nat -F nat_reflection_in 2>/dev/null || {
                iptables -t nat -N nat_reflection_in
 
        iptables -t nat -F nat_reflection_in 2>/dev/null || {
                iptables -t nat -N nat_reflection_in


@@ -99,9 +62,8 @@ if [ "$ACTION" = "add" ] && [ "$INTERFACE" = "wan" ]; then
 
                        local net
                        for net in $(find_networks "$dest"); do
 
                        local net
                        for net in $(find_networks "$dest"); do

-                               local lanip lanmk
-                               find_iface_address "$net" lanip lanmk
-                               [ -n "$lanip" ] || return
+                               local lannet
+                               network_get_subnet lannet "$net" || return

 
                                local proto
                                config_get proto "$cfg" proto
 
                                local proto
                                config_get proto "$cfg" proto


@@ -144,17 +106,17 @@ if [ "$ACTION" = "add" ] && [ "$INTERFACE" = "wan" ]; then
                                        case "$p" in
                                                tcp|udp|6|17)
                                                        iptables -t nat -A nat_reflection_in \
                                        case "$p" in
                                                tcp|udp|6|17)
                                                        iptables -t nat -A nat_reflection_in \

-                                                               -s $lanip/$lanmk -d $exthost \
+                                                               -s $lannet -d $exthost \

                                                                -p $p $extport \
                                                                -j DNAT --to $inthost:${ipmin#!}${ipmax:+-$ipmax}
 
                                                        iptables -t nat -A nat_reflection_out \
                                                                -p $p $extport \
                                                                -j DNAT --to $inthost:${ipmin#!}${ipmax:+-$ipmax}
 
                                                        iptables -t nat -A nat_reflection_out \

-                                                               -s $lanip/$lanmk -d $inthost \
+                                                               -s $lannet -d $inthost \

                                                                -p $p $intport \
                                                                -p $p $intport \

-                                                               -j SNAT --to-source $lanip
+                                                               -j SNAT --to-source ${lannet%%/*}

 
                                                        iptables -t filter -A nat_reflection_fwd \
 
                                                        iptables -t filter -A nat_reflection_fwd \

-                                                               -s $lanip/$lanmk -d $inthost \
+                                                               -s $lannet -d $inthost \

                                                                -p $p $intport \
                                                                -j ACCEPT
                                                ;;
                                                                -p $p $intport \
                                                                -j ACCEPT
                                                ;;