contrib/package/meshwizard/files/usr/bin/meshwizard/helpers/setup_firewall.sh

   1 #!/bin/sh
   2 # This will add $net to the zone firewall (and remove it from other zones where it is referenced)
   3 # It will also setup rules defined in /etc/config/freifunk and /etc/config/profile_<community>
   4 # Arg $1 = $net
   5
   6 net=$1
   7 . /etc/functions.sh
   8 . $dir/functions.sh
   9 config_load firewall
  10
  11 # Get some variables
  12 type="$(uci -q get wireless.$net.type)"
  13 vap="$(uci -q get meshwizard.netconfig.$net\_vap)"
  14 lan_ip="$(uci -q get network.lan.ipaddr)"
  15 lan_mask="$(uci -q get network.lan.netmask)"
  16
  17 # Delete old firewall zone for freifunk
  18 handle_fwzone() {
  19         config_get name "$1" name
  20         config_get network "$1" network
  21
  22         if [ "$2" == "zoneconf" ]; then
  23                 # clean zone
  24                 if [ "$name" == "freifunk" ]; then
  25                         if [ "$cleanup" == 1 ]; then
  26                                 section_cleanup firewall.$1
  27                         else
  28                                 # rename section if unnamed
  29                                 if [ -z "${1/cfg[0-9a-fA-F]*/}" ]; then
  30                                         section_rename firewall $1 zone_freifunk
  31                                 fi
  32                         fi
  33                 else
  34
  35                         if [ "$name" == "$netrenamed" ]; then
  36                                 section_cleanup firewall.$1
  37                         fi
  38                         if [ -n "$netrenamed" -a -n "$(echo $network | grep $netrenamed)" ] && [ ! "$name" == "freifunk" ]; then
  39                                 echo "    Removed $netrenamed from firewall zone $name."
  40                                 network_new=$(echo $network | sed -e 's/'$netrenamed'//' -e 's/^ //' -e 's/  / /' -e 's/ $//')
  41                                 uci set firewall.$1.network="$network_new"
  42                         fi
  43                 fi
  44         else
  45                 # clean fw_rule, fw_forwarding, include and advanced
  46                 for option in src tcp_ecn path; do
  47                         config_get $option $1 $option
  48                 done
  49                 if [ "$src" == "freifunk" -o "$path" == "/etc/firewall.freifunk" -o -n "$tcpecn" ]; then
  50                         section_cleanup firewall.$1
  51                 fi
  52         fi
  53 }
  54
  55 config_foreach handle_fwzone zone zoneconf
  56
  57 if [ "$cleanup" == 1 ]; then
  58         for target in include advanced rule forwarding; do
  59                 config_foreach handle_fwzone $target
  60         done
  61 fi
  62
  63 # setup freifunk firewall zone
  64
  65 echo "    + Setup firewall zone."
  66
  67 # add $netrenamed and if needed ${netrenamed}dhcp to the networks for this zone
  68 config_get network zone_freifunk network
  69
  70 # remove ${netrenamed}dhcp from networks list
  71 [ -n "$network" -a -n "$net" ] && network="${network/${netrenamed}dhcp/}"
  72 network=$(echo $network) # Removes leading and trailing whitespaces
  73
  74 [ -n "$netrenamed" ] && [ -z "$(echo $network | grep $netrenamed)" ] && network="$network $netrenamed"
  75
  76 if [ "$type" == "atheros" -a "$vap" == 1 ]; then
  77         [ -n "$netrenamed" ] && [ "$network" == "${network/${netrenamed}dhcp/}" ] && network="$network ${netrenamed}dhcp"
  78 fi
  79
  80 uci batch << EOF
  81 set firewall.zone_freifunk="zone"
  82 set firewall.zone_freifunk.name="freifunk"
  83 set firewall.zone_freifunk.network="$network"
  84 set firewall.zone_freifunk.input="$zone_freifunk_input"
  85 set firewall.zone_freifunk.forward="$zone_freifunk_forward"
  86 set firewall.zone_freifunk.output="$zone_freifunk_output"
  87 EOF
  88
  89 echo "    network: $network
  90     input: $zone_freifunk_input
  91     forward: $zone_freifunk_forward
  92     output: $zone_freifunk_output"
  93
  94 # Usually we need to setup masquerading for lan, except lan is an olsr interface or has an olsr hna
  95
  96 echo "    + Setup masquerading rules"
  97
  98 eval $(ipcalc.sh $lan_ip $lan_mask)
  99
 100 handle_interface() {
 101         config_get interface "$1" interface
 102         if [ "$interface" == "lan" ]; then
 103                 no_masq_lan=1
 104         fi
 105 }
 106 config_load olsrd
 107 config_foreach handle_interface Interface
 108
 109 handle_hna() {
 110         config_get netaddr "$1" netaddr
 111         if [ "$NETWORK" == "$netaddr" ]; then
 112                 no_masq_lan=1
 113         fi
 114 }
 115 config_foreach handle_hna Hna4
 116
 117 currms=$(uci -q get firewall.zone_freifunk.masq_src)
 118 if [ ! "$no_masq_lan" == "1" ]; then
 119         uci set firewall.zone_freifunk.masq="1" && echo "    Enabled masquerading." || echo -e "\033[1mWarning:\033[0m: Could not enable masquerading."
 120         [ -z "$(echo $currms |grep $NETWORK/$PREFIX)" ] && uci add_list firewall.zone_freifunk.masq_src="$NETWORK/$PREFIX"
 121 fi
 122
 123 # If wifi-interfaces are outside of the mesh network they should be natted
 124 for i in $networks; do
 125         # Get dhcprange and meshnet
 126         dhcprange=$(uci get meshwizard.netconfig.$i\_dhcprange)
 127         meshnet="$(uci get profile_$community.profile.mesh_network)"
 128         # check if the dhcprange is inside meshnet
 129         dhcpinmesh="$($dir/helpers/check-range-in-range.sh $dhcprange $meshnet)"
 130         if [ ! "$dhcpinmesh" == 1 ]; then
 131                 [ -z "$(echo $currms |grep $dhcprange)" ] && uci add_list firewall.zone_freifunk.masq_src="$dhcprange"
 132         fi
 133 done
 134
 135 # Rules, Forwardings, advanced config and includes
 136 # Clear firewall configuration
 137
 138 echo "    + Setup rules, forwardings, advanced config and includes."
 139
 140 for config in freifunk profile_$community; do
 141
 142         config_load $config
 143
 144         for section in advanced include fw_rule fw_forwarding; do
 145                 handle_firewall() {
 146                         local options=$(uci show $config."$1")
 147                         options=$(echo "$options" | sed -e "s/fw_//g" -e "s/^$config/firewall/g")
 148                         for o in $options; do
 149                                 uci set $o
 150                         done
 151                 }
 152                 config_foreach handle_firewall $section
 153         done
 154 done
 155
 156 uci commit