kernel: add md5sum of kernel

[openwrt.git] / package / firewall / files / lib / core_init.sh

diff --git a/package/firewall/files/lib/core_init.sh b/package/firewall/files/lib/core_init.sh
index 2dd989e..42124b3 100644 (file)
--- a/package/firewall/files/lib/core_init.sh
+++ b/package/firewall/files/lib/core_init.sh
@@ -4,6 +4,8 @@
 FW_INITIALIZED=
 
 FW_ZONES=
 FW_INITIALIZED=
 
 FW_ZONES=

+FW_ZONES4=
+FW_ZONES6=

 FW_CONNTRACK_ZONES=
 FW_NOTRACK_DISABLED=
 
 FW_CONNTRACK_ZONES=
 FW_NOTRACK_DISABLED=
 


@@ -40,7 +42,7 @@ fw_load_defaults() {
                boolean disable_ipv6 0 \
        } || return
        [ -n "$FW_DEFAULTS_APPLIED" ] && {
                boolean disable_ipv6 0 \
        } || return
        [ -n "$FW_DEFAULTS_APPLIED" ] && {

-               echo "Error: multiple defaults sections detected"
+               fw_log error "duplicate defaults section detected, skipping"

                return 1
        }
        FW_DEFAULTS_APPLIED=1
                return 1
        }
        FW_DEFAULTS_APPLIED=1


@@ -82,13 +84,16 @@ fw_load_defaults() {
        [ $defaults_syn_flood == 1 ] && \
                defaults_synflood_protect=1
 
        [ $defaults_syn_flood == 1 ] && \
                defaults_synflood_protect=1
 

+       [ "${defaults_synflood_rate%/*}" == "$defaults_synflood_rate" ] && \
+               defaults_synflood_rate="$defaults_synflood_rate/second"
+

        [ $defaults_synflood_protect == 1 ] && {
                echo "Loading synflood protection"
                fw_callback pre synflood
                fw add i f syn_flood
                fw add i f syn_flood RETURN { \
                        -p tcp --syn \
        [ $defaults_synflood_protect == 1 ] && {
                echo "Loading synflood protection"
                fw_callback pre synflood
                fw add i f syn_flood
                fw add i f syn_flood RETURN { \
                        -p tcp --syn \

-                       -m limit --limit "${defaults_synflood_rate}/second" --limit-burst "${defaults_synflood_burst}" \
+                       -m limit --limit "${defaults_synflood_rate}" --limit-burst "${defaults_synflood_burst}" \

                }
                fw add i f syn_flood DROP
                fw add i f INPUT syn_flood { -p tcp --syn }
                }
                fw add i f syn_flood DROP
                fw add i f INPUT syn_flood { -p tcp --syn }


@@ -137,9 +142,14 @@ fw_config_get_zone() {
                string output "$FW_DEFAULT_OUTPUT_POLICY" \
                string forward "$FW_DEFAULT_FORWARD_POLICY" \
                boolean masq 0 \
                string output "$FW_DEFAULT_OUTPUT_POLICY" \
                string forward "$FW_DEFAULT_FORWARD_POLICY" \
                boolean masq 0 \

+               string masq_src "" \
+               string masq_dest "" \

                boolean conntrack 0 \
                boolean mtu_fix 0 \
                boolean custom_chains "$FW_ADD_CUSTOM_CHAINS" \
                boolean conntrack 0 \
                boolean mtu_fix 0 \
                boolean custom_chains "$FW_ADD_CUSTOM_CHAINS" \

+               boolean log 0 \
+               string log_limit 10 \
+               string family "" \

        } || return
        [ -n "$zone_name" ] || zone_name=$zone_NAME
        [ -n "$zone_network" ] || zone_network=$zone_name
        } || return
        [ -n "$zone_name" ] || zone_name=$zone_NAME
        [ -n "$zone_network" ] || zone_network=$zone_name


@@ -149,68 +159,110 @@ fw_load_zone() {
        fw_config_get_zone "$1"
 
        list_contains FW_ZONES $zone_name && {
        fw_config_get_zone "$1"
 
        list_contains FW_ZONES $zone_name && {

-               fw_die "zone ${zone_name}: duplicated zone"
+               fw_log error "zone ${zone_name}: duplicated zone, skipping"
+               return 0

        }
        append FW_ZONES $zone_name
 
        fw_callback pre zone
 
        [ $zone_conntrack = 1 -o $zone_masq = 1 ] && \
        }
        append FW_ZONES $zone_name
 
        fw_callback pre zone
 
        [ $zone_conntrack = 1 -o $zone_masq = 1 ] && \

-               append FW_CONNTRACK_ZONES "$zone_NAME"
+               append FW_CONNTRACK_ZONES "$zone_name"
+
+       local mode
+       case "$zone_family" in
+               *4)
+                       mode=4
+                       append FW_ZONES4 $zone_name
+                       uci_set_state firewall core ${zone_name}_ipv4 1
+               ;;
+               *6)
+                       mode=6
+                       append FW_ZONES6 $zone_name
+                       uci_set_state firewall core ${zone_name}_ipv6 1
+               ;;
+               *)
+                       mode=i
+                       append FW_ZONES4 $zone_name
+                       append FW_ZONES6 $zone_name
+                       uci_set_state firewall core ${zone_name}_ipv4 1
+                       uci_set_state firewall core ${zone_name}_ipv6 1
+               ;;
+       esac

 
        local chain=zone_${zone_name}
 
 
        local chain=zone_${zone_name}
 

-       fw add i f ${chain}_ACCEPT
-       fw add i f ${chain}_DROP
-       fw add i f ${chain}_REJECT
-       fw add i f ${chain}_MSSFIX
+       fw add $mode f ${chain}_ACCEPT
+       fw add $mode f ${chain}_DROP
+       fw add $mode f ${chain}_REJECT
+       fw add $mode f ${chain}_MSSFIX

 
        # TODO: Rename to ${chain}_input
 
        # TODO: Rename to ${chain}_input

-       fw add i f ${chain}
-       fw add i f ${chain} ${chain}_${zone_input} $
+       fw add $mode f ${chain}
+       fw add $mode f ${chain} ${chain}_${zone_input} $

 
 

-       fw add i f ${chain}_forward
-       fw add i f ${chain}_forward ${chain}_${zone_forward} $
+       fw add $mode f ${chain}_forward
+       fw add $mode f ${chain}_forward ${chain}_${zone_forward} $

 
        # TODO: add ${chain}_output
 
        # TODO: add ${chain}_output

-       fw add i f output ${chain}_${zone_output} $
+       fw add $mode f output ${chain}_${zone_output} $

 
        # TODO: Rename to ${chain}_MASQUERADE
 
        # TODO: Rename to ${chain}_MASQUERADE

-       fw add i n ${chain}_nat
-       fw add i n ${chain}_prerouting
+       fw add $mode n ${chain}_nat
+       fw add $mode n ${chain}_prerouting

 
 

-       fw add i r ${chain}_notrack
-       [ $zone_masq == 1 ] && \
-               fw add i n POSTROUTING ${chain}_nat $
+       fw add $mode r ${chain}_notrack

 
        [ $zone_mtu_fix == 1 ] && \
 
        [ $zone_mtu_fix == 1 ] && \

-               fw add i f FORWARD ${chain}_MSSFIX ^
+               fw add $mode f FORWARD ${chain}_MSSFIX ^

 
        [ $zone_custom_chains == 1 ] && {
                [ $FW_ADD_CUSTOM_CHAINS == 1 ] || \
                        fw_die "zone ${zone_name}: custom_chains globally disabled"
 
 
        [ $zone_custom_chains == 1 ] && {
                [ $FW_ADD_CUSTOM_CHAINS == 1 ] || \
                        fw_die "zone ${zone_name}: custom_chains globally disabled"
 

-               fw add i f input_${zone_name}
-               fw add i f ${chain} input_${zone_name} ^
+               fw add $mode f input_${zone_name}
+               fw add $mode f ${chain} input_${zone_name} ^
+
+               fw add $mode f forwarding_${zone_name}
+               fw add $mode f ${chain}_forward forwarding_${zone_name} ^
+
+               fw add $mode n prerouting_${zone_name}
+               fw add $mode n ${chain}_prerouting prerouting_${zone_name} ^
+       }

 
 

-               fw add i f forwarding_${zone_name}
-               fw add i f ${chain}_forward forwarding_${zone_name} ^
+       [ "$zone_log" == 1 ] && {
+               [ "${zone_log_limit%/*}" == "$zone_log_limit" ] && \
+                       zone_log_limit="$zone_log_limit/minute"

 
 

-               fw add i n prerouting_${zone_name}
-               fw add i n ${chain}_prerouting prerouting_${zone_name} ^
+               local t
+               for t in REJECT DROP MSSFIX; do
+                       fw add $mode f ${chain}_${t} LOG ^ \
+                               { -m limit --limit $zone_log_limit --log-prefix "$t($zone_name): "  }
+               done

        }
 
        }
 

+       # NB: if MASQUERADING for IPv6 becomes available we'll need a family check here
+       if [ "$zone_masq" == 1 ]; then
+               local msrc mdst
+               for msrc in ${zone_masq_src:-0.0.0.0/0}; do
+                       fw_get_negation msrc '-s' "$msrc"
+                       for mdst in ${zone_masq_dest:-0.0.0.0/0}; do
+                               fw_get_negation mdst '-d' "$mdst"
+                               fw add $mode n ${chain}_nat MASQUERADE $ { $msrc $mdst }
+                       done
+               done
+       fi
+

        fw_callback post zone
 }
 
 fw_load_notrack_zone() {
        fw_callback post zone
 }
 
 fw_load_notrack_zone() {

-       list_contains FW_CONNTRACK_ZONES "$1" && return
-

        fw_config_get_zone "$1"
        fw_config_get_zone "$1"

+       list_contains FW_CONNTRACK_ZONES "${zone_name}" && return

 
        fw_callback pre notrack
 
 
        fw_callback pre notrack
 

-       fw add i f zone_${zone_name}_notrack NOTRACK $
+       fw add i r zone_${zone_name}_notrack NOTRACK $

 
        fw_callback post notrack
 }
 
        fw_callback post notrack
 }


@@ -219,8 +271,10 @@ fw_load_notrack_zone() {
 fw_load_include() {
        local name="$1"
 
 fw_load_include() {
        local name="$1"
 

-       local path; config_get path ${name} path
-       [ -e $path ] && . $path
+       local path
+       config_get path ${name} path
+
+       [ -e $path ] && ( . $path )

 }
 
 
 }