From: Daniel Dickinson Date: Tue, 8 Mar 2011 14:49:40 +0000 (+0000) Subject: [net] miniupnpd: Added uci setting of allow/deny rules, amongst other things. This... X-Git-Url: http://git.openwrt.org/?p=openwrt%2Fsvn-archive%2Farchive.git;a=commitdiff_plain;h=ccbe22dcf0db753f6a3e459e365cb2dad6ecd2bc [net] miniupnpd: Added uci setting of allow/deny rules, amongst other things. This involved switching to the use of /var/etc/miniupnpd.conf that is generated on the fly, instead of command-line parameters. SVN-Revision: 25953 --- diff --git a/net/miniupnpd/Makefile b/net/miniupnpd/Makefile index 08b332bd87..532885619a 100644 --- a/net/miniupnpd/Makefile +++ b/net/miniupnpd/Makefile @@ -49,7 +49,9 @@ define Package/miniupnpd/install $(INSTALL_CONF) ./files/upnpd.config $(1)/etc/config/upnpd $(INSTALL_DATA) ./files/miniupnpd.iface.hotplug $(1)/etc/hotplug.d/iface/50-miniupnpd $(INSTALL_DATA) ./files/miniupnpd.firewall.hotplug $(1)/etc/hotplug.d/firewall/50-miniupnpd - $(INSTALL_DATA) $(PKG_BUILD_DIR)/miniupnpd.conf $(1)/etc/miniupnpd.conf.example + $(INSTALL_DIR) $(1)/usr/share/miniupnpd + $(INSTALL_DATA) $(PKG_BUILD_DIR)/miniupnpd.conf $(1)/usr/share/miniupnpd/miniupnpd.conf.example + $(INSTALL_DATA) ./files/upnpd.config.example $(1)/etc/config/upnpd.example endef $(eval $(call BuildPackage,miniupnpd)) diff --git a/net/miniupnpd/files/miniupnpd.init b/net/miniupnpd/files/miniupnpd.init index aa9eb41221..ff442758fe 100644 --- a/net/miniupnpd/files/miniupnpd.init +++ b/net/miniupnpd/files/miniupnpd.init @@ -1,6 +1,50 @@ #!/bin/sh /etc/rc.common START=95 +upnpd_get_port_range() { + local _var="$1"; shift + local _val + + config_get _val "$@" + + case "$_val" in + [0-9]*[:-][0-9]*) + export -n -- "${_var}_start=${_val%%[:-]*}" + export -n -- "${_var}_end=${_val##*[:-]}" + ;; + [0-9]*) + export -n -- "${_var}_start=$_val" + export -n -- "${_var}_end=" + ;; + esac +} + +conf_rule_add() { + local cfg="$1" + local tmpconf="$2" + local action external_port_start external_port_end ip_mask + local internal_port_start internal_port_end + config_get action "$cfg" action "deny" # allow or deny + upnpd_get_port_range "ext" "$cfg" ext_ports "0-65535" # external ports: x, x-y, x:y + config_get int_addr "$cfg" int_addr "0.0.0.0/0" # ip or network and subnet mask (internal) + upnpd_get_port_range "int" "$cfg" int_ports "0-65535" # internal ports: x, x-y, x:y or range + echo "${action} ${ext_start}${ext_end:+-}${ext_end} ${int_addr} ${int_start}${int_end:+-}${int_end}" >>$tmpconf +} + +upnpd_write_bool() { + local opt="$1" + local def="${2:-0}" + local alt="$3" + + local val + config_get_bool val config "$opt" "$def" + if [ "$val" -eq 0 ]; then + echo "${alt:-$opt}=no" >> $tmpconf + else + echo "${alt:-$opt}=yes" >> $tmpconf + fi +} + start() { type miniupnpd_add_rules >/dev/null 2>/dev/null || \ ACTION=- . /etc/hotplug.d/firewall/50-miniupnpd @@ -8,7 +52,8 @@ start() { config_load "upnpd" local extiface intiface upload download logging secure enabled natpmp local extip port usesysuptime conffile serial_number model_number - local uuid notify_interval presentation_url + local uuid notify_interval presentation_url enable_upnp + local upnp_lease_file clean_ruleset_threshold clean_ruleset_interval config_get extiface config external_iface config_get intiface config internal_iface @@ -17,86 +62,106 @@ start() { config_get upload config upload config_get download config download config_get_bool logging config log_output 0 - config_get_bool secure config secure_mode 0 - config_get_bool natpmp config enable_natpmp 0 - config_get_bool enabled config enabled 0 - config_get_bool usesysuptime config use_system_uptime 1 config_get conffile config config_file config_get serial_number config serial_number config_get model_number config model_number config_get uuid config uuid config_get notify_interval config notify_interval config_get presentation_url config presentation_url + config_get upnp_lease_file config upnp_lease_file + config_get clean_ruleset_threshold config clean_ruleset_threshold + config_get clean_ruleset_interval config clean_ruleset_interval + + local args include /lib/network scan_interfaces local ifname config_get ifname ${extiface:-wan} ifname + + if [ -n "$conffile" ]; then + args="-f $conffile" + else + local tmpconf="/var/etc/miniupnpd.conf" + args="-f $tmpconf" + mkdir -p /var/etc - if [ -n "$ifname" ]; then - local args="-i $ifname" - local iface + echo "ext_ifname=$ifname" >$tmpconf - [ -n "$extip" ] && \ - append args "-o $extip" + local iface + + [ -n "$extip" ] && \ + echo "ext_ip=$extip" >>$tmpconf - for iface in ${intiface:-lan}; do - local ipaddr - config_get ipaddr "$iface" ipaddr - [ -n "$ipaddr" ] && append args "-a $ipaddr" - done - - [ "$port" != "auto" ] && \ - append args "-p $port" + for iface in ${intiface:-lan}; do + local ipaddr + config_get ipaddr "$iface" ipaddr + [ -n "$ipaddr" ] && \ + echo "listening_ip=$ipaddr" >>$tmpconf + done + + [ "$port" != "auto" ] && \ + echo "port=$port" >>$tmpconf + + config_load "upnpd" + upnpd_write_bool enable_natpmp 1 + upnpd_write_bool enable_upnp 1 + upnpd_write_bool enable_secure 1 secure_mode + upnpd_write_bool system_uptime 1 + + [ -n "$upnp_lease_file" ] && \ + echo "lease_file=$upnp_lease_file" >>$tmpconf - [ "$usesysuptime" -eq 1 ] && \ - append args "-U" + [ -n "$upload" -a -n "$download" ] && { + echo "bitrate_down=$(($download * 1024 * 8))" >>$tmpconf + echo "bitrate_up=$(($upload * 1024 * 8))" >>$tmpconf + } - [ -n "$upload" -a -n "$download" ] && \ - append args "-B $(($download * 1024 * 8)) $(($upload * 1024 * 8))" + [ -n "${presentation_url}" ] && \ + echo "presentation_url=${presentation_url}" >>$tmpconf - [ "$secure" -gt 0 ] && \ - append args "-S" + [ -n "${notify_interval}" ] && \ + echo "notify_interval=${notify_interval}" >>$tmpconf - [ "$natpmp" -gt 0 ] && \ - append args "-N" + [ -n "${clean_ruleset_threshold}" ] && \ + echo "clean_ruleset_threshold=${clean_ruleset_threshold}" >>$tmpconf - [ -n "$conffile" ] && \ - append args "-f $conffile" + [ -n "${clean_ruleset_interval}" ] && \ + echo "clean_ruleset_interval=${clean_ruleset_interval}" >>$tmpconf - [ -n "${serial_number}" ] && \ - append args "-s ${serial_number}" + [ -z "$uuid" ] && { + uuid="$(cat /proc/sys/kernel/random/uuid)" + uci set upnpd.config.uuid=$uuid + uci commit upnpd + } + + [ "$uuid" = "nocli" ] || \ + echo "uuid=$uuid" >>$tmpconf - [ -n "${model_number}" ] && \ - append args "-m ${model_number}" - - [ -z "$uuid" ] && { - uuid="$(cat /proc/sys/kernel/random/uuid)" - uci set upnpd.config.uuid=$uuid - uci commit upnpd - } - - [ "$uuid" = "nocli" ] || \ - append args "-u $uuid" + [ -n "${serial_number}" ] && \ + echo "serial=${serial_number}" >>$tmpconf - [ -n "${notify_interval}" ] && \ - append args "-t ${notify_interval}" + [ -n "${model_number}" ] && \ + echo "model_number=${model_number}" >>$tmpconf + + config_foreach conf_rule_add perm_rule "$tmpconf" + fi + - [ -n "${presentation_url}" ] && \ - append args "-w \"${presentation_url}\"" - # start firewall - local zone - config_load firewall - config_get zone core "${extiface:-wan}_zone" - [ -n "$zone" ] && \ - miniupnpd_add_rules "$zone" "${extiface:-wan}" "$ifname" - - if [ "$logging" = "1" ]; then - [ "$enabled" -gt 0 ] && eval start-stop-daemon -S -x miniupnpd -- $args -d | logger -t miniupnpd & - else - [ "$enabled" -gt 0 ] && eval start-stop-daemon -S -x miniupnpd -- $args 2>/dev/null - fi + if [ -n "$ifname" ]; then + # start firewall + local zone + config_load firewall + config_get zone core "${extiface:-wan}_zone" + [ -n "$zone" ] && \ + miniupnpd_add_rules "$zone" "${extiface:-wan}" "$ifname" + + if [ "$logging" = "1" ]; then + eval start-stop-daemon -S -x miniupnpd -- $args -d | logger -t miniupnpd & + else + eval start-stop-daemon -S -x miniupnpd -- $args 2>/dev/null + fi else logger -t "upnp daemon" "external interface not found, not starting" fi diff --git a/net/miniupnpd/files/upnpd.config b/net/miniupnpd/files/upnpd.config index 1dd73d7177..952a89a80a 100644 --- a/net/miniupnpd/files/upnpd.config +++ b/net/miniupnpd/files/upnpd.config @@ -1,8 +1,14 @@ config upnpd config - option enabled 0 + option enable_natpmp 1 option secure_mode 1 option log_output 0 option download 1024 option upload 512 option external_iface wan option internal_iface lan + +config perm_rule + option action deny + option ext_ports 0-65535 + option ip_mask 0.0.0.0/0 + option int_ports '0:65535' diff --git a/net/miniupnpd/files/upnpd.config.example b/net/miniupnpd/files/upnpd.config.example new file mode 100644 index 0000000000..11d28bc559 --- /dev/null +++ b/net/miniupnpd/files/upnpd.config.example @@ -0,0 +1,43 @@ +config upnpd config + option enable_natpmp 1 + option secure_mode 1 + option log_output 0 + option download 1024 + option upload 512 + option external_iface wan + option internal_iface lan + +config perm_rule + option action deny + option ext_ports 0-65535 + option int_addr 0.0.0.0/0 + option int_ports '0:65535' + +# Allow rule +# Allow incoming on a port in the range 1024 to 65535 to be redirected to +# any 192.168.1.0/24 subnet host (depending on secure_mod) on a port in the +# range 1024 to 65535 +# config perm_rule +# option action allow +# option ext_ports 1024-65535 +# option int_addr 192.168.1.0/24 +# option int_ports 1024-65535 + +# Single port +# Allow incoming on 12233 to be redirected to 192.168.1.24 on a port in the +# range 12233 to 12345 (inclusive) +# config perm_rule +# option action allow +# option ext_ports 12233 +# option int_addr 192.168.1.24/24 +# option int_ports 12233-12345 +# + +# Deny rule (recommended at end) +# Deny any redirection that matchs: +# incoming on port 0-65535, redirected to any port numbered 0-65535 on any ip +# config perm_rule +# option action deny +# option ext_ports 0-65535 +# option int_addr 0.0.0.0/0 +# option int_ports 0-65535