package/firewall/files/uci_firewall.sh

   1 #!/bin/sh
   2 # Copyright (C) 2008 John Crispin <blogic@openwrt.org>
   3
   4 . /etc/functions.sh
   5
   6 IPTABLES="echo iptables"
   7 IPTABLES=iptables
   8
   9 config_clear
  10 include /lib/network
  11 scan_interfaces
  12
  13 CONFIG_APPEND=1
  14 config_load firewall
  15
  16 config fw_zones
  17 ZONE_LIST=$CONFIG_SECTION
  18
  19 CUSTOM_CHAINS=1
  20 DEF_INPUT=DROP
  21 DEF_OUTPUT=DROP
  22 DEF_FORWARD=DROP
  23
  24 load_policy() {
  25         config_get input $1 input
  26         config_get output $1 output
  27         config_get forward $1 forward
  28
  29         DEF_INPUT="${input:-$DEF_INPUT}"
  30         DEF_OUTPUT="${output:-$DEF_OUTPUT}"
  31         DEF_FORWARD="${forward:-$DEF_FORWARD}"
  32 }
  33
  34 create_zone() {
  35         local exists
  36
  37         [ "$1" == "loopback" ] && return
  38
  39         config_get exists $ZONE_LIST $1
  40         [ -n "$exists" ] && return
  41         config_set $ZONE_LIST $1 1
  42
  43         $IPTABLES -N zone_$1
  44         $IPTABLES -N zone_$1_MSSFIX
  45         $IPTABLES -N zone_$1_ACCEPT
  46         $IPTABLES -N zone_$1_DROP
  47         $IPTABLES -N zone_$1_REJECT
  48         $IPTABLES -N zone_$1_forward
  49         $IPTABLES -A zone_$1_forward -j zone_$1_$5
  50         $IPTABLES -A zone_$1 -j zone_$1_$3
  51         $IPTABLES -A output -j zone_$1_$4
  52         $IPTABLES -N zone_$1_nat -t nat
  53         $IPTABLES -N zone_$1_prerouting -t nat
  54         [ "$6" == "1" ] && $IPTABLES -t nat -A POSTROUTING -j zone_$1_nat
  55 }
  56
  57 addif() {
  58         local dev
  59         config_get dev core $2
  60         [ -n "$dev" -a "$dev" != "$1" ] && delif "$dev" "$2"
  61         [ -n "$dev" -a "$dev" == "$1" ] && return
  62         logger "adding $1 to firewall zone $2"
  63         $IPTABLES -A input -i $1 -j zone_$2
  64         $IPTABLES -I zone_$2_MSSFIX 1 -o $1 -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
  65         $IPTABLES -I zone_$2_ACCEPT 1 -o $1 -j ACCEPT
  66         $IPTABLES -I zone_$2_DROP 1 -o $1 -j DROP
  67         $IPTABLES -I zone_$2_REJECT 1 -o $1 -j reject
  68         $IPTABLES -I zone_$2_ACCEPT 1 -i $1 -j ACCEPT
  69         $IPTABLES -I zone_$2_DROP 1 -i $1 -j DROP
  70         $IPTABLES -I zone_$2_REJECT 1 -i $1 -j reject
  71         $IPTABLES -I zone_$2_nat 1 -t nat -o $1 -j MASQUERADE
  72         $IPTABLES -I PREROUTING 1 -t nat -i $1 -j zone_$2_prerouting
  73         $IPTABLES -A forward -i $1 -j zone_$2_forward
  74         uci_set_state firewall core "$2" "$1"
  75 }
  76
  77 delif() {
  78         logger "removing $1 from firewall zone $2"
  79         $IPTABLES -D input -i $1 -j zone_$2
  80         $IPTABLES -D zone_$2_MSSFIX -o $1 -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
  81         $IPTABLES -D zone_$2_ACCEPT -o $1 -j ACCEPT
  82         $IPTABLES -D zone_$2_DROP -o $1 -j DROP
  83         $IPTABLES -D zone_$2_REJECT -o $1 -j reject
  84         $IPTABLES -D zone_$2_ACCEPT -i $1 -j ACCEPT
  85         $IPTABLES -D zone_$2_DROP -i $1 -j DROP
  86         $IPTABLES -D zone_$2_REJECT -i $1 -j reject
  87         $IPTABLES -D zone_$2_nat -t nat -o $1 -j MASQUERADE
  88         $IPTABLES -D PREROUTING -t nat -i $1 -j zone_$2_prerouting
  89         $IPTABLES -D forward -i $1 -j zone_$2_forward
  90         uci_revert_state firewall core "$2"
  91 }
  92
  93 load_synflood() {
  94         local rate=${1:-25}
  95         local burst=${2:-50}
  96         echo "Loading synflood protection"
  97         $IPTABLES -N syn_flood
  98         $IPTABLES -A syn_flood -p tcp --syn -m limit --limit $rate/second --limit-burst $burst -j RETURN
  99         $IPTABLES -A syn_flood -j DROP
 100         $IPTABLES -A INPUT -p tcp --syn -j syn_flood
 101 }
 102
 103 fw_set_chain_policy() {
 104         local chain=$1
 105         local target=$2
 106         [ "$target" == "REJECT" ] && {
 107                 $IPTABLES -A $chain -j reject
 108                 target=DROP
 109         }
 110         $IPTABLES -P $chain $target
 111 }
 112
 113 fw_defaults() {
 114         [ -n "$DEFAULTS_APPLIED" ] && {
 115                 echo "Error: multiple defaults sections detected"
 116                 return;
 117         }
 118         DEFAULTS_APPLIED=1
 119
 120         load_policy "$1"
 121
 122         echo 1 > /proc/sys/net/ipv4/tcp_syncookies
 123         for f in /proc/sys/net/ipv4/conf/*/accept_redirects
 124         do
 125                 echo 0 > $f
 126         done
 127         for f in /proc/sys/net/ipv4/conf/*/accept_source_route
 128         do
 129                 echo 0 > $f
 130         done
 131
 132         uci_revert_state firewall core
 133         uci_set_state firewall core "" firewall_state
 134
 135         $IPTABLES -P INPUT DROP
 136         $IPTABLES -P OUTPUT DROP
 137         $IPTABLES -P FORWARD DROP
 138
 139         $IPTABLES -F
 140         $IPTABLES -t mangle -F
 141         $IPTABLES -t nat -F
 142         $IPTABLES -t mangle -X
 143         $IPTABLES -t nat -X
 144         $IPTABLES -X
 145
 146         $IPTABLES -A INPUT -m state --state INVALID -j DROP
 147         $IPTABLES -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
 148
 149         $IPTABLES -A OUTPUT -m state --state INVALID -j DROP
 150         $IPTABLES -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
 151
 152         $IPTABLES -A FORWARD -m state --state INVALID -j DROP
 153         $IPTABLES -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
 154
 155         $IPTABLES -A INPUT -i lo -j ACCEPT
 156         $IPTABLES -A OUTPUT -o lo -j ACCEPT
 157
 158         config_get syn_flood $1 syn_flood
 159         config_get syn_rate $1 syn_rate
 160         config_get syn_burst $1 syn_burst
 161         [ "$syn_flood" == "1" ] && load_synflood $syn_rate $syn_burst
 162
 163         echo "Adding custom chains"
 164         fw_custom_chains
 165
 166         $IPTABLES -N input
 167         $IPTABLES -N output
 168         $IPTABLES -N forward
 169
 170         $IPTABLES -A INPUT -j input
 171         $IPTABLES -A OUTPUT -j output
 172         $IPTABLES -A FORWARD -j forward
 173
 174         $IPTABLES -N reject
 175         $IPTABLES -A reject -p tcp -j REJECT --reject-with tcp-reset
 176         $IPTABLES -A reject -j REJECT --reject-with icmp-port-unreachable
 177
 178         fw_set_chain_policy INPUT "$DEF_INPUT"
 179         fw_set_chain_policy OUTPUT "$DEF_OUTPUT"
 180         fw_set_chain_policy FORWARD "$DEF_FORWARD"
 181 }
 182
 183 fw_zone() {
 184         local name
 185         local network
 186         local masq
 187
 188         config_get name $1 name
 189         config_get network $1 network
 190         config_get masq $1 masq
 191         load_policy $1
 192
 193         [ -z "$network" ] && network=$name
 194         create_zone "$name" "$network" "$input" "$output" "$forward" "$masq"
 195         fw_custom_chains_zone "$name"
 196 }
 197
 198 fw_rule() {
 199         local src
 200         local src_ip
 201         local src_mac
 202         local src_port
 203         local src_mac
 204         local dest
 205         local dest_ip
 206         local dest_port
 207         local proto
 208         local target
 209         local ruleset
 210
 211         config_get src $1 src
 212         config_get src_ip $1 src_ip
 213         config_get src_mac $1 src_mac
 214         config_get src_port $1 src_port
 215         config_get dest $1 dest
 216         config_get dest_ip $1 dest_ip
 217         config_get dest_port $1 dest_port
 218         config_get proto $1 proto
 219         config_get target $1 target
 220         config_get ruleset $1 ruleset
 221
 222         src_port_first=${src_port%-*}
 223         src_port_last=${src_port#*-}
 224         [ "$src_port_first" -ne "$src_port_last" ] && { \
 225                 src_port="$src_port_first:$src_port_last"; }
 226
 227         dest_port_first=${dest_port%-*}
 228         dest_port_last=${dest_port#*-}
 229         [ "$dest_port_first" -ne "$dest_port_last" ] && { \
 230                 dest_port="$dest_port_first:$dest_port_last"; }
 231
 232         ZONE=input
 233         TARGET=$target
 234         [ -z "$target" ] && target=DROP
 235         [ -n "$src" -a -z "$dest" ] && ZONE=zone_$src
 236         [ -n "$src" -a -n "$dest" ] && ZONE=zone_${src}_forward
 237         [ -n "$dest" ] && TARGET=zone_${dest}_$target
 238         add_rule() {
 239                 $IPTABLES -I $ZONE 1 \
 240                         ${proto:+-p $proto} \
 241                         ${src_ip:+-s $src_ip} \
 242                         ${src_port:+--sport $src_port} \
 243                         ${src_mac:+-m mac --mac-source $src_mac} \
 244                         ${dest_ip:+-d $dest_ip} \
 245                         ${dest_port:+--dport $dest_port} \
 246                         -j $TARGET
 247         }
 248         [ "$proto" == "tcpudp" -o -z "$proto" ] && {
 249                 proto=tcp
 250                 add_rule
 251                 proto=udp
 252                 add_rule
 253                 return
 254         }
 255         add_rule
 256 }
 257
 258 fw_forwarding() {
 259         local src
 260         local dest
 261         local masq
 262
 263         config_get src $1 src
 264         config_get dest $1 dest
 265         config_get_bool mtu_fix $1 mtu_fix 0
 266         [ -n "$src" ] && z_src=zone_${src}_forward || z_src=forward
 267         [ -n "$dest" ] && z_dest=zone_${dest}_ACCEPT || z_dest=ACCEPT
 268         $IPTABLES -I $z_src 1 -j $z_dest
 269         [ "$mtu_fix" -gt 0 -a -n "$dest" ] && $IPTABLES -I $z_src 1 -j zone_${dest}_MSSFIX
 270 }
 271
 272 fw_redirect() {
 273         local src
 274         local src_ip
 275         local src_port
 276         local src_dport
 277         local src_mac
 278         local dest_ip
 279         local dest_port dest_port2
 280         local proto
 281
 282         config_get src $1 src
 283         config_get src_ip $1 src_ip
 284         config_get src_port $1 src_port
 285         config_get src_dport $1 src_dport
 286         config_get src_mac $1 src_mac
 287         config_get dest_ip $1 dest_ip
 288         config_get dest_port $1 dest_port
 289         config_get proto $1 proto
 290         [ -z "$src" -o -z "$dest_ip" ] && { \
 291                 echo "redirect needs src and dest_ip"; return ; }
 292
 293         src_port_first=${src_port%-*}
 294         src_port_last=${src_port#*-}
 295         [ "$src_port_first" -ne "$src_port_last" ] && { \
 296                 src_port="$src_port_first:$src_port_last"; }
 297
 298         src_dport_first=${src_dport%-*}
 299         src_dport_last=${src_dport#*-}
 300         [ "$src_dport_first" -ne "$src_dport_last" ] && { \
 301                 src_dport="$src_dport_first:$src_dport_last"; }
 302
 303         dest_port2=$dest_port
 304         dest_port_first=${dest_port2%-*}
 305         dest_port_last=${dest_port2#*-}
 306         [ "$dest_port_first" -ne "$dest_port_last" ] && { \
 307                 dest_port2="$dest_port_first:$dest_port_last"; }
 308
 309         add_rule() {
 310                 $IPTABLES -A zone_${src}_prerouting -t nat \
 311                         ${proto:+-p $proto} \
 312                         ${src_ip:+-s $src_ip} \
 313                         ${src_port:+--sport $src_port} \
 314                         ${src_dport:+--dport $src_dport} \
 315                         ${src_mac:+-m mac --mac-source $src_mac} \
 316                         -j DNAT --to-destination $dest_ip${dest_port:+:$dest_port}
 317
 318                 $IPTABLES -I zone_${src}_forward 1 \
 319                         ${proto:+-p $proto} \
 320                         -d $dest_ip \
 321                         ${src_ip:+-s $src_ip} \
 322                         ${src_port:+--sport $src_port} \
 323                         ${dest_port2:+--dport $dest_port2} \
 324                         ${src_mac:+-m mac --mac-source $src_mac} \
 325                         -j ACCEPT
 326         }
 327         [ "$proto" == "tcpudp" -o -z "$proto" ] && {
 328                 proto=tcp
 329                 add_rule
 330                 proto=udp
 331                 add_rule
 332                 return
 333         }
 334         add_rule
 335 }
 336
 337 fw_include() {
 338         local path
 339         config_get path $1 path
 340         [ -e $path ] && . $path
 341 }
 342
 343 fw_addif() {
 344         local up
 345         local ifname
 346         config_get up $1 up
 347         config_get ifname $1 ifname
 348         [ -n "$up" ] || return 0
 349         (ACTION="ifup" INTERFACE="$1" . /etc/hotplug.d/iface/20-firewall)
 350 }
 351
 352 fw_custom_chains() {
 353         [ -n "$CUSTOM_CHAINS" ] || return 0
 354         $IPTABLES -N input_rule
 355         $IPTABLES -N output_rule
 356         $IPTABLES -N forwarding_rule
 357         $IPTABLES -N prerouting_rule -t nat
 358         $IPTABLES -N postrouting_rule -t nat
 359
 360         $IPTABLES -A INPUT -j input_rule
 361         $IPTABLES -A OUTPUT -j output_rule
 362         $IPTABLES -A FORWARD -j forwarding_rule
 363         $IPTABLES -A PREROUTING -t nat -j prerouting_rule
 364         $IPTABLES -A POSTROUTING -t nat -j postrouting_rule
 365 }
 366
 367 fw_custom_chains_zone() {
 368         local zone="$1"
 369
 370         [ -n "$CUSTOM_CHAINS" ] || return 0
 371         $IPTABLES -N input_${zone}
 372         $IPTABLES -N forwarding_${zone}
 373         $IPTABLES -N prerouting_${zone} -t nat
 374         $IPTABLES -I zone_${zone} 1 -j input_${zone}
 375         $IPTABLES -I zone_${zone}_forward 1 -j forwarding_${zone}
 376         $IPTABLES -I zone_${zone}_prerouting 1 -t nat -j prerouting_${zone}
 377 }
 378
 379 fw_init() {
 380         DEFAULTS_APPLIED=
 381
 382         echo "Loading defaults"
 383         config_foreach fw_defaults defaults
 384         echo "Loading zones"
 385         config_foreach fw_zone zone
 386         echo "Loading rules"
 387         config_foreach fw_rule rule
 388         echo "Loading forwarding"
 389         config_foreach fw_forwarding forwarding
 390         echo "Loading redirects"
 391         config_foreach fw_redirect redirect
 392         echo "Loading includes"
 393         config_foreach fw_include include
 394         uci_set_state firewall core loaded 1
 395         unset CONFIG_APPEND
 396         config_load network
 397         config_foreach fw_addif interface
 398 }
 399
 400 fw_stop() {
 401         $IPTABLES -F
 402         $IPTABLES -t mangle -F
 403         $IPTABLES -t nat -F
 404         $IPTABLES -t mangle -X
 405         $IPTABLES -t nat -X
 406         $IPTABLES -X
 407         $IPTABLES -P INPUT ACCEPT
 408         $IPTABLES -P OUTPUT ACCEPT
 409         $IPTABLES -P FORWARD ACCEPT
 410         uci_revert_state firewall core
 411 }