From 68a1c8e1e3ccd2a366563b32db85361f5fff6cec Mon Sep 17 00:00:00 2001
From: Jo-Philipp Wich <jow@openwrt.org>
Date: Thu, 30 Jun 2011 01:31:23 +0000
Subject: firewall: - allow multiple ports, protocols, macs, icmp types per
 rule - implement "limit" and "limit_burst" options for rules - implement
 "extra" option to rules and redirects for passing arbritary flags to iptables
 - implement negations for "src_port", "dest_port", "src_dport", "src_mac",
 "proto" and "icmp_type" options - allow wildcard (*) "src" and "dest" options
 in rules to allow specifying "any" source or destination - validate symbolic
 icmp-type names against the selected iptables binary - properly handle
 forwarded ICMPv6 traffic in the default configuration

SVN-Revision: 27317
---
 package/firewall/files/lib/core_rule.sh | 63 +++++++++++++++++++++++----------
 1 file changed, 45 insertions(+), 18 deletions(-)

(limited to 'package/firewall/files/lib/core_rule.sh')

diff --git a/package/firewall/files/lib/core_rule.sh b/package/firewall/files/lib/core_rule.sh
index 8c234a33a1..64a510df92 100644
--- a/package/firewall/files/lib/core_rule.sh
+++ b/package/firewall/files/lib/core_rule.sh
@@ -16,24 +16,23 @@ fw_config_get_rule() {
 		string proto "tcpudp" \
 		string target "" \
 		string family "" \
+		string limit "" \
+		string limit_burst "" \
+		string extra "" \
 	} || return
 	[ -n "$rule_name" ] || rule_name=$rule__name
-	[ "$rule_proto" == "icmp" ] || rule_icmp_type=
 }
 
 fw_load_rule() {
 	fw_config_get_rule "$1"
 
-	[ "$rule_target" != "NOTRACK" ] || [ -n "$rule_src" ] || {
+	[ "$rule_target" != "NOTRACK" ] || [ -n "$rule_src" ] || [ "$rule_src" != "*" ] || {
 		fw_log error "NOTRACK rule ${rule_name}: needs src, skipping"
 		return 0
 	}
 
 	fw_callback pre rule
 
-	fw_get_port_range rule_src_port $rule_src_port
-	fw_get_port_range rule_dest_port $rule_dest_port
-
 	local table=f
 	local chain=input
 	local target="${rule_target:-REJECT}"
@@ -41,8 +40,22 @@ fw_load_rule() {
 		table=r
 		chain="zone_${rule_src}_notrack"
 	else
-		[ -n "$rule_src" ] && chain="zone_${rule_src}${rule_dest:+_forward}"
-		[ -n "$rule_dest" ] && target="zone_${rule_dest}_${target}"
+		if [ -n "$rule_src" ]; then
+			if [ "$rule_src" != "*" ]; then
+				chain="zone_${rule_src}${rule_dest:+_forward}"
+			else
+				chain="${rule_dest:+forward}"
+				chain="${chain:-input}"
+			fi
+		fi
+
+		if [ -n "$rule_dest" ]; then
+			if [ "$rule_dest" != "*" ]; then
+				target="zone_${rule_dest}_${target}"
+			elif [ "$target" = REJECT ]; then
+				target=reject
+			fi
+		fi
 	fi
 
 	local mode
@@ -54,17 +67,31 @@ fw_load_rule() {
 
 	[ "$rule_proto" == "tcpudp" ] && rule_proto="tcp udp"
 	for rule_proto in $rule_proto; do
-		local rule_pos
-		eval 'rule_pos=$((++FW__RULE_COUNT_'${mode#G}'_'$chain'))'
-
-		fw add $mode $table $chain $target $rule_pos { $rule_src_ip $rule_dest_ip } { \
-			$src_spec $dest_spec \
-			${rule_proto:+-p $rule_proto} \
-			${rule_src_port:+--sport $rule_src_port} \
-			${rule_src_mac:+-m mac --mac-source $rule_src_mac} \
-			${rule_dest_port:+--dport $rule_dest_port} \
-			${rule_icmp_type:+--icmp-type $rule_icmp_type} \
-		}
+		fw_get_negation rule_proto '-p' "$rule_proto"
+		for rule_src_port in ${rule_src_port:-""}; do
+			fw_get_port_range rule_src_port $rule_src_port
+			fw_get_negation rule_src_port '--sport' "$rule_src_port"
+			for rule_dest_port in ${rule_dest_port:-""}; do
+				fw_get_port_range rule_dest_port $rule_dest_port
+				fw_get_negation rule_dest_port '--dport' "$rule_dest_port"
+				for rule_src_mac in ${rule_src_mac:-""}; do
+					fw_get_negation rule_src_mac '--mac-source' "$rule_src_mac"
+					for rule_icmp_type in ${rule_icmp_type:-""}; do
+						[ "$rule_proto" = "-p icmp" ] || rule_icmp_type=""
+						fw add $mode $table $chain $target + \
+							{ $rule_src_ip $rule_dest_ip } { \
+							$src_spec $dest_spec $rule_proto \
+							$rule_src_port $rule_dest_port \
+							${rule_src_mac:+-m mac $rule_src_mac} \
+							${rule_icmp_type:+--icmp-type $rule_icmp_type} \
+							${rule_limit:+-m limit --limit $rule_limit \
+								${rule_limit_burst:+--limit-burst $rule_limit_burst}} \
+							$rule_extra \
+						}
+					done
+				done
+			done
+		done
 	done
 
 	fw_callback post rule
-- 
cgit v1.2.3