[net] miniupnpd: Added uci setting of allow/deny rules, amongst other things. This...
authorDaniel Dickinson <crazycshore@gmail.com>
Tue, 8 Mar 2011 14:49:40 +0000 (14:49 +0000)
committerDaniel Dickinson <crazycshore@gmail.com>
Tue, 8 Mar 2011 14:49:40 +0000 (14:49 +0000)
SVN-Revision: 25953

net/miniupnpd/Makefile
net/miniupnpd/files/miniupnpd.init
net/miniupnpd/files/upnpd.config
net/miniupnpd/files/upnpd.config.example [new file with mode: 0644]

index 08b332b..5328856 100644 (file)
@@ -49,7 +49,9 @@ define Package/miniupnpd/install
        $(INSTALL_CONF) ./files/upnpd.config $(1)/etc/config/upnpd
        $(INSTALL_DATA) ./files/miniupnpd.iface.hotplug $(1)/etc/hotplug.d/iface/50-miniupnpd
        $(INSTALL_DATA) ./files/miniupnpd.firewall.hotplug $(1)/etc/hotplug.d/firewall/50-miniupnpd
-       $(INSTALL_DATA) $(PKG_BUILD_DIR)/miniupnpd.conf $(1)/etc/miniupnpd.conf.example
+       $(INSTALL_DIR) $(1)/usr/share/miniupnpd
+       $(INSTALL_DATA) $(PKG_BUILD_DIR)/miniupnpd.conf $(1)/usr/share/miniupnpd/miniupnpd.conf.example
+       $(INSTALL_DATA) ./files/upnpd.config.example $(1)/etc/config/upnpd.example
 endef
 
 $(eval $(call BuildPackage,miniupnpd))
index aa9eb41..ff44275 100644 (file)
@@ -1,6 +1,50 @@
 #!/bin/sh /etc/rc.common
 START=95
 
+upnpd_get_port_range() {
+    local _var="$1"; shift
+    local _val
+   
+    config_get _val "$@"
+
+    case "$_val" in
+       [0-9]*[:-][0-9]*)
+           export -n -- "${_var}_start=${_val%%[:-]*}"
+           export -n -- "${_var}_end=${_val##*[:-]}"
+       ;;
+       [0-9]*)
+           export -n -- "${_var}_start=$_val"
+           export -n -- "${_var}_end="
+       ;;
+    esac
+}
+
+conf_rule_add() {
+    local cfg="$1"
+    local tmpconf="$2"
+    local action external_port_start external_port_end ip_mask
+    local internal_port_start internal_port_end
+    config_get action "$cfg" action "deny"               # allow or deny
+    upnpd_get_port_range "ext" "$cfg" ext_ports "0-65535" # external ports: x, x-y, x:y
+    config_get int_addr "$cfg" int_addr "0.0.0.0/0"       # ip or network and subnet mask (internal)
+    upnpd_get_port_range "int" "$cfg" int_ports "0-65535" # internal ports: x, x-y, x:y or range
+    echo "${action} ${ext_start}${ext_end:+-}${ext_end} ${int_addr} ${int_start}${int_end:+-}${int_end}" >>$tmpconf   
+}
+
+upnpd_write_bool() {
+    local opt="$1"
+    local def="${2:-0}"
+    local alt="$3"
+
+    local val
+    config_get_bool val config "$opt" "$def"
+    if [ "$val" -eq 0 ]; then
+       echo "${alt:-$opt}=no" >> $tmpconf
+    else
+       echo "${alt:-$opt}=yes" >> $tmpconf
+    fi
+}
+
 start() {
        type miniupnpd_add_rules >/dev/null 2>/dev/null || \
                ACTION=- . /etc/hotplug.d/firewall/50-miniupnpd
@@ -8,7 +52,8 @@ start() {
        config_load "upnpd"
        local extiface intiface upload download logging secure enabled natpmp
        local extip port usesysuptime conffile serial_number model_number
-       local uuid notify_interval presentation_url
+       local uuid notify_interval presentation_url enable_upnp
+       local upnp_lease_file clean_ruleset_threshold clean_ruleset_interval
 
        config_get extiface config external_iface
        config_get intiface config internal_iface
@@ -17,86 +62,106 @@ start() {
        config_get upload   config upload
        config_get download config download
        config_get_bool logging config log_output 0
-       config_get_bool secure config secure_mode 0
-       config_get_bool natpmp config enable_natpmp 0
-       config_get_bool enabled config enabled 0 
-       config_get_bool usesysuptime config use_system_uptime 1
        config_get conffile config config_file
        config_get serial_number config serial_number
        config_get model_number config model_number
        config_get uuid config uuid
        config_get notify_interval config notify_interval
        config_get presentation_url config presentation_url
+       config_get upnp_lease_file config upnp_lease_file
+       config_get clean_ruleset_threshold config clean_ruleset_threshold
+       config_get clean_ruleset_interval config clean_ruleset_interval
+
+       local args
 
        include /lib/network
        scan_interfaces
 
        local ifname
        config_get ifname ${extiface:-wan} ifname
+       
+       if [ -n "$conffile" ]; then
+           args="-f $conffile"
+       else
+           local tmpconf="/var/etc/miniupnpd.conf"
+           args="-f $tmpconf"
+           mkdir -p /var/etc
 
-       if [ -n "$ifname" ]; then
-               local args="-i $ifname"
-               local iface
+           echo "ext_ifname=$ifname" >$tmpconf
 
-               [ -n "$extip" ] && \
-                       append args "-o $extip"
+           local iface
+           
+           [ -n "$extip" ] && \
+               echo "ext_ip=$extip" >>$tmpconf
                
-               for iface in ${intiface:-lan}; do
-                       local ipaddr
-                       config_get ipaddr "$iface" ipaddr
-                       [ -n "$ipaddr" ] && append args "-a $ipaddr"
-               done
-
-               [ "$port" != "auto" ] && \
-                       append args "-p $port"
+           for iface in ${intiface:-lan}; do
+               local ipaddr
+               config_get ipaddr "$iface" ipaddr
+               [ -n "$ipaddr" ] && \
+                   echo "listening_ip=$ipaddr" >>$tmpconf
+           done
+           
+           [ "$port" != "auto" ] && \
+               echo "port=$port" >>$tmpconf
+
+           config_load "upnpd"
+           upnpd_write_bool enable_natpmp 1
+           upnpd_write_bool enable_upnp 1
+           upnpd_write_bool enable_secure 1 secure_mode
+           upnpd_write_bool system_uptime 1
+
+           [ -n "$upnp_lease_file" ] && \
+               echo "lease_file=$upnp_lease_file" >>$tmpconf
                
-               [ "$usesysuptime" -eq 1 ] && \
-                       append args "-U"
+           [ -n "$upload" -a -n "$download" ] && {
+               echo "bitrate_down=$(($download * 1024 * 8))" >>$tmpconf
+               echo "bitrate_up=$(($upload * 1024 * 8))" >>$tmpconf
+           }
 
-               [ -n "$upload" -a -n "$download" ] && \
-                       append args "-B $(($download * 1024 * 8)) $(($upload * 1024 * 8))"
+           [ -n "${presentation_url}" ] && \
+               echo "presentation_url=${presentation_url}" >>$tmpconf
 
-               [ "$secure" -gt 0 ] && \
-                       append args "-S"
+           [ -n "${notify_interval}" ] && \
+               echo "notify_interval=${notify_interval}" >>$tmpconf
 
-               [ "$natpmp" -gt 0 ] && \
-                       append args "-N"
+           [ -n "${clean_ruleset_threshold}" ] && \
+               echo "clean_ruleset_threshold=${clean_ruleset_threshold}" >>$tmpconf
 
-               [ -n "$conffile" ] && \
-                       append args "-f $conffile"
+           [ -n "${clean_ruleset_interval}" ] && \
+               echo "clean_ruleset_interval=${clean_ruleset_interval}" >>$tmpconf
 
-               [ -n "${serial_number}" ] && \
-                       append args "-s ${serial_number}"
+           [ -z "$uuid" ] && {
+               uuid="$(cat /proc/sys/kernel/random/uuid)"
+               uci set upnpd.config.uuid=$uuid
+               uci commit upnpd
+           }
+
+           [ "$uuid" = "nocli" ] || \
+               echo "uuid=$uuid" >>$tmpconf
                
-               [ -n "${model_number}" ] && \
-                       append args "-m ${model_number}"
-                       
-               [ -z "$uuid" ] && {
-                       uuid="$(cat /proc/sys/kernel/random/uuid)"
-                       uci set upnpd.config.uuid=$uuid
-                       uci commit upnpd
-               }
-
-               [ "$uuid" = "nocli" ] || \
-                       append args "-u $uuid"
+           [ -n "${serial_number}" ] && \
+               echo "serial=${serial_number}" >>$tmpconf
                
-               [ -n "${notify_interval}" ] && \
-                       append args "-t ${notify_interval}"
+           [ -n "${model_number}" ] && \
+               echo "model_number=${model_number}" >>$tmpconf
+           
+           config_foreach conf_rule_add perm_rule "$tmpconf"
+       fi    
+       
                        
-               [ -n "${presentation_url}" ] && \
-                       append args "-w \"${presentation_url}\""                        
-               # start firewall
-               local zone
-               config_load firewall
-               config_get zone core "${extiface:-wan}_zone"
-               [ -n "$zone" ] && \
-                       miniupnpd_add_rules "$zone" "${extiface:-wan}" "$ifname"
-
-               if [ "$logging" = "1" ]; then
-                       [ "$enabled" -gt 0 ] && eval start-stop-daemon -S -x miniupnpd -- $args -d | logger -t miniupnpd &
-               else
-                       [ "$enabled" -gt 0 ] && eval start-stop-daemon -S -x miniupnpd -- $args 2>/dev/null
-               fi
+       if [ -n "$ifname" ]; then
+           # start firewall
+           local zone
+           config_load firewall
+           config_get zone core "${extiface:-wan}_zone"
+           [ -n "$zone" ] && \
+               miniupnpd_add_rules "$zone" "${extiface:-wan}" "$ifname"
+
+           if [ "$logging" = "1" ]; then
+               eval start-stop-daemon -S -x miniupnpd -- $args -d | logger -t miniupnpd &
+           else
+               eval start-stop-daemon -S -x miniupnpd -- $args 2>/dev/null
+           fi
        else
                logger -t "upnp daemon" "external interface not found, not starting"
        fi
index 1dd73d7..952a89a 100644 (file)
@@ -1,8 +1,14 @@
 config upnpd config
-       option enabled          0
+       option enable_natpmp    1
        option secure_mode      1
        option log_output       0
        option download         1024
        option upload           512
        option external_iface   wan
        option internal_iface   lan
+
+config perm_rule
+       option action deny
+       option ext_ports 0-65535
+       option ip_mask 0.0.0.0/0
+       option int_ports '0:65535'
diff --git a/net/miniupnpd/files/upnpd.config.example b/net/miniupnpd/files/upnpd.config.example
new file mode 100644 (file)
index 0000000..11d28bc
--- /dev/null
@@ -0,0 +1,43 @@
+config upnpd config
+       option enable_natpmp    1
+       option secure_mode      1
+       option log_output       0
+       option download         1024
+       option upload           512
+       option external_iface   wan
+       option internal_iface   lan
+
+config perm_rule
+       option action deny
+       option ext_ports 0-65535
+       option int_addr 0.0.0.0/0
+       option int_ports '0:65535'
+
+# Allow rule
+# Allow incoming on a port in the range 1024 to 65535 to be redirected to
+# any 192.168.1.0/24 subnet host (depending on secure_mod) on a port in the
+# range 1024 to 65535
+# config perm_rule
+#      option action allow
+#      option ext_ports 1024-65535
+#      option int_addr 192.168.1.0/24
+#      option int_ports 1024-65535
+
+# Single port
+# Allow incoming on 12233 to be redirected to 192.168.1.24 on a port in the
+# range 12233 to 12345 (inclusive)
+# config perm_rule
+#      option action allow
+#      option ext_ports 12233
+#      option int_addr 192.168.1.24/24
+#      option int_ports 12233-12345
+#
+
+# Deny rule (recommended at end)
+# Deny any redirection that matchs:
+#  incoming on port 0-65535, redirected to any port numbered 0-65535 on any ip
+# config perm_rule
+#       option action deny
+#       option ext_ports 0-65535
+#       option int_addr 0.0.0.0/0
+#       option int_ports 0-65535