From aa9ccf77c6648515ba58c37b9345cdbd561028db Mon Sep 17 00:00:00 2001 From: Steven Barth Date: Thu, 8 May 2008 15:37:41 +0000 Subject: * Mördercommit ;-) * Major Repository Reorganisation * API 0.4 Softfreeze to come MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- applications/luci-fw/Makefile | 2 + applications/luci-fw/root/etc/config/luci_fw | 2 + applications/luci-fw/root/etc/init.d/luci_fw | 124 +++++++++++++++++++++ .../src/model/cbi/admin_network/firewall.lua | 63 +++++++++++ .../luci-fw/src/model/cbi/admin_network/portfw.lua | 25 +++++ applications/luci-fw/src/model/menu/50luci-fw.lua | 3 + 6 files changed, 219 insertions(+) create mode 100644 applications/luci-fw/Makefile create mode 100644 applications/luci-fw/root/etc/config/luci_fw create mode 100644 applications/luci-fw/root/etc/init.d/luci_fw create mode 100644 applications/luci-fw/src/model/cbi/admin_network/firewall.lua create mode 100644 applications/luci-fw/src/model/cbi/admin_network/portfw.lua create mode 100644 applications/luci-fw/src/model/menu/50luci-fw.lua (limited to 'applications/luci-fw') diff --git a/applications/luci-fw/Makefile b/applications/luci-fw/Makefile new file mode 100644 index 000000000..81a96f6a8 --- /dev/null +++ b/applications/luci-fw/Makefile @@ -0,0 +1,2 @@ +include ../../build/config.mk +include ../../build/module.mk \ No newline at end of file diff --git a/applications/luci-fw/root/etc/config/luci_fw b/applications/luci-fw/root/etc/config/luci_fw new file mode 100644 index 000000000..c7dec7f2c --- /dev/null +++ b/applications/luci-fw/root/etc/config/luci_fw @@ -0,0 +1,2 @@ + + \ No newline at end of file diff --git a/applications/luci-fw/root/etc/init.d/luci_fw b/applications/luci-fw/root/etc/init.d/luci_fw new file mode 100644 index 000000000..e98b3f729 --- /dev/null +++ b/applications/luci-fw/root/etc/init.d/luci_fw @@ -0,0 +1,124 @@ +#!/bin/sh /etc/rc.common +START=46 + +apply_portfw() { + local cfg="$1" + config_get proto "$cfg" proto + config_get dport "$cfg" dport + config_get iface "$cfg" iface + config_get to "$cfg" to + + ports=$(echo $to | cut -sd: -f2) + if [ -n "$ports" ]; then + ports="--dport $(echo $ports | sed -e 's/-/:/')" + else + ports="--dport $dport" + fi + + ip=$(echo $to | cut -d: -f1) + + if ([ "$proto" == "tcpudp" ] || [ "$proto" == "tcp" ]); then + iptables -t nat -A luci_fw_prerouting -i "$iface" -p tcp --dport "$dport" -j DNAT --to "$to" + iptables -A luci_fw_forward -i "$iface" -p tcp -d "$ip" $ports -j ACCEPT + fi + + if ([ "$proto" == "tcpudp" ] || [ "$proto" == "udp" ]); then + iptables -t nat -A luci_fw_prerouting -i "$iface" -p udp --dport "$dport" -j DNAT --to "$to" + iptables -A luci_fw_forward -i "$iface" -p udp -d "$ip" $ports -j ACCEPT + fi +} + +apply_rule() { + local cfg="$1" + local cmd="" + + config_get chain "$cfg" chain + [ -n "$chain" ] || return 0 + [ "$chain" == "forward" ] && cmd="$cmd -A luci_fw_forward" + [ "$chain" == "input" ] && cmd="$cmd -A luci_fw_input" + [ "$chain" == "output" ] && cmd="$cmd -A luci_fw_output" + [ "$chain" == "prerouting" ] && cmd="$cmd -t nat -A luci_fw_prerouting" + [ "$chain" == "postrouting" ] && cmd="$cmd -t nat -A luci_fw_postrouting" + + config_get iface "$cfg" iface + [ -n "$iface" ] && cmd="$cmd -i $iface" + + config_get oface "$cfg" oface + [ -n "$oface" ] && cmd="$cmd -o $oface" + + config_get proto "$cfg" proto + [ -n "$proto" ] && cmd="$cmd -p $proto" + + config_get source "$cfg" source + [ -n "$source" ] && cmd="$cmd -s $source" + + config_get destination "$cfg" destination + [ -n "$destination" ] && cmd="$cmd -d $destination" + + config_get sport "$cfg" sport + [ -n "$sport" ] && cmd="$cmd --sport $sport" + + config_get dport "$cfg" dport + [ -n "$dport" ] && cmd="$cmd --dport $dport" + + config_get todest "$cfg" todest + [ -n "$todest" ] && cmd="$cmd --to-destination $todest" + + config_get tosrc "$cfg" tosrc + [ -n "$tosrc" ] && cmd="$cmd --to-source $tosrc" + + config_get mac "$cfg" mac + [ -n "$mac" ] && cmd="$cmd -m mac --mac-source $mac" + + config_get jump "$cfg" jump + [ -n "$jump" ] && cmd="$cmd -j $jump" + + config_get command "$cfg" command + [ -n "$command" ] && cmd="$cmd $command" + + iptables $cmd +} + +start() { + ### Create subchains + iptables -N luci_fw_input + iptables -N luci_fw_output + iptables -N luci_fw_forward + iptables -t nat -N luci_fw_prerouting + iptables -t nat -N luci_fw_postrouting + + ### Hook in the chains + iptables -A input_rule -j luci_fw_input + iptables -A output_rule -j luci_fw_output + iptables -A forwarding_rule -j luci_fw_forward + iptables -t nat -A prerouting_rule -j luci_fw_prerouting + iptables -t nat -A postrouting_rule -j luci_fw_postrouting + + ### Read chains from config + config_load luci_fw + config_foreach apply_portfw portfw + config_foreach apply_rule rule +} + +stop() { + ### Hook out the chains + iptables -D input_rule -j luci_fw_input + iptables -D output_rule -j luci_fw_output + iptables -D forwarding_rule -j luci_fw_forward + iptables -t nat -D prerouting_rule -j luci_fw_prerouting + iptables -t nat -D postrouting_rule -j luci_fw_postrouting + + ### Clear subchains + iptables -F luci_fw_input + iptables -F luci_fw_output + iptables -F luci_fw_forward + iptables -t nat -F luci_fw_prerouting + iptables -t nat -F luci_fw_postrouting + + ### Delete subchains + iptables -X luci_fw_input + iptables -X luci_fw_output + iptables -X luci_fw_forward + iptables -t nat -X luci_fw_prerouting + iptables -t nat -X luci_fw_postrouting +} diff --git a/applications/luci-fw/src/model/cbi/admin_network/firewall.lua b/applications/luci-fw/src/model/cbi/admin_network/firewall.lua new file mode 100644 index 000000000..4ff15db53 --- /dev/null +++ b/applications/luci-fw/src/model/cbi/admin_network/firewall.lua @@ -0,0 +1,63 @@ +-- ToDo: Translate, Add descriptions and help texts +m = Map("luci_fw", "Firewall", [[Mit Hilfe der Firewall können Zugriffe auf das Netzwerk +erlaubt, verboten oder umgeleitet werden.]]) + +s = m:section(TypedSection, "rule") +s.addremove = true +s.anonymous = true + +chain = s:option(ListValue, "chain", "Kette") +chain:value("forward", "Forward") +chain:value("input", "Input") +chain:value("output", "Output") +chain:value("prerouting", "Prerouting") +chain:value("postrouting", "Postrouting") + +s:option(Value, "iface", "Eingangsschnittstelle").optional = true +s:option(Value, "oface", "Ausgangsschnittstelle").optional = true + +proto = s:option(ListValue, "proto", "Protokoll") +proto.optional = true +proto:value("") +proto:value("tcp", "TCP") +proto:value("udp", "UDP") + +s:option(Value, "source", "Quelladresse").optional = true +s:option(Value, "destination", "Zieladresse").optional = true +s:option(Value, "mac", "MAC-Adresse").optional = true + +sport = s:option(Value, "sport", "Quellport") +sport.optional = true +sport:depends("proto", "tcp") +sport:depends("proto", "udp") + +dport = s:option(Value, "dport", "Zielport") +dport.optional = true +dport:depends("proto", "tcp") +dport:depends("proto", "udp") + +tosrc = s:option(Value, "tosrc", "Neue Quelladresse [SNAT]") +tosrc.optional = true +tosrc:depends("jump", "SNAT") + +tosrc = s:option(Value, "todest", "Neue Zieladresse [DNAT]") +tosrc.optional = true +tosrc:depends("jump", "DNAT") + +jump = s:option(ListValue, "jump", "Aktion") +jump.rmempty = true +jump:value("", "") +jump:value("ACCEPT", "annehmen (ACCEPT)") +jump:value("REJECT", "zurückweisen (REJECT)") +jump:value("DROP", "verwerfen (DROP)") +jump:value("LOG", "protokollieren (LOG)") +jump:value("DNAT", "Ziel umschreiben (DNAT) [nur Prerouting]") +jump:value("MASQUERADE", "maskieren (MASQUERADE) [nur Postrouting]") +jump:value("SNAT", "Quelle umschreiben (SNAT) [nur Postrouting]") + + +add = s:option(Value, "command", "Eigener Befehl") +add.size = 50 +add.rmempty = true + +return m diff --git a/applications/luci-fw/src/model/cbi/admin_network/portfw.lua b/applications/luci-fw/src/model/cbi/admin_network/portfw.lua new file mode 100644 index 000000000..96822b53a --- /dev/null +++ b/applications/luci-fw/src/model/cbi/admin_network/portfw.lua @@ -0,0 +1,25 @@ +-- ToDo: Translate, Add descriptions and help texts +require("ffluci.sys") +m = Map("luci_fw", "Portweiterleitung", [[Portweiterleitungen ermöglichen es interne +Netzwerkdienste von einem anderen externen Netzwerk aus erreichbar zu machen.]]) + +s = m:section(TypedSection, "portfw") +s.addremove = true +s.anonymous = true + +iface = s:option(ListValue, "iface", "Externes Interface") +iface:value("") +for k,v in pairs(ffluci.sys.net.devices()) do + iface:value(v) +end + +proto = s:option(ListValue, "proto", "Protokoll") +proto:value("tcp", "TCP") +proto:value("udp", "UDP") +proto:value("tcpudp", "TCP + UDP") + +dport = s:option(Value, "dport", "Externer Port", "Port[:Endport]") + +to = s:option(Value, "to", "Interne Adresse", "IP-Adresse[:Zielport[-Zielendport]]") + +return m diff --git a/applications/luci-fw/src/model/menu/50luci-fw.lua b/applications/luci-fw/src/model/menu/50luci-fw.lua new file mode 100644 index 000000000..93aba2fab --- /dev/null +++ b/applications/luci-fw/src/model/menu/50luci-fw.lua @@ -0,0 +1,3 @@ +sel("admin", "network") +act("portfw", "Portweiterleitung") +act("firewall", "Firewall") \ No newline at end of file -- cgit v1.2.3