package/firewall/files/new/uci_firewall.sh

   1 #!/bin/sh
   2 # Copyright (C) 2008 John Crispin <blogic@openwrt.org>
   3
   4 . /etc/functions.sh
   5
   6 IPTABLES="echo iptables"
   7 IPTABLES=iptables
   8
   9 config_clear
  10 include /lib/network
  11 scan_interfaces
  12
  13 CONFIG_APPEND=1
  14 config_load firewall
  15
  16 config fw_zones
  17 ZONE_LIST=$CONFIG_SECTION
  18
  19 DEF_INPUT=DROP
  20 DEF_OUTPUT=DROP
  21 DEF_FORWARD=DROP
  22
  23 load_policy() {
  24         config_get input $1 input
  25         config_get output $1 output
  26         config_get forward $1 forward
  27
  28         [ -z "$input" ] && input=$DEF_INPUT
  29         [ -z "$output" ] && output=$DEF_OUTPUT
  30         [ -z "$forward" ] && forward=$DEF_FORWARD
  31 }
  32
  33 create_zone() {
  34         local exists
  35
  36         [ "$1" == "loopback" ] && return
  37
  38         config_get exists $ZONE_LIST $1
  39         [ -n "$exists" ] && return
  40         config_set $ZONE_LIST $1 1
  41
  42         $IPTABLES -N zone_$1
  43         $IPTABLES -N zone_$1_ACCEPT
  44         $IPTABLES -N zone_$1_DROP
  45         $IPTABLES -N zone_$1_REJECT
  46         $IPTABLES -N zone_$1_forward
  47         $IPTABLES -A zone_$1_forward -j zone_$1_$5
  48         $IPTABLES -A zone_$1 -j zone_$1_$3
  49         $IPTABLES -A OUTPUT -j zone_$1_$4
  50         $IPTABLES -N zone_$1_nat -t nat
  51         $IPTABLES -N zone_$1_prerouting -t nat
  52         [ "$6" == "1" ] && $IPTABLES -t nat -A POSTROUTING -j zone_$2_nat
  53 }
  54
  55 addif() {
  56         logger "adding $1 to firewall zone $2"
  57         $IPTABLES -A INPUT -i $1 -j zone_$2
  58         $IPTABLES -I zone_$2_ACCEPT 1 -o $1 -j ACCEPT
  59         $IPTABLES -I zone_$2_DROP 1 -o $1 -j DROP
  60         $IPTABLES -I zone_$2_REJECT 1 -o $1 -j REJECT
  61         $IPTABLES -I zone_$2_ACCEPT 1 -i $1 -j ACCEPT
  62         $IPTABLES -I zone_$2_DROP 1 -i $1 -j DROP
  63         $IPTABLES -I zone_$2_REJECT 1 -i $1 -j REJECT
  64         $IPTABLES -I zone_$2_nat 1 -t nat -o $1 -j MASQUERADE
  65         $IPTABLES -I PREROUTING 1 -t nat -i $1 -j zone_$2_prerouting
  66         $IPTABLES -A FORWARD -i $1 -j zone_$2_forward
  67 }
  68
  69 delif() {
  70         logger "removing $1 from firewall zone $2"
  71         $IPTABLES -D INPUT -i $1 -j zone_$2
  72         $IPTABLES -D zone_$2_ACCEPT -o $1 -j ACCEPT
  73         $IPTABLES -D zone_$2_DROP -o $1 -j DROP
  74         $IPTABLES -D zone_$2_REJECT -o $1 -j REJECT
  75         $IPTABLES -D zone_$2_ACCEPT -i $1 -j ACCEPT
  76         $IPTABLES -D zone_$2_DROP -i $1 -j DROP
  77         $IPTABLES -D zone_$2_REJECT -i $1 -j REJECT
  78         $IPTABLES -D zone_$2_nat -t nat -o $1 -j MASQUERADE
  79         $IPTABLES -D PREROUTING -t nat -i $1 -j zone_$2_prerouting
  80         $IPTABLES -D FORWARD -i $1 -j zone_$2_forward
  81 }
  82
  83 load_synflood() {
  84         echo "Loading synflood protection"
  85         $IPTABLES -N SYN_FLOOD
  86         $IPTABLES -A SYN_FLOOD -p tcp --syn -m limit --limit ${1}/second --limit-burst $2 -j RETURN
  87         $IPTABLES -A SYN_FLOOD -p ! tcp -j RETURN
  88         $IPTABLES -A SYN_FLOOD -p tcp ! --syn -j RETURN
  89         $IPTABLES -A SYN_FLOOD -j LOG --log-prefix "syn_flood: "
  90         $IPTABLES -A SYN_FLOOD -j DROP
  91         $IPTABLES -A INPUT -p tcp --syn -j SYN_FLOOD
  92 }
  93
  94 create_network_zone() {
  95         create_zone "$1" "$1"
  96 }
  97
  98 fw_defaults() {
  99         load_policy $1
 100         DEF_INPUT=$input
 101         DEF_OUTPUT=$output
 102         DEF_FORWARD=$forward
 103
 104         echo 1 > /proc/sys/net/ipv4/tcp_syncookies
 105         for f in /proc/sys/net/ipv4/conf/*/accept_redirects
 106         do
 107                 echo 0 > $f
 108         done
 109         for f in /proc/sys/net/ipv4/conf/*/accept_source_route
 110         do
 111                 echo 0 > $f
 112         done
 113
 114         $IPTABLES -F
 115         $IPTABLES -t nat -F
 116         $IPTABLES -t mangle -F
 117         $IPTABLES -X -t nat
 118         $IPTABLES -X
 119
 120         $IPTABLES -P INPUT $input
 121         $IPTABLES -A INPUT -m state --state INVALID -j DROP
 122         $IPTABLES -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
 123
 124         $IPTABLES -P OUTPUT $output
 125         $IPTABLES -A OUTPUT -m state --state INVALID -j DROP
 126         $IPTABLES -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
 127
 128         $IPTABLES -P FORWARD $forward
 129         $IPTABLES -A FORWARD -m state --state INVALID -j DROP
 130         $IPTABLES -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
 131         $IPTABLES -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
 132
 133         $IPTABLES -A INPUT -i lo -j ACCEPT
 134         $IPTABLES -A OUTPUT -o lo -j ACCEPT
 135
 136         config_get syn_flood $1 syn_flood
 137         config_get syn_rate $1 syn_rate
 138         config_get syn_burst $1 syn_burst
 139
 140         [ -z "$syn_rate" ] && syn_rate=25
 141         [ -z "$syn_burst" ] && syn_burst=50
 142         [ "$syn_flood" == "1" ] && load_synflood $syn_rate $syn_burst
 143 }
 144
 145 fw_zone() {
 146         local name
 147         local network
 148         local masq
 149
 150         config_get name $1 name
 151         config_get network $1 network
 152         config_get masq $1 masq
 153         load_policy $1
 154
 155         [ -z "$network" ] && network=$name
 156         create_zone "$name" "$network" "$input" "$output" "$forward" "$masq"
 157 }
 158
 159 fw_rule() {
 160         local src
 161         local src_ip
 162         local src_mac
 163         local src_port
 164         local src_mac
 165         local dest
 166         local dest_ip
 167         local dest_port
 168         local proto
 169         local target
 170
 171         config_get src $1 src
 172         config_get src_ip $1 src_ip
 173         config_get src_mac $1 src_mac
 174         config_get src_port $1 src_port
 175         config_get dest $1 dest
 176         config_get dest_ip $1 dest_ip
 177         config_get dest_port $1 dest_port
 178         config_get proto $1 proto
 179         config_get target $1 target
 180         config_get ruleset $1 ruleset
 181
 182         [ -z "$target" ] && target=DROP
 183         [ -n "$src" ] && ZONE=zone_$src || ZONE=INPUT
 184         [ -n "$dest" ] && TARGET=zone_${dest}_$target || TARGET=$target
 185         $IPTABLES -I $ZONE 1 \
 186                 ${proto:+-p $proto} \
 187                 ${src_ip:+-s $src_ip} \
 188                 ${src_port:+--sport $src_port} \
 189                 ${src_mac:+-m mac --mac-source $src_mac} \
 190                 ${dest_ip:+-d $dest_ip} \
 191                 ${dest_port:+--dport $dest_port} \
 192                 -j $TARGET
 193 }
 194
 195 fw_forwarding() {
 196         local src
 197         local dest
 198         local masq
 199
 200         config_get src $1 src
 201         config_get dest $1 dest
 202         [ -n "$src" ] && z_src=zone_${src}_forward || z_src=FORWARD
 203         [ -n "$dest" ] && z_dest=zone_${dest}_ACCEPT || z_dest=ACCEPT
 204         $IPTABLES -I $z_src 1 -j $z_dest
 205 }
 206
 207 fw_redirect() {
 208         local src
 209         local src_ip
 210         local src_port
 211         local src_dport
 212         local src_mac
 213         local dest_ip
 214         local dest_port
 215         local protocol
 216
 217         config_get src $1 src
 218         config_get src_ip $1 src_ip
 219         config_get src_port $1 src_port
 220         config_get src_dport $1 src_dport
 221         config_get src_mac $1 src_mac
 222         config_get dest_ip $1 dest_ip
 223         config_get dest_port $1 dest_port
 224         config_get protocol $1 protocol
 225         [ -z "$src" -o -z "$dest_ip" ] && { \
 226                 echo "redirect needs src and dest_ip"; return ; }
 227         $IPTABLES -A zone_${src}_prerouting -t nat \
 228                 ${protocol:+-p $protocol} \
 229                 ${src_ip:+-s $srcdip} \
 230                 ${src_port:+--sport $src_port} \
 231                 ${src_dport:+--dport $src_dport} \
 232                 ${src_mac:+-m mac --mac-source $src_mac} \
 233                 -j DNAT --to-destination $dest_ip${dest_port:+:$dest_port}
 234         $IPTABLES -I zone_${src}_forward 1 \
 235                 ${protocol:+-p $protocol} \
 236                 -d $dest_ip \
 237                 ${src_ip:+-s $srcdip} \
 238                 ${src_port:+--sport $src_port} \
 239                 ${dest_port:+--dport $dest_port} \
 240                 ${src_mac:+-m mac --mac-source $src_mac} \
 241                 -j ACCEPT
 242 }
 243
 244 fw_include() {
 245         local path
 246         config_get path $1 path
 247         [ -e $path ] && . $path
 248 }
 249
 250 fw_addif() {
 251         local up
 252         local ifname
 253         config_get up $1 up
 254         config_get ifname $1 ifname
 255         [ -n "$up" ] || return 0
 256         (ACTION="ifup" INTERFACE="$1" . /etc/hotplug.d/iface/20-firewall)
 257 }
 258
 259 fw_init() {
 260         echo "Loading defaults"
 261         config_foreach fw_defaults defaults
 262         echo "Loading zones"
 263         config_foreach fw_zone zone
 264         echo "Loading interfaces"
 265         config_foreach create_network_zone interface
 266         echo "Loading rules"
 267         config_foreach fw_rule rule
 268         echo "Loading forwarding"
 269         config_foreach fw_forwarding forwarding
 270         echo "Loading redirects"
 271         config_foreach fw_redirect redirect
 272         echo "Loading includes"
 273         config_foreach fw_include include
 274
 275         uci_set_state firewall core "" firewall_state
 276         uci_set_state firewall core loaded 1
 277         unset CONFIG_APPEND
 278         config_load network
 279         config_foreach fw_addif interface
 280 }
 281
 282 fw_stop() {
 283         $IPTABLES -F
 284         $IPTABLES -t nat -F
 285         $IPTABLES -t mangle -F
 286         $IPTABLES -X -t nat
 287         $IPTABLES -X
 288         $IPTABLES -P INPUT ACCEPT
 289         $IPTABLES -P OUTPUT ACCEPT
 290         $IPTABLES -P FORWARD ACCEPT
 291 }