Skip to content

Commit 2305e47

Browse files
Self-Hosting-GroupSelf-Hosting-Group
committed
miniupnpd: rearrange init and format firewall3.include
- Arrange `start_service` and main init functions first - Format `firewall3.include` using shfmt (to merge with prior) Signed-off-by: Self-Hosting-Group <[email protected]>
1 parent 53bde2f commit 2305e47

File tree

2 files changed

+100
-100
lines changed

2 files changed

+100
-100
lines changed

‎net/miniupnpd/files/firewall3.include‎

Lines changed: 22 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -20,36 +20,36 @@ iptables_prepend_rule() {
2020
local chain="$3"
2121
local target="$4"
2222

23-
$iptables "$IPTARGS" -t "$table" -I "$chain" $($iptables "$IPTARGS" -t "$table" --line-numbers -nL "$chain" | \
23+
$iptables "$IPTARGS" -t "$table" -I "$chain" $($iptables "$IPTARGS" -t "$table" --line-numbers -nL "$chain" |
2424
sed -ne '$s/[^0-9].*//p') -j "$target"
2525
}
2626

2727
ADDED=0
2828

2929
add_extzone_rules() {
30-
local ext_zone="$1"
31-
32-
[ -z "$ext_zone" ] && return
33-
34-
# IPv4 - due to NAT, need to add both to nat and filter table
35-
# need to insert as penultimate rule for input & forward & postrouting since final rule might be a fw3 REJECT
36-
iptables_prepend_rule "$IPTABLES" filter "zone_${ext_zone}_input" MINIUPNPD
37-
iptables_prepend_rule "$IPTABLES" filter "zone_${ext_zone}_forward" MINIUPNPD
38-
$IPTABLES -t nat -A "zone_${ext_zone}_prerouting" -j MINIUPNPD
39-
iptables_prepend_rule "$IPTABLES" nat "zone_${ext_zone}_postrouting" MINIUPNPD-POSTROUTING
40-
41-
# IPv6 if available - filter only
42-
[ -x $IP6TABLES ] && {
43-
iptables_prepend_rule "$IP6TABLES" filter "zone_${ext_zone}_input" MINIUPNPD
44-
iptables_prepend_rule "$IP6TABLES" filter "zone_${ext_zone}_forward" MINIUPNPD
45-
}
46-
ADDED=$(($ADDED + 1))
30+
local ext_zone="$1"
31+
32+
[ -z "$ext_zone" ] && return
33+
34+
# IPv4 - due to NAT, need to add both to nat and filter table
35+
# need to insert as penultimate rule for input & forward & postrouting since final rule might be a fw3 REJECT
36+
iptables_prepend_rule "$IPTABLES" filter "zone_${ext_zone}_input" MINIUPNPD
37+
iptables_prepend_rule "$IPTABLES" filter "zone_${ext_zone}_forward" MINIUPNPD
38+
$IPTABLES -t nat -A "zone_${ext_zone}_prerouting" -j MINIUPNPD
39+
iptables_prepend_rule "$IPTABLES" nat "zone_${ext_zone}_postrouting" MINIUPNPD-POSTROUTING
40+
41+
# IPv6 if available - filter only
42+
[ -x $IP6TABLES ] && {
43+
iptables_prepend_rule "$IP6TABLES" filter "zone_${ext_zone}_input" MINIUPNPD
44+
iptables_prepend_rule "$IP6TABLES" filter "zone_${ext_zone}_forward" MINIUPNPD
45+
}
46+
ADDED=$(($ADDED + 1))
4747
}
4848

4949
# By default, user configuration is king.
5050

5151
for ext_iface in $(uci -q get upnpd.settings.external_iface); do
52-
add_extzone_rules $(fw3 -q network "$ext_iface")
52+
add_extzone_rules $(fw3 -q network "$ext_iface")
5353
done
5454

5555
add_extzone_rules $(uci -q get upnpd.settings.external_zone)
@@ -66,7 +66,7 @@ network_find_wan wan_iface
6666
network_find_wan6 wan6_iface
6767

6868
for ext_iface in $wan_iface $wan6_iface; do
69-
# fw3 -q network fails on sub-interfaces => map to device first
70-
network_get_device ext_device $ext_iface
71-
add_extzone_rules $(fw3 -q device "$ext_device")
69+
# fw3 -q network fails on sub-interfaces => map to device first
70+
network_get_device ext_device $ext_iface
71+
add_extzone_rules $(fw3 -q device "$ext_device")
7272
done

‎net/miniupnpd/files/miniupnpd.init‎

Lines changed: 78 additions & 78 deletions
Original file line numberDiff line numberDiff line change
@@ -7,34 +7,56 @@ USE_PROCD=1
77
PROG=/usr/sbin/miniupnpd
88
[ -x "$(command -v nft)" ] && FW="fw4" || FW="fw3"
99

10-
is_port_or_range() {
11-
[ "$1" = "0" ] && return 1
12-
[ "$1" -ge "1" ] 2>/dev/null && [ "$1" -le "65535" ] 2>/dev/null && return 0
13-
[ "$2" = "port0inrange" ] && local minport=0 || local minport=1
14-
[ "${1%%-*}" -ge "$minport" ] 2>/dev/null && [ "${1%%-*}" -le "65535" ] 2>/dev/null &&
15-
[ "${1##*-}" -ge "$minport" ] 2>/dev/null && [ "${1##*-}" -le "65535" ] 2>/dev/null &&
16-
[ "${1##*-}" -ge "${1%%-*}" ] 2>/dev/null && return 0 || return 1
10+
start_service() {
11+
config_load "upnpd"
12+
local enabled config_file log_output conf
13+
config_get enabled settings enabled 0
14+
config_get config_file settings config_file
15+
config_get log_output settings log_output
16+
if [ "$enabled" != "1" ]; then
17+
log "Service disabled, UCI enabled is not set"
18+
return 1
19+
fi
20+
21+
if [ -n "$config_file" ]; then
22+
conf="$config_file"
23+
else
24+
local tmpconf="/var/etc/miniupnpd.conf"
25+
conf="$tmpconf"
26+
mkdir -p /var/etc
27+
upnpd_generate_config "$tmpconf" || return 1
28+
fi
29+
30+
if [ "$FW" = "fw4" ]; then
31+
nft -s -t -n list chain inet fw4 upnp_forward >/dev/null 2>&1 || fw4 reload
32+
else
33+
iptables -L MINIUPNPD >/dev/null 2>&1 || fw3 reload
34+
fi
35+
36+
procd_open_instance
37+
procd_set_param file "$conf"
38+
procd_set_param command "$PROG"
39+
procd_append_param command -f "$conf"
40+
[ "$log_output" = "info" ] && procd_append_param command -v
41+
[ "$log_output" = "debug" ] && procd_append_param command -d
42+
procd_close_instance
1743
}
1844

19-
upnpd_add_custom_acl_entry() {
20-
local cfg="$1"
21-
local comment int_addr int_port ext_port descr_filter action
22-
config_get comment "$cfg" comment "unspecified" # comment
23-
config_get int_addr "$cfg" int_addr "0.0.0.0/0" # IPv4 or network and subnet mask (internal)
24-
config_get int_port "$cfg" int_port "1-65535" # internal port/range: x or x-y
25-
config_get ext_port "$cfg" ext_port "1-65535" # external port/range: x or x-y
26-
config_get descr_filter "$cfg" descr_filter # description regex filter (must be built in)
27-
config_get action "$cfg" action # accept/reject/ignore
28-
! is_port_or_range "$int_port" port0inrange &&
29-
log "Custom ACL: Entry with invalid port or port range ($int_port) in int_port ignored" daemon.warn && int_port=1-65535
30-
! is_port_or_range "$ext_port" port0inrange &&
31-
log "Custom ACL: Entry with invalid port or port range ($ext_port) in ext_port ignored" daemon.warn && ext_port=1-65535
32-
[ "$descr_filter" != "" ] && descr_filter=" \"$descr_filter\""
33-
[ "$action" = "accept" ] && action=allow
34-
[ "$action" = "reject" ] && action=deny
35-
[ "$action" = "ignore" ] && return 0
36-
[ "$action" = "" ] && log "Custom ACL: Entry with no action ignored" daemon.warn && return 0
37-
echo "$action $ext_port $int_addr $int_port${descr_filter} # $comment"
45+
stop_service() {
46+
if [ "$FW" = "fw3" ]; then
47+
iptables -t filter -F MINIUPNPD 2>/dev/null
48+
[ -x /usr/sbin/ip6tables ] && ip6tables -t filter -F MINIUPNPD 2>/dev/null
49+
iptables -t nat -F MINIUPNPD 2>/dev/null
50+
iptables -t nat -F MINIUPNPD-POSTROUTING 2>/dev/null
51+
else
52+
nft flush chain inet fw4 upnp_forward 2>/dev/null
53+
nft flush chain inet fw4 upnp_prerouting 2>/dev/null
54+
nft flush chain inet fw4 upnp_postrouting 2>/dev/null
55+
fi
56+
}
57+
58+
service_triggers() {
59+
procd_add_reload_trigger "upnpd" "firewall"
3860
}
3961

4062
upnpd_generate_config() {
@@ -166,58 +188,6 @@ upnpd_generate_config() {
166188
} >"$1"
167189
}
168190

169-
stop_service() {
170-
if [ "$FW" = "fw3" ]; then
171-
iptables -t filter -F MINIUPNPD 2>/dev/null
172-
[ -x /usr/sbin/ip6tables ] && ip6tables -t filter -F MINIUPNPD 2>/dev/null
173-
iptables -t nat -F MINIUPNPD 2>/dev/null
174-
iptables -t nat -F MINIUPNPD-POSTROUTING 2>/dev/null
175-
else
176-
nft flush chain inet fw4 upnp_forward 2>/dev/null
177-
nft flush chain inet fw4 upnp_prerouting 2>/dev/null
178-
nft flush chain inet fw4 upnp_postrouting 2>/dev/null
179-
fi
180-
}
181-
182-
start_service() {
183-
config_load "upnpd"
184-
local enabled config_file log_output conf
185-
config_get enabled settings enabled 0
186-
config_get config_file settings config_file
187-
config_get log_output settings log_output
188-
if [ "$enabled" != "1" ]; then
189-
log "Service disabled, UCI enabled is not set"
190-
return 1
191-
fi
192-
193-
if [ -n "$config_file" ]; then
194-
conf="$config_file"
195-
else
196-
local tmpconf="/var/etc/miniupnpd.conf"
197-
conf="$tmpconf"
198-
mkdir -p /var/etc
199-
upnpd_generate_config "$tmpconf" || return 1
200-
fi
201-
202-
if [ "$FW" = "fw4" ]; then
203-
nft -s -t -n list chain inet fw4 upnp_forward >/dev/null 2>&1 || fw4 reload
204-
else
205-
iptables -L MINIUPNPD >/dev/null 2>&1 || fw3 reload
206-
fi
207-
208-
procd_open_instance
209-
procd_set_param file "$conf"
210-
procd_set_param command "$PROG"
211-
procd_append_param command -f "$conf"
212-
[ "$log_output" = "info" ] && procd_append_param command -v
213-
[ "$log_output" = "debug" ] && procd_append_param command -d
214-
procd_close_instance
215-
}
216-
217-
service_triggers() {
218-
procd_add_reload_trigger "upnpd" "firewall"
219-
}
220-
221191
log() {
222192
logger -s -p "${2:-daemon.notice}" -t "upnpd" "$1" || echo "upnpd: $1" >&2
223193
}
@@ -227,6 +197,15 @@ xml_encode() {
227197
echo "$1" | sed "s/&/\&amp;/g; s/</\&lt;/g; s/>/\&gt;/g"
228198
}
229199

200+
is_port_or_range() {
201+
[ "$1" = "0" ] && return 1
202+
[ "$1" -ge "1" ] 2>/dev/null && [ "$1" -le "65535" ] 2>/dev/null && return 0
203+
[ "$2" = "port0inrange" ] && local minport=0 || local minport=1
204+
[ "${1%%-*}" -ge "$minport" ] 2>/dev/null && [ "${1%%-*}" -le "65535" ] 2>/dev/null &&
205+
[ "${1##*-}" -ge "$minport" ] 2>/dev/null && [ "${1##*-}" -le "65535" ] 2>/dev/null &&
206+
[ "${1##*-}" -ge "${1%%-*}" ] 2>/dev/null && return 0 || return 1
207+
}
208+
230209
upnpd_add_int_network_and_preset() {
231210
local cfg="$1"
232211
local interface access_preset accept_ports reject_ports custom_acl_before
@@ -271,3 +250,24 @@ upnpd_add_int_network_and_preset() {
271250
echo "deny 1-65535 $subnet 1-65535 # Reject ACL by default on $interface"
272251
fi
273252
}
253+
254+
upnpd_add_custom_acl_entry() {
255+
local cfg="$1"
256+
local comment int_addr int_port ext_port descr_filter action
257+
config_get comment "$cfg" comment "unspecified" # comment
258+
config_get int_addr "$cfg" int_addr "0.0.0.0/0" # IPv4 or network and subnet mask (internal)
259+
config_get int_port "$cfg" int_port "1-65535" # internal port/range: x or x-y
260+
config_get ext_port "$cfg" ext_port "1-65535" # external port/range: x or x-y
261+
config_get descr_filter "$cfg" descr_filter # description regex filter (must be built in)
262+
config_get action "$cfg" action # accept/reject/ignore
263+
! is_port_or_range "$int_port" port0inrange &&
264+
log "Custom ACL: Entry with invalid port or port range ($int_port) in int_port ignored" daemon.warn && int_port=1-65535
265+
! is_port_or_range "$ext_port" port0inrange &&
266+
log "Custom ACL: Entry with invalid port or port range ($ext_port) in ext_port ignored" daemon.warn && ext_port=1-65535
267+
[ "$descr_filter" != "" ] && descr_filter=" \"$descr_filter\""
268+
[ "$action" = "accept" ] && action=allow
269+
[ "$action" = "reject" ] && action=deny
270+
[ "$action" = "ignore" ] && return 0
271+
[ "$action" = "" ] && log "Custom ACL: Entry with no action ignored" daemon.warn && return 0
272+
echo "$action $ext_port $int_addr $int_port${descr_filter} # $comment"
273+
}

0 commit comments

Comments
 (0)