Skip to content

Commit cdd870f

Browse files
Self-Hosting-GroupSelf-Hosting-Group
committed
miniupnpd: rearrange init and format firewall3.include
- Arrange `start_service` and main init functions first - Format `firewall3.include` using shfmt (to merge with prior) Signed-off-by: Self-Hosting-Group <[email protected]>
1 parent e33b340 commit cdd870f

File tree

2 files changed

+99
-99
lines changed

2 files changed

+99
-99
lines changed

‎net/miniupnpd/files/firewall3.include‎

Lines changed: 22 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -20,36 +20,36 @@ iptables_prepend_rule() {
2020
local chain="$3"
2121
local target="$4"
2222

23-
$iptables "$IPTARGS" -t "$table" -I "$chain" $($iptables "$IPTARGS" -t "$table" --line-numbers -nL "$chain" | \
23+
$iptables "$IPTARGS" -t "$table" -I "$chain" $($iptables "$IPTARGS" -t "$table" --line-numbers -nL "$chain" |
2424
sed -ne '$s/[^0-9].*//p') -j "$target"
2525
}
2626

2727
ADDED=0
2828

2929
add_extzone_rules() {
30-
local ext_zone="$1"
31-
32-
[ -z "$ext_zone" ] && return
33-
34-
# IPv4 - due to NAT, need to add both to nat and filter table
35-
# need to insert as penultimate rule for input & forward & postrouting since final rule might be a fw3 REJECT
36-
iptables_prepend_rule "$IPTABLES" filter "zone_${ext_zone}_input" MINIUPNPD
37-
iptables_prepend_rule "$IPTABLES" filter "zone_${ext_zone}_forward" MINIUPNPD
38-
$IPTABLES -t nat -A "zone_${ext_zone}_prerouting" -j MINIUPNPD
39-
iptables_prepend_rule "$IPTABLES" nat "zone_${ext_zone}_postrouting" MINIUPNPD-POSTROUTING
40-
41-
# IPv6 if available - filter only
42-
[ -x $IP6TABLES ] && {
43-
iptables_prepend_rule "$IP6TABLES" filter "zone_${ext_zone}_input" MINIUPNPD
44-
iptables_prepend_rule "$IP6TABLES" filter "zone_${ext_zone}_forward" MINIUPNPD
45-
}
46-
ADDED=$(($ADDED + 1))
30+
local ext_zone="$1"
31+
32+
[ -z "$ext_zone" ] && return
33+
34+
# IPv4 - due to NAT, need to add both to nat and filter table
35+
# need to insert as penultimate rule for input & forward & postrouting since final rule might be a fw3 REJECT
36+
iptables_prepend_rule "$IPTABLES" filter "zone_${ext_zone}_input" MINIUPNPD
37+
iptables_prepend_rule "$IPTABLES" filter "zone_${ext_zone}_forward" MINIUPNPD
38+
$IPTABLES -t nat -A "zone_${ext_zone}_prerouting" -j MINIUPNPD
39+
iptables_prepend_rule "$IPTABLES" nat "zone_${ext_zone}_postrouting" MINIUPNPD-POSTROUTING
40+
41+
# IPv6 if available - filter only
42+
[ -x $IP6TABLES ] && {
43+
iptables_prepend_rule "$IP6TABLES" filter "zone_${ext_zone}_input" MINIUPNPD
44+
iptables_prepend_rule "$IP6TABLES" filter "zone_${ext_zone}_forward" MINIUPNPD
45+
}
46+
ADDED=$(($ADDED + 1))
4747
}
4848

4949
# By default, user configuration is king.
5050

5151
for ext_iface in $(uci -q get upnpd.settings.external_iface); do
52-
add_extzone_rules $(fw3 -q network "$ext_iface")
52+
add_extzone_rules $(fw3 -q network "$ext_iface")
5353
done
5454

5555
add_extzone_rules $(uci -q get upnpd.settings.external_zone)
@@ -66,7 +66,7 @@ network_find_wan wan_iface
6666
network_find_wan6 wan6_iface
6767

6868
for ext_iface in $wan_iface $wan6_iface; do
69-
# fw3 -q network fails on sub-interfaces => map to device first
70-
network_get_device ext_device $ext_iface
71-
add_extzone_rules $(fw3 -q device "$ext_device")
69+
# fw3 -q network fails on sub-interfaces => map to device first
70+
network_get_device ext_device $ext_iface
71+
add_extzone_rules $(fw3 -q device "$ext_device")
7272
done

‎net/miniupnpd/files/miniupnpd.init‎

Lines changed: 77 additions & 77 deletions
Original file line numberDiff line numberDiff line change
@@ -7,34 +7,55 @@ USE_PROCD=1
77
PROG=/usr/sbin/miniupnpd
88
[ -x "$(command -v nft)" ] && FW="fw4" || FW="fw3"
99

10-
is_port_or_range() {
11-
[ "$1" = "0" ] && return 1
12-
[ "$1" -ge "1" ] 2>/dev/null && [ "$1" -le "65535" ] 2>/dev/null && return 0
13-
[ "$2" = "port0inrange" ] && local minport=0 || local minport=1
14-
[ "${1%%-*}" -ge "$minport" ] 2>/dev/null && [ "${1%%-*}" -le "65535" ] 2>/dev/null &&
15-
[ "${1##*-}" -ge "$minport" ] 2>/dev/null && [ "${1##*-}" -le "65535" ] 2>/dev/null &&
16-
[ "${1##*-}" -ge "${1%%-*}" ] 2>/dev/null && return 0 || return 1
10+
start_service() {
11+
upnpd_uci_migration
12+
config_load "upnpd"
13+
local enabled config_file log_output conf
14+
config_get enabled settings enabled 0
15+
config_get config_file settings config_file
16+
config_get log_output settings log_output
17+
if [ "$enabled" != "1" ]; then
18+
log "Service disabled, UCI enabled is not set"
19+
return 1
20+
fi
21+
if [ -n "$config_file" ]; then
22+
conf="$config_file"
23+
else
24+
local tmpconf="/var/etc/miniupnpd.conf"
25+
conf="$tmpconf"
26+
mkdir -p /var/etc
27+
upnpd_generate_config "$tmpconf" || return 1
28+
fi
29+
if [ "$FW" = "fw4" ]; then
30+
nft -s -t -n list chain inet fw4 upnp_forward >/dev/null 2>&1 || fw4 reload
31+
else
32+
iptables -L MINIUPNPD >/dev/null 2>&1 || fw3 reload
33+
fi
34+
35+
procd_open_instance
36+
procd_set_param file "$conf"
37+
procd_set_param command "$PROG"
38+
procd_append_param command -f "$conf"
39+
[ "$log_output" = "info" ] && procd_append_param command -v
40+
[ "$log_output" = "debug" ] && procd_append_param command -d
41+
procd_close_instance
1742
}
1843

19-
upnpd_add_custom_acl_entry() {
20-
local cfg="$1"
21-
local comment int_addr int_port ext_port descr_filter action
22-
config_get comment "$cfg" comment "unspecified" # comment
23-
config_get int_addr "$cfg" int_addr "0.0.0.0/0" # IPv4 or network and subnet mask (internal)
24-
config_get int_port "$cfg" int_port "1-65535" # internal port/range: x or x-y
25-
config_get ext_port "$cfg" ext_port "1-65535" # external port/range: x or x-y
26-
config_get descr_filter "$cfg" descr_filter # description regex filter (must be built in)
27-
config_get action "$cfg" action # accept/reject/ignore
28-
! is_port_or_range "$int_port" port0inrange &&
29-
log "Custom ACL: Entry with invalid port or port range ($int_port) in int_port ignored" daemon.warn && int_port=1-65535
30-
! is_port_or_range "$ext_port" port0inrange &&
31-
log "Custom ACL: Entry with invalid port or port range ($ext_port) in ext_port ignored" daemon.warn && ext_port=1-65535
32-
[ "$descr_filter" != "" ] && descr_filter=" \"$descr_filter\""
33-
[ "$action" = "accept" ] && action=allow
34-
[ "$action" = "reject" ] && action=deny
35-
[ "$action" = "ignore" ] && return 0
36-
[ "$action" = "" ] && log "Custom ACL: Entry with no action ignored" daemon.warn && return 0
37-
echo "$action $ext_port $int_addr $int_port${descr_filter} # $comment"
44+
stop_service() {
45+
if [ "$FW" = "fw3" ]; then
46+
iptables -t filter -F MINIUPNPD 2>/dev/null
47+
[ -x /usr/sbin/ip6tables ] && ip6tables -t filter -F MINIUPNPD 2>/dev/null
48+
iptables -t nat -F MINIUPNPD 2>/dev/null
49+
iptables -t nat -F MINIUPNPD-POSTROUTING 2>/dev/null
50+
else
51+
nft flush chain inet fw4 upnp_forward 2>/dev/null
52+
nft flush chain inet fw4 upnp_prerouting 2>/dev/null
53+
nft flush chain inet fw4 upnp_postrouting 2>/dev/null
54+
fi
55+
}
56+
57+
service_triggers() {
58+
procd_add_reload_trigger "upnpd" "firewall"
3859
}
3960

4061
upnpd_generate_config() {
@@ -166,57 +187,6 @@ upnpd_generate_config() {
166187
} >"$1"
167188
}
168189

169-
stop_service() {
170-
if [ "$FW" = "fw3" ]; then
171-
iptables -t nat -F MINIUPNPD 2>/dev/null
172-
iptables -t nat -F MINIUPNPD-POSTROUTING 2>/dev/null
173-
iptables -t filter -F MINIUPNPD 2>/dev/null
174-
[ -x /usr/sbin/ip6tables ] && ip6tables -t filter -F MINIUPNPD 2>/dev/null
175-
else
176-
nft flush chain inet fw4 upnp_forward 2>/dev/null
177-
nft flush chain inet fw4 upnp_prerouting 2>/dev/null
178-
nft flush chain inet fw4 upnp_postrouting 2>/dev/null
179-
fi
180-
}
181-
182-
start_service() {
183-
upnpd_uci_migration
184-
config_load "upnpd"
185-
local enabled config_file log_output conf
186-
config_get enabled settings enabled 0
187-
config_get config_file settings config_file
188-
config_get log_output settings log_output
189-
if [ "$enabled" != "1" ]; then
190-
log "Service disabled, UCI enabled is not set"
191-
return 1
192-
fi
193-
if [ -n "$config_file" ]; then
194-
conf="$config_file"
195-
else
196-
local tmpconf="/var/etc/miniupnpd.conf"
197-
conf="$tmpconf"
198-
mkdir -p /var/etc
199-
upnpd_generate_config "$tmpconf" || return 1
200-
fi
201-
if [ "$FW" = "fw4" ]; then
202-
nft -s -t -n list chain inet fw4 upnp_forward >/dev/null 2>&1 || fw4 reload
203-
else
204-
iptables -L MINIUPNPD >/dev/null 2>&1 || fw3 reload
205-
fi
206-
207-
procd_open_instance
208-
procd_set_param file "$conf"
209-
procd_set_param command "$PROG"
210-
procd_append_param command -f "$conf"
211-
[ "$log_output" = "info" ] && procd_append_param command -v
212-
[ "$log_output" = "debug" ] && procd_append_param command -d
213-
procd_close_instance
214-
}
215-
216-
service_triggers() {
217-
procd_add_reload_trigger "upnpd" "firewall"
218-
}
219-
220190
log() {
221191
logger -s -p "${2:-daemon.notice}" -t "upnpd" "$1" || echo "upnpd: $1" >&2
222192
}
@@ -226,6 +196,15 @@ xml_encode() {
226196
echo "$1" | sed "s/&/\&amp;/g; s/</\&lt;/g; s/>/\&gt;/g"
227197
}
228198

199+
is_port_or_range() {
200+
[ "$1" = "0" ] && return 1
201+
[ "$1" -ge "1" ] 2>/dev/null && [ "$1" -le "65535" ] 2>/dev/null && return 0
202+
[ "$2" = "port0inrange" ] && local minport=0 || local minport=1
203+
[ "${1%%-*}" -ge "$minport" ] 2>/dev/null && [ "${1%%-*}" -le "65535" ] 2>/dev/null &&
204+
[ "${1##*-}" -ge "$minport" ] 2>/dev/null && [ "${1##*-}" -le "65535" ] 2>/dev/null &&
205+
[ "${1##*-}" -ge "${1%%-*}" ] 2>/dev/null && return 0 || return 1
206+
}
207+
229208
upnpd_add_int_network_and_preset() {
230209
local cfg="$1"
231210
local interface access_preset accept_ports reject_ports custom_acl_before
@@ -271,6 +250,27 @@ upnpd_add_int_network_and_preset() {
271250
fi
272251
}
273252

253+
upnpd_add_custom_acl_entry() {
254+
local cfg="$1"
255+
local comment int_addr int_port ext_port descr_filter action
256+
config_get comment "$cfg" comment "unspecified" # comment
257+
config_get int_addr "$cfg" int_addr "0.0.0.0/0" # IPv4 or network and subnet mask (internal)
258+
config_get int_port "$cfg" int_port "1-65535" # internal port/range: x or x-y
259+
config_get ext_port "$cfg" ext_port "1-65535" # external port/range: x or x-y
260+
config_get descr_filter "$cfg" descr_filter # description regex filter (must be built in)
261+
config_get action "$cfg" action # accept/reject/ignore
262+
! is_port_or_range "$int_port" port0inrange &&
263+
log "Custom ACL: Entry with invalid port or port range ($int_port) in int_port ignored" daemon.warn && int_port=1-65535
264+
! is_port_or_range "$ext_port" port0inrange &&
265+
log "Custom ACL: Entry with invalid port or port range ($ext_port) in ext_port ignored" daemon.warn && ext_port=1-65535
266+
[ "$descr_filter" != "" ] && descr_filter=" \"$descr_filter\""
267+
[ "$action" = "accept" ] && action=allow
268+
[ "$action" = "reject" ] && action=deny
269+
[ "$action" = "ignore" ] && return 0
270+
[ "$action" = "" ] && log "Custom ACL: Entry with no action ignored" daemon.warn && return 0
271+
echo "$action $ext_port $int_addr $int_port${descr_filter} # $comment"
272+
}
273+
274274
upnpd_uci_migration() {
275275
{ uci -q get upnpd.settings >/dev/null || ! uci -q get upnpd.config >/dev/null; } && return 0
276276
log "Check UCI options in /etc/config/upnpd to be migrated to v2.0"

0 commit comments

Comments
 (0)