896947241a525bdf8d383dd41ce3f34610ef2c6b
[openwrt-10.03/.git] / package / firewall / files / lib / fw.sh
1 # Copyright (C) 2009-2010 OpenWrt.org
2 # Copyright (C) 2009 Malte S. Stretz
3
4 export FW_4_ERROR=0
5 export FW_6_ERROR=0
6 export FW_i_ERROR=0
7 export FW_e_ERROR=0
8 export FW_a_ERROR=0
9
10 #TODO: remove this
11 [ "${-#*x}" == "$-" ] && {
12         fw() {
13                 fw__exec "$@"
14         }
15 } || {
16         fw() {
17                 local os=$-
18                 set +x
19                 fw__exec "$@"
20                 local rc=$?
21                 set -$os
22                 return $rc
23         }
24 }
25
26 fw__exec() { # <action> <family> <table> <chain> <target> <position> { <rules> }
27         local cmd fam tab chn tgt pos
28         local i
29         for i in cmd fam tab chn tgt pos; do
30                 if [ "$1" -a "$1" != '{' ]; then
31                         eval "$i='$1'"
32                         shift
33                 else
34                         eval "$i=-"
35                 fi
36         done
37
38         fw__rc() {
39                 export FW_${fam#G}_ERROR=$1
40                 return $1
41         }
42
43         fw__dualip() {
44                 fw $cmd 4 $tab $chn $tgt $pos "$@"
45                 fw $cmd 6 $tab $chn $tgt $pos "$@"
46                 fw__rc $((FW_4_ERROR | FW_6_ERROR))
47         }
48
49         fw__autoip() {
50                 local ip4 ip6
51                 shift
52                 while [ "$1" != '}' ]; do
53                         case "$1" in
54                                 *:*) ip6=1 ;;
55                                 *.*.*.*) ip4=1 ;;
56                         esac
57                         shift
58                 done
59                 shift
60                 if [ "${ip4:-4}" == "${ip6:-6}" ]; then
61                         echo "fw: can't mix ip4 and ip6" >&2
62                         return 1
63                 fi
64                 local ver=${ip4:+4}${ip6:+6}
65                 fam=i
66                 fw $cmd ${ver:-i} $tab $chn $tgt $pos "$@"
67                 fw__rc $?
68         }
69
70         fw__has() {
71                 local tab=${1:-$tab}
72                 if [ $tab == '-' ]; then
73                         type $app > /dev/null 2> /dev/null
74                         fw__rc $(($? & 1))
75                         return
76                 fi
77                 local mod
78                 eval "mod=\$FW_${fam#G}_${tab}"
79                 if [ "$mod" ]; then
80                         fw__rc $mod
81                         return
82                 fi
83                 case "$fam" in
84                         *4) mod=iptable_${tab} ;;
85                         *6) mod=ip6table_${tab} ;;
86                         *) mod=. ;;
87                 esac
88                 grep -q "^${mod} " /proc/modules
89                 mod=$?
90                 export FW_${fam}_${tab}=$mod
91                 fw__rc $mod
92         }
93
94         fw__err() {
95                 local err
96                 eval "err=\$FW_${fam}_ERROR"
97                 fw__rc $err
98         }
99
100         local app=
101         local pol=
102         case "$fam" in
103                 *4) [ $FW_DISABLE_IPV4 == 0 ] && app=iptables  || return ;;
104                 *6) [ $FW_DISABLE_IPV6 == 0 ] && app=ip6tables || return ;;
105                 i) fw__dualip "$@"; return ;;
106                 I) fw__autoip "$@"; return ;;
107                 e) app=ebtables ;;
108                 a) app=arptables ;;
109                 -) fw $cmd i $tab $chn $tgt $pos "$@"; return ;;
110                 *) return 254 ;;
111         esac
112         case "$tab" in
113                 f) tab=filter ;;
114                 m) tab=mangle ;;
115                 n) tab=nat ;;
116                 r) tab=raw ;;
117                 -) tab=filter ;;
118         esac
119         case "$cmd:$chn:$tgt:$pos" in
120                 add:*:-:*) cmd=new-chain ;;
121                 add:*:*:-) cmd=append ;;
122                 add:*:*:$) cmd=append ;;
123                 add:*:*:*) cmd=insert ;;
124                 del:-:*:*) cmd=delete-chain; fw flush $fam $tab ;;
125                 del:*:-:*) cmd=delete-chain; fw flush $fam $tab $chn ;;
126                 del:*:*:*) cmd=delete ;;
127                 flush:*) ;;
128                 policy:*) pol=$tgt; tgt=- ;;
129                 has:*) fw__has; return ;;
130                 err:*) fw__err; return ;;
131                 list:*) cmd="numeric --verbose --$cmd" ;;
132                 *) return 254 ;;
133         esac
134         case "$chn" in
135                 -) chn= ;;
136         esac
137         case "$tgt" in
138                 -) tgt= ;;
139         esac
140         case "$pos" in
141                 ^) pos=1 ;;
142                 $) pos= ;;
143                 -) pos= ;;
144         esac
145
146         if ! fw__has - family || ! fw__has $tab ; then
147                 export FW_${fam}_ERROR=0
148                 return 0
149         fi
150
151         case "$fam" in
152                 G*) shift; while [ $# -gt 0 ] && [ "$1" != "{" ]; do shift; done ;;
153         esac
154
155         if [ $# -gt 0 ]; then
156                 shift
157                 if [ $cmd == delete ]; then
158                         pos=
159                 fi
160         fi
161
162         local cmdline="$app --table ${tab} --${cmd} ${chn} ${pol} ${pos} ${tgt:+--jump "$tgt"}"
163         while [ $# -gt 1 ]; do
164                 case "$app:$1" in
165                         ip6tables:--icmp-type) cmdline="$cmdline --icmpv6-type" ;;
166                         ip6tables:icmp|ip6tables:ICMP) cmdline="$cmdline icmpv6" ;;
167                         iptables:--icmpv6-type) cmdline="$cmdline --icmp-type" ;;
168                         iptables:icmpv6) cmdline="$cmdline icmp" ;;
169                         *) cmdline="$cmdline $1" ;;
170                 esac
171                 shift
172         done
173
174         [ -n "$FW_TRACE" ] && echo $cmdline >&2
175
176         $cmdline
177
178         fw__rc $?
179 }
180
181 fw_get_port_range() {
182         local _var=$1
183         local _ports=$2
184         local _delim=${3:-:}
185         if [ "$4" ]; then
186                 fw_get_port_range $_var "${_ports}-${4}" $_delim
187                 return
188         fi
189
190         local _first=${_ports%-*}
191         local _last=${_ports#*-}
192         if [ "$_first" != "$_last" ]; then
193                 export -- "$_var=$_first$_delim$_last"
194         else
195                 export -- "$_var=$_first"
196         fi
197 }
198
199 fw_get_family_mode() {
200         local _var="$1"
201         local _hint="$2"
202         local _zone="$3"
203         local _mode="$4"
204
205         local _ipv4 _ipv6
206         [ -n "$FW_ZONES4$FW_ZONES6" ] && {
207                 list_contains FW_ZONES4 $_zone && _ipv4=1 || _ipv4=0
208                 list_contains FW_ZONES6 $_zone && _ipv6=1 || _ipv6=0
209         } || {
210                 _ipv4=$(uci_get_state firewall core ${_zone}_ipv4 0)
211                 _ipv6=$(uci_get_state firewall core ${_zone}_ipv6 0)
212         }
213
214         case "$_hint:$_ipv4:$_ipv6" in
215                 *4:1:*|*:1:0) export -n -- "$_var=G4" ;;
216                 *6:*:1|*:0:1) export -n -- "$_var=G6" ;;
217                 *) export -n -- "$_var=$_mode" ;;
218         esac
219 }
220
221 fw_get_negation() {
222         local _var="$1"
223         local _flag="$2"
224         local _ipaddr="$3"
225
226         [ "${_ipaddr#!}" != "$_ipaddr" ] && \
227                 export -n -- "$_var=! $_flag ${_ipaddr#!}" || \
228                 export -n -- "$_var=${_ipaddr:+$_flag $_ipaddr}"
229 }
230
231 fw_get_subnet4() {
232         local _var="$1"
233         local _flag="$2"
234         local _name="$3"
235
236         local _ipaddr="$(uci_get_state network "${_name#!}" ipaddr)"
237         local _netmask="$(uci_get_state network "${_name#!}" netmask)"
238
239         case "$_ipaddr" in
240                 *.*.*.*)
241                         [ "${_name#!}" != "$_name" ] && \
242                                 export -n -- "$_var=! $_flag $_ipaddr/${_netmask:-255.255.255.255}" || \
243                                 export -n -- "$_var=$_flag $_ipaddr/${_netmask:-255.255.255.255}"
244                 ;;
245                 *) export -n -- "$_var=" ;;
246         esac
247 }