* applications/luci-fw: Added support for customizing inter-device routing

* applications/luci-fw: Adapted Firewallscripts to better integrate into OpenWRT networking concept

6 files changed, 105 insertions, 14 deletions

diff --git a/applications/luci-fw/root/etc/init.d/luci_fw b/applications/luci-fw/root/etc/init.d/luci_fw
index e98b3f7296..51faef9084 100644
--- a/applications/luci-fw/root/etc/init.d/luci_fw
+++ b/applications/luci-fw/root/etc/init.d/luci_fw
@@ -7,6 +7,13 @@ apply_portfw() {
 	config_get dport "$cfg" dport
 	config_get iface "$cfg" iface
 	config_get to    "$cfg" to
+	
+	config_get ifname "$iface" ifname
+	
+	[ -n "$proto" ] || return 0
+	[ -n "$dport" ] || return 0
+	[ -n "$ifname" ] || return 0
+	[ -n "$to" ] || return 0
 
 	ports=$(echo $to | cut -sd: -f2)
 	if [ -n "$ports" ]; then
@@ -18,16 +25,52 @@ apply_portfw() {
 	ip=$(echo $to | cut -d: -f1)
 	
 	if ([ "$proto" == "tcpudp" ] || [ "$proto" == "tcp" ]); then
-		iptables -t nat -A luci_fw_prerouting -i "$iface" -p tcp --dport "$dport" -j DNAT --to "$to"
-		iptables -A luci_fw_forward -i "$iface" -p tcp -d "$ip" $ports -j ACCEPT
+		iptables -t nat -A luci_fw_prerouting -i "$ifname" -p tcp --dport "$dport" -j DNAT --to "$to"
+		iptables -A luci_fw_forward -i "$ifname" -p tcp -d "$ip" $ports -j ACCEPT
 	fi
 
 	if ([ "$proto" == "tcpudp" ] || [ "$proto" == "udp" ]); then
-		iptables -t nat -A luci_fw_prerouting -i "$iface" -p udp --dport "$dport" -j DNAT --to "$to"
-		iptables -A luci_fw_forward -i "$iface" -p udp -d "$ip" $ports -j ACCEPT
+		iptables -t nat -A luci_fw_prerouting -i "$ifname" -p udp --dport "$dport" -j DNAT --to "$to"
+		iptables -A luci_fw_forward -i "$ifname" -p udp -d "$ip" $ports -j ACCEPT
 	fi
 }
 
+apply_routing() {
+	local cfg="$1"
+	config_get iface "$cfg" iface
+	config_get oface "$cfg" oface
+	config_get_bool fwd "$cfg" fwd
+	config_get_bool nat "$cfg" nat
+	config_get_bool bidi "$cfg" bidi
+	
+	config_get ifname "$iface" ifname
+	config_get ofname "$oface" ifname
+	
+	[ -n "$ifname" ] || return 0
+	[ -n "$ofname" ] || return 0
+	
+	[ "$fwd" -gt 0 ] && {
+		iptables -A luci_fw_forward -i "$ifname" -o "$ofname" -j ACCEPT
+		[ "$bidi" -gt 0 ] && iptables -A luci_fw_forward -i "$ofname" -o "$ifname" -j ACCEPT
+	}
+	
+	[ "$nat" -gt 0 ] && {
+		config_get ifip "$iface" ipaddr
+		config_get ifmask "$iface" netmask
+		eval "$(ipcalc.sh $ifip $ifmask)"
+		
+		iptables -t nat -A luci_freifunk_postrouting -s "$NETWORK/$PREFIX" -o "$oface" -j MASQUERADE
+		
+		[ "$bidi" -gt 0 ] && {
+			config_get ofip "$oface" ipaddr
+			config_get ofmask "$oface" netmask
+			eval "$(ipcalc.sh $ofip $ofmask)"
+			
+			iptables -t nat -A luci_freifunk_postrouting -s "$NETWORK/$PREFIX" -o "$iface" -j MASQUERADE		
+		}
+	}
+}
+
 apply_rule() {
 	local cfg="$1"
 	local cmd=""
@@ -41,10 +84,12 @@ apply_rule() {
 	[ "$chain" == "postrouting" ] && cmd="$cmd -t nat -A luci_fw_postrouting"
 	
 	config_get iface "$cfg" iface
-	[ -n "$iface" ] && cmd="$cmd -i $iface"	
+	config_get ifname "$iface" ifname
+	[ -n "$ifname" ] && cmd="$cmd -i $ifname"	
 
 	config_get oface "$cfg" oface
-	[ -n "$oface" ] && cmd="$cmd -o $oface"	
+	config_get ofname "$oface" ifname
+	[ -n "$ofname" ] && cmd="$cmd -o $ofname"	
 
 	config_get proto "$cfg" proto
 	[ -n "$proto" ] && cmd="$cmd -p $proto"	
@@ -94,10 +139,15 @@ start() {
 	iptables -t nat -A prerouting_rule -j luci_fw_prerouting
 	iptables -t nat -A postrouting_rule -j luci_fw_postrouting
 	
+	### Scan network interfaces
+	include /lib/network
+	scan_interfaces
+	
 	### Read chains from config
 	config_load luci_fw
-	config_foreach apply_portfw portfw
 	config_foreach apply_rule rule
+	config_foreach apply_portfw portfw
+	config_foreach apply_routing routing
 }
 
 stop() {
diff --git a/applications/luci-fw/src/model/cbi/admin_network/firewall.lua b/applications/luci-fw/src/model/cbi/admin_network/firewall.lua
index 4ff15db53e..7c89d07c55 100644
--- a/applications/luci-fw/src/model/cbi/admin_network/firewall.lua
+++ b/applications/luci-fw/src/model/cbi/admin_network/firewall.lua
@@ -13,8 +13,18 @@ chain:value("output", "Output")
 chain:value("prerouting", "Prerouting")
 chain:value("postrouting", "Postrouting")
 
-s:option(Value, "iface", "Eingangsschnittstelle").optional = true
-s:option(Value, "oface", "Ausgangsschnittstelle").optional = true
+iface = s:option(ListValue, "iface", "Eingangsschnittstelle")
+iface.optional = true
+
+oface = s:option(ListValue, "oface", "Ausgangsschnittstelle")
+oface.optional = true
+
+for k, v in pairs(ffluci.model.uci.sections("network")) do
+	if v[".type"] == "interface" and k ~= "loopback" then
+		iface:value(k)
+		oface:value(k)
+	end
+end
 
 proto = s:option(ListValue, "proto", "Protokoll")
 proto.optional = true
diff --git a/applications/luci-fw/src/model/cbi/admin_network/portfw.lua b/applications/luci-fw/src/model/cbi/admin_network/portfw.lua
index 5ee22336e7..90ebb4c24d 100644
--- a/applications/luci-fw/src/model/cbi/admin_network/portfw.lua
+++ b/applications/luci-fw/src/model/cbi/admin_network/portfw.lua
@@ -9,9 +9,11 @@ s.addremove = true
 s.anonymous = true
 
 iface = s:option(ListValue, "iface", "Schnittstelle", "Externe Schnittstelle")
-iface:value("")
-for k,v in pairs(ffluci.sys.net.devices()) do
-	iface:value(v)
+iface.default = "wan"
+for k, v in pairs(ffluci.model.uci.sections("network")) do
+	if v[".type"] == "interface" and k ~= "loopback" then
+		iface:value(k)
+	end
 end
 
 proto = s:option(ListValue, "proto", "Protokoll")
diff --git a/applications/luci-fw/src/model/cbi/admin_network/routing.lua b/applications/luci-fw/src/model/cbi/admin_network/routing.lua
new file mode 100644
index 0000000000..45016f42b9
--- /dev/null
+++ b/applications/luci-fw/src/model/cbi/admin_network/routing.lua
@@ -0,0 +1,28 @@
+-- ToDo: Translate, Add descriptions and help texts
+require("ffluci.sys")
+m = Map("luci_fw", "Routing", [[An dieser Stelle wird festlegt, welcher Netzverkehr zwischen einzelnen
+Schnittstellen erlaubt werden soll. Es werden jeweils nur neue Verbindungen
+betrachtet, d.h. Pakete von aufgebauten oder zugehörigen Verbindungen werden automatisch in beide Richtungen
+akzeptiert, auch wenn das Feld "beide Richtungen" nicht explizit gesetzt ist.
+NAT ermöglicht Adressübersetzung.]])
+
+s = m:section(TypedSection, "routing")
+s.template  = "cbi/tblsection"
+s.addremove = true
+s.anonymous = true
+
+iface = s:option(ListValue, "iface", "Eingang", "Eingangsschnittstelle")
+oface = s:option(ListValue, "oface", "Ausgang", "Ausgangsschnittstelle")
+
+for k, v in pairs(ffluci.model.uci.sections("network")) do
+	if v[".type"] == "interface" and k ~= "loopback" then
+		iface:value(k)
+		oface:value(k)
+	end
+end
+
+s:option(Flag, "fwd", "FWD", "weiterleiten")
+s:option(Flag, "nat", "NAT", "übersetzen")
+s:option(Flag, "bidi", "<->", "beide Richtungen")
+
+return m
diff --git a/applications/luci-fw/src/model/menu/50luci-fw.lua b/applications/luci-fw/src/model/menu/50luci-fw.lua
index 93aba2fabe..b7543b0621 100644
--- a/applications/luci-fw/src/model/menu/50luci-fw.lua
+++ b/applications/luci-fw/src/model/menu/50luci-fw.lua
@@ -1,3 +1,4 @@
 sel("admin", "network")
 act("portfw", "Portweiterleitung")
+act("routing", "Routing")
 act("firewall", "Firewall")
\ No newline at end of file
diff --git a/contrib/package/ffluci/Makefile b/contrib/package/ffluci/Makefile
index 2981900576..998469541e 100644
--- a/contrib/package/ffluci/Makefile
+++ b/contrib/package/ffluci/Makefile
@@ -68,7 +68,7 @@ define Package/ffluci-ff-halle
   DEPENDS:=ffluci \
    +ffluci-sgi-haserl +ffluci-mod-freifunk +ffluci-app-firewall +ffluci-app-splash \
    +olsrd +olsrd-mod-dyn-gw +olsrd-mod-txtinfo +olsrd-mod-nameservice \
-   +kmod-tun
+   +kmod-tun +ip
   TITLE:=Freifunk Halle Community Meta-Package
 endef
 
@@ -81,7 +81,7 @@ define Package/ffluci-ff-leipzig
   DEPENDS:=ffluci \
    +ffluci-sgi-haserl +ffluci-mod-freifunk +ffluci-app-firewall +ffluci-app-splash \
    +olsrd +olsrd-mod-dyn-gw +olsrd-mod-txtinfo +olsrd-mod-nameservice \
-   +kmod-tun
+   +kmod-tun +ip
   TITLE:=Freifunk Leipzig Community Meta-Package
 endef