You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

104 lines
2.7 KiB

  1. #!/bin/sh
  2. # BCP38 filtering implementation for CeroWrt.
  3. #
  4. # This program is free software; you can redistribute it and/or modify it under
  5. # the terms of the GNU General Public License as published by the Free Software
  6. # Foundation; either version 3 of the License, or (at your option) any later
  7. # version.
  8. #
  9. # Author: Toke Høiland-Jørgensen <toke@toke.dk>
  10. STOP=$1
  11. IPSET_NAME=bcp38-ipv4
  12. IPTABLES_CHAIN=BCP38
  13. . /lib/functions.sh
  14. config_load bcp38
  15. add_bcp38_rule()
  16. {
  17. local subnet="$1"
  18. local action="$2"
  19. if [ "$action" == "nomatch" ]; then
  20. ipset add "$IPSET_NAME" "$subnet" nomatch
  21. else
  22. ipset add "$IPSET_NAME" "$subnet"
  23. fi
  24. }
  25. detect_upstream()
  26. {
  27. local interface="$1"
  28. subnets=$(ip route show dev "$interface" | grep 'scope link' | awk '{print $1}')
  29. for subnet in $subnets; do
  30. # ipset test doesn't work for subnets, so strip out the subnet part
  31. # and test for that; add as exception if there's a match
  32. addr=$(echo $subnet | sed 's|/[0-9]\+$||')
  33. ipset test "$IPSET_NAME" $addr 2>/dev/null && add_bcp38_rule $subnet nomatch
  34. done
  35. }
  36. run() {
  37. local section="$1"
  38. local enabled
  39. local interface
  40. local detect_upstream
  41. config_get_bool enabled "$section" enabled 0
  42. config_get interface "$section" interface
  43. config_get detect_upstream "$section" detect_upstream
  44. if [ "$enabled" -eq "1" -a -n "$interface" -a -z "$STOP" ] ; then
  45. setup_ipset
  46. setup_iptables "$interface"
  47. config_list_foreach "$section" match add_bcp38_rule match
  48. config_list_foreach "$section" nomatch add_bcp38_rule nomatch
  49. [ "$detect_upstream" -eq "1" ] && detect_upstream "$interface"
  50. fi
  51. exit 0
  52. }
  53. setup_ipset()
  54. {
  55. ipset create "$IPSET_NAME" hash:net family ipv4
  56. ipset flush "$IPSET_NAME"
  57. }
  58. setup_iptables()
  59. {
  60. local interface="$1"
  61. iptables -N "$IPTABLES_CHAIN" 2>/dev/null
  62. iptables -F "$IPTABLES_CHAIN" 2>/dev/null
  63. iptables -I output_rule -j "$IPTABLES_CHAIN"
  64. iptables -I input_rule -j "$IPTABLES_CHAIN"
  65. iptables -I forwarding_rule -j "$IPTABLES_CHAIN"
  66. # always accept DHCP traffic
  67. iptables -A "$IPTABLES_CHAIN" -p udp --dport 67:68 --sport 67:68 -j RETURN
  68. iptables -A "$IPTABLES_CHAIN" -o "$interface" -m set --match-set "$IPSET_NAME" dst -j REJECT --reject-with icmp-net-unreachable
  69. iptables -A "$IPTABLES_CHAIN" -i "$interface" -m set --match-set "$IPSET_NAME" src -j DROP
  70. }
  71. destroy_ipset()
  72. {
  73. ipset flush "$IPSET_NAME" 2>/dev/null
  74. ipset destroy "$IPSET_NAME" 2>/dev/null
  75. }
  76. destroy_iptables()
  77. {
  78. iptables -D output_rule -j "$IPTABLES_CHAIN" 2>/dev/null
  79. iptables -D input_rule -j "$IPTABLES_CHAIN" 2>/dev/null
  80. iptables -D forwarding_rule -j "$IPTABLES_CHAIN" 2>/dev/null
  81. iptables -F "$IPTABLES_CHAIN" 2>/dev/null
  82. iptables -X "$IPTABLES_CHAIN" 2>/dev/null
  83. }
  84. destroy_iptables
  85. destroy_ipset
  86. config_foreach run bcp38
  87. exit 0