package/network/iptables/rocknet_iptables.sh

   1 # --- T2-COPYRIGHT-NOTE-BEGIN ---
   2 # This copyright note is auto-generated by scripts/Create-CopyPatch.
   3 #
   4 # T2 SDE: package/.../iptables/rocknet_iptables.sh
   5 # Copyright (C) 2004 - 2020 The T2 SDE Project
   6 #
   7 # More information can be found in the files COPYING and README.
   8 #
   9 # This program is free software; you can redistribute it and/or modify
  10 # it under the terms of the GNU General Public License as published by
  11 # the Free Software Foundation; version 2 of the License. A copy of the
  12 # GNU General Public License can be found in the file COPYING.
  13 # --- T2-COPYRIGHT-NOTE-END ---
  14
  15 ipv=
  16
  17 function ipt_addcode() {
  18         code="$4"
  19         ipv6code="${code/iptables/ip6tables}"
  20         ipv6code="${ipv6code//icmp/icmpv6}"
  21         ipv6code="${ipv6code/--icmpv6-type any/}"
  22         [ "$ipv" != "-6" ] && addcode $1 $2 $3 "$code"
  23         [ "$ipv" != "-4" ] && addcode $1 $2 $3 "$ipv6code"
  24 }
  25
  26 iptables_init_if() {
  27         if isfirst "iptables_$if"; then
  28                 ipv="" # always init ipv4/6 chains for now
  29                 # prepare INPUT
  30                 ipt_addcode up   1 1 "iptables -N firewall_$if"
  31                 ipt_addcode up   1 2 "iptables -A INPUT -i $if -m state --state ESTABLISHED,RELATED -j ACCEPT"
  32                 ipt_addcode up   1 3 "iptables -A INPUT -i $if -j firewall_$if"
  33
  34                 # prepare FORWARD
  35                 ipt_addcode up   1 1 "iptables -N forward_$if"
  36                 ipt_addcode up   1 2 "iptables -A FORWARD -i $if -m state --state ESTABLISHED,RELATED -j ACCEPT"
  37                 ipt_addcode up   1 3 "iptables -A FORWARD -i $if -j forward_$if"
  38
  39                 # clean INPUT
  40                 ipt_addcode down 1 3 "iptables -F firewall_$if"
  41                 ipt_addcode down 1 2 "iptables -D INPUT -i $if -j firewall_$if"
  42                 ipt_addcode down 1 2 "iptables -D INPUT -i $if -m state --state ESTABLISHED,RELATED -j ACCEPT"
  43                 ipt_addcode down 1 1 "iptables -X firewall_$if"
  44
  45                 # clean FORWARD
  46                 ipt_addcode down 1 3 "iptables -F forward_$if"
  47                 ipt_addcode down 1 2 "iptables -D FORWARD -i $if -j forward_$if"
  48                 ipt_addcode down 1 2 "iptables -D FORWARD -i $if -m state --state ESTABLISHED,RELATED -j ACCEPT"
  49                 ipt_addcode down 1 1 "iptables -X forward_$if"
  50         fi
  51 }
  52
  53 iptables_parse_conditions() {
  54         iptables_cond=""
  55         ipv=""
  56         [ "$1" == "-4" -o "$1" == "-6" ] && ipv="$1" && shift
  57         while [ -n "$1" ]; do
  58                 case "$1" in
  59                     all)
  60                         shift
  61                         ;;
  62                     tcp|udp)
  63                         iptables_cond="$iptables_cond -p $1 --dport $2"
  64                         shift; shift
  65                         ;;
  66                     icmp)
  67                         iptables_cond="$iptables_cond -p icmp --icmp-type $2"
  68                         shift; shift
  69                         ;;
  70                     ip)
  71                         iptables_cond="$iptables_cond -s $2"
  72                         shift; shift
  73                         ;;
  74                     *)
  75                         error "Unkown accept/reject/drop condition: $1"
  76                         shift
  77                 esac
  78         done
  79 }
  80
  81 public_accept() {
  82         iptables_parse_conditions "$@"
  83         ipt_addcode up 1 6 "iptables -A firewall_$if $iptables_cond -j ACCEPT"
  84         iptables_init_if
  85 }
  86
  87 public_reject() {
  88         iptables_parse_conditions "$@"
  89         ipt_addcode up 1 6 "iptables -A firewall_$if $iptables_cond -j REJECT"
  90         iptables_init_if
  91 }
  92
  93 public_drop() {
  94         iptables_parse_conditions "$@"
  95         ipt_addcode up 1 6 "iptables -A firewall_$if $iptables_cond -j DROP"
  96         iptables_init_if
  97 }
  98
  99 public_restrict() {
 100         iptables_parse_conditions "$@"
 101         ipt_addcode up 1 6 "iptables -A forward_$if $iptables_cond -j DROP"
 102         iptables_init_if
 103 }
 104
 105 public_iptables() {
 106         ipv=""
 107         [ "$1" == "-4" -o "$1" == "-6" ] && ipv="$1" && shift
 108         ipt_addcode up 1 6 "iptables $*"
 109         iptables_init_if
 110 }
 111
 112 public_iptables_down() {
 113         ipv=""
 114         [ "$1" == "-4" -o "$1" == "-6" ] && ipv="$1" && shift
 115         ipt_addcode down 1 6 "iptables $*"
 116         iptables_init_if
 117 }
 118
 119 public_conduit() {
 120         # conduit (tcp|udp) port targetip[:targetport]
 121         #
 122         local proto=$1 port=$2
 123         local targetip=$3 targetport=$2
 124
 125         if [ "${targetip/:/}" != "$targetip" ]; then
 126                 targetport=${targetip#*:}
 127                 targetip=${targetip%:*}
 128         fi
 129
 130         addcode up 1 4 "iptables -t nat -A PREROUTING -i $if -p $proto --dport $port -j DNAT --to $targetip:$targetport"
 131         addcode up 1 4 "iptables -A forward_$if  -p $proto -d $targetip --dport $targetport -j ACCEPT"
 132
 133         iptables_init_if
 134 }
 135
 136 public_clamp_mtu() {
 137         addcode up 1 1 "iptables -A FORWARD ${if:+-o $if} -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu"
 138         addcode down 9 1 "iptables -D FORWARD ${if:+-o $if} -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu"
 139 }
 140
 141 public_masquerade() {
 142         if [ "$ip" ]; then
 143                 addcode up   1 6 "iptables -t nat -A POSTROUTING ${1:+-s $1} -o $if -j SNAT --to $ip"
 144                 addcode down 9 6 "iptables -t nat -D POSTROUTING ${1:+-s $1} -o $if -j SNAT --to $ip"
 145         else
 146                 addcode up   1 6 "iptables -t nat -A POSTROUTING ${1:+-s $1} -o $if -j MASQUERADE"
 147                 addcode down 9 6 "iptables -t nat -D POSTROUTING ${1:+-s $1} -o $if -j MASQUERADE"
 148         fi
 149 }