1 # Copyright (C) 2009-2010 OpenWrt.org
2 # Copyright (C) 2009 Malte S. Stretz
11 [ "${-#*x}" == "$-" ] && {
26 fw__exec() { # <action> <family> <table> <chain> <target> <position> { <rules> }
27 local cmd fam tab chn tgt pos
29 for i in cmd fam tab chn tgt pos; do
30 if [ "$1" -a "$1" != '{' ]; then
39 export FW_${fam#G}_ERROR=$1
44 fw $cmd 4 $tab $chn $tgt $pos "$@"
45 fw $cmd 6 $tab $chn $tgt $pos "$@"
46 fw__rc $((FW_4_ERROR | FW_6_ERROR))
52 while [ "$1" != '}' ]; do
60 if [ "${ip4:-4}" == "${ip6:-6}" ]; then
61 echo "fw: can't mix ip4 and ip6" >&2
64 local ver=${ip4:+4}${ip6:+6}
66 fw $cmd ${ver:-i} $tab $chn $tgt $pos "$@"
72 if [ $tab == '-' ]; then
73 type $app > /dev/null 2> /dev/null
77 [ "$app" != ip6tables ] || [ "$tab" != nat ]
83 eval "err=\$FW_${fam}_ERROR"
90 *4) [ $FW_DISABLE_IPV4 == 0 ] && app=iptables || return ;;
91 *6) [ $FW_DISABLE_IPV6 == 0 ] && app=ip6tables || return ;;
92 i) fw__dualip "$@"; return ;;
93 I) fw__autoip "$@"; return ;;
96 -) fw $cmd i $tab $chn $tgt $pos "$@"; return ;;
106 case "$cmd:$chn:$tgt:$pos" in
107 add:*:-:*) cmd=new-chain ;;
108 add:*:*:-) cmd=append ;;
109 add:*:*:$) cmd=append ;;
110 add:*:*:*) cmd=insert ;;
111 del:-:*:*) cmd=delete-chain; fw flush $fam $tab ;;
112 del:*:-:*) cmd=delete-chain; fw flush $fam $tab $chn ;;
113 del:*:*:*) cmd=delete ;;
115 policy:*) pol=$tgt; tgt=- ;;
116 has:*) fw__has; return ;;
117 err:*) fw__err; return ;;
118 list:*) cmd="numeric --verbose --$cmd" ;;
133 +) eval "rule_offset=\${FW__RULE_OFS_${app}_${tab}_${chn}:-1}" ;;
136 if ! fw__has - family || ! fw__has $tab ; then
137 export FW_${fam}_ERROR=0
142 G*) shift; while [ $# -gt 0 ] && [ "$1" != "{" ]; do shift; done ;;
145 if [ $# -gt 0 ]; then
147 if [ $cmd == delete ]; then
152 local cmdline="$app --table ${tab} --${cmd} ${chn} ${pol} ${rule_offset:-${pos}} ${tgt:+--jump "$tgt"}"
153 while [ $# -gt 1 ]; do
154 # special parameter handling
156 -p:icmp*|-p:1|-p:58|--protocol:icmp*|--protocol:1|--protocol:58)
157 [ "$app" = ip6tables ] && \
158 cmdline="$cmdline -p icmpv6" || \
159 cmdline="$cmdline -p icmp"
162 --icmp-type:*|--icmpv6-type:*)
164 if [ "$app" = ip6tables ] && fw_check_icmptype6 icmp_type "$2"; then
165 cmdline="$cmdline $icmp_type"
166 elif [ "$app" = iptables ] && fw_check_icmptype4 icmp_type "$2"; then
167 cmdline="$cmdline $icmp_type"
169 local fam=IPv4; [ "$app" = ip6tables ] && fam=IPv6
170 fw_log info "ICMP type '$2' is not valid for $fam address family, skipping rule"
175 *) cmdline="$cmdline $1" ;;
180 [ -n "$FW_TRACE" ] && echo $cmdline >&2
185 [ $rv -eq 0 ] && [ -n "$rule_offset" ] && \
186 export -- "FW__RULE_OFS_${app}_${tab}_${chn}=$(($rule_offset + 1))"
190 fw_get_port_range() {
195 fw_get_port_range $_var "${_ports}-${4}" $_delim
199 local _first=${_ports%-*}
200 local _last=${_ports#*-}
201 if [ "${_first#!}" != "${_last#!}" ]; then
202 export -- "$_var=$_first$_delim${_last#!}"
204 export -- "$_var=$_first"
208 fw_get_family_mode() {
215 [ "$_zone" != "*" ] && {
216 [ -n "$FW_ZONES4$FW_ZONES6" ] && {
217 list_contains FW_ZONES4 "$_zone" && _ipv4=1 || _ipv4=0
218 list_contains FW_ZONES6 "$_zone" && _ipv6=1 || _ipv6=0
220 _ipv4=$(uci_get_state firewall core "${_zone}_ipv4" 0)
221 _ipv6=$(uci_get_state firewall core "${_zone}_ipv6" 0)
228 case "$_hint:$_ipv4:$_ipv6" in
229 *4:1:*|*:1:0) export -n -- "$_var=G4" ;;
230 *6:*:1|*:0:1) export -n -- "$_var=G6" ;;
231 *) export -n -- "$_var=$_mode" ;;
240 [ "${_value#!}" != "$_value" ] && \
241 export -n -- "$_var=! $_flag ${_value#!}" || \
242 export -n -- "$_var=${_value:+$_flag $_value}"
250 local _ipaddr="$(uci_get_state network "${_name#!}" ipaddr)"
251 local _netmask="$(uci_get_state network "${_name#!}" netmask)"
255 [ "${_name#!}" != "$_name" ] && \
256 export -n -- "$_var=! $_flag $_ipaddr/${_netmask:-255.255.255.255}" || \
257 export -n -- "$_var=$_flag $_ipaddr/${_netmask:-255.255.255.255}"
262 export -n -- "$_var="
266 fw_check_icmptype4() {
270 ![0-9]*) export -n -- "$_var=! --icmp-type ${_type#!}"; return 0 ;;
271 [0-9]*) export -n -- "$_var=--icmp-type $_type"; return 0 ;;
274 [ -z "$FW_ICMP4_TYPES" ] && \
275 export FW_ICMP4_TYPES=$(
276 iptables -p icmp -h 2>/dev/null | \
277 sed -n -e '/^Valid ICMP Types:/ {
278 n; :r; s/[()]/ /g; s/[[:space:]]\+/\n/g; p; n; b r
283 for _check in $FW_ICMP4_TYPES; do
284 if [ "$_check" = "${_type#!}" ]; then
285 [ "${_type#!}" != "$_type" ] && \
286 export -n -- "$_var=! --icmp-type ${_type#!}" || \
287 export -n -- "$_var=--icmp-type $_type"
292 export -n -- "$_var="
296 fw_check_icmptype6() {
300 ![0-9]*) export -n -- "$_var=! --icmpv6-type ${_type#!}"; return 0 ;;
301 [0-9]*) export -n -- "$_var=--icmpv6-type $_type"; return 0 ;;
304 [ -z "$FW_ICMP6_TYPES" ] && \
305 export FW_ICMP6_TYPES=$(
306 ip6tables -p icmpv6 -h 2>/dev/null | \
307 sed -n -e '/^Valid ICMPv6 Types:/ {
308 n; :r; s/[()]/ /g; s/[[:space:]]\+/\n/g; p; n; b r
313 for _check in $FW_ICMP6_TYPES; do
314 if [ "$_check" = "${_type#!}" ]; then
315 [ "${_type#!}" != "$_type" ] && \
316 export -n -- "$_var=! --icmpv6-type ${_type#!}" || \
317 export -n -- "$_var=--icmpv6-type $_type"
322 export -n -- "$_var="