blob: d9ac8a19fb6247661b5b8bc73e8c73fb91c6b826 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
|
#!/bin/sh
set -o pipefail
MAIN=/usr/share/firewall4/main.uc
LOCK=/var/run/fw4.lock
STATE=/var/run/fw4.state
VERBOSE=
[ -e /dev/stdin ] && STDIN=/dev/stdin || STDIN=/proc/self/fd/0
[ -t 2 ] && export TTY=1
die() {
[ -n "$QUIET" ] || echo "$@" >&2
exit 1
}
start() {
{
flock -x 1000
case "$1" in
start)
[ -f $STATE ] && die "The fw4 firewall appears to be already loaded."
;;
reload)
[ ! -f $STATE ] && die "The fw4 firewall does not appear to be loaded."
# Delete state to force reloading ubus state
rm -f $STATE
;;
esac
ACTION=start \
utpl -S $MAIN | nft $VERBOSE -f $STDIN
ACTION=includes \
utpl -S $MAIN
} 1000>$LOCK
}
print() {
ACTION=print \
utpl -S $MAIN
}
stop() {
{
flock -x 1000
nft delete table inet fw4
rm -f $STATE
} 1000>$LOCK
}
flush() {
{
flock -x 1000
local dummy family table
nft list tables | while read dummy family table; do
nft delete table "$family" "$table"
done
rm -f $STATE
} 1000>$LOCK
}
reload_sets() {
ACTION=reload-sets \
flock -x $LOCK utpl -S $MAIN | nft $VERBOSE -f $STDIN
}
lookup() {
ACTION=$1 OBJECT=$2 DEVICE=$3 \
flock -x $LOCK utpl -S $MAIN
}
while [ -n "$1" ]; do
case "$1" in
-q)
export QUIET=1
shift
;;
-v)
export VERBOSE=-e
shift
;;
*)
break
;;
esac
done
case "$1" in
start|reload)
start "$1"
;;
stop)
stop || die "The fw4 firewall does not appear to be loaded, try fw4 flush to delete all rules."
;;
flush)
flush
;;
restart)
QUIET=1 print | nft ${VERBOSE} -c -f $STDIN || die "The rendered ruleset contains errors, not doing firewall restart."
stop || rm -f $STATE
start
;;
check)
if [ -n "$QUIET" ]; then
exec 1>/dev/null
exec 2>/dev/null
fi
print | nft ${VERBOSE} -c -f $STDIN && echo "Ruleset passes nftables check."
;;
print)
print
;;
reload-sets)
reload_sets
;;
network|device|zone)
lookup "$@"
;;
*)
cat <<EOT
Usage:
$0 [-v] [-q] start|stop|flush|restart|reload
Start, stop, flush, restart or reload the firewall respectively.
$0 [-v] [-q] reload-sets
Reload the contents of all declared sets but do not touch the
ruleset.
$0 [-q] print
Print the rendered ruleset.
$0 [-q] check
Test the rendered ruleset using nftables' check mode without
applying it to the running system.
$0 [-q] network {net}
Print the name of the firewall zone covering the given network.
Exits with code 1 if the network is not found or if no zone is
covering it.
$0 [-q] device {dev}
Print the name of the firewall zone covering the given device.
Exits with code 1 if the device is not found or if no zone is
covering it.
$0 [-q] zone {zone} [dev]
Print all covered devices of the given zone, optionally restricted
to only the given device name.
Exits with code 1 if zone is not found or if a device is specified
and not covered by the given zone.
EOT
;;
esac
|
