[net] miniupnpd: Added uci setting of allow/deny rules, amongst other things. This involved switching to the use of /var/etc/miniupnpd.conf that is generated on the fly, instead of command-line parameters.
git-svn-id: svn://svn.openwrt.org/openwrt/packages@25953 3c298f89-4303-0410-b956-a3cf2f4a3e73
This commit is contained in:
cshore
parent
9603746203
commit
a5d6c75e01
@ -49,7 +49,9 @@ define Package/miniupnpd/install
|
||||
$(INSTALL_CONF) ./files/upnpd.config $(1)/etc/config/upnpd
|
||||
$(INSTALL_DATA) ./files/miniupnpd.iface.hotplug $(1)/etc/hotplug.d/iface/50-miniupnpd
|
||||
$(INSTALL_DATA) ./files/miniupnpd.firewall.hotplug $(1)/etc/hotplug.d/firewall/50-miniupnpd
|
||||
$(INSTALL_DATA) $(PKG_BUILD_DIR)/miniupnpd.conf $(1)/etc/miniupnpd.conf.example
|
||||
$(INSTALL_DIR) $(1)/usr/share/miniupnpd
|
||||
$(INSTALL_DATA) $(PKG_BUILD_DIR)/miniupnpd.conf $(1)/usr/share/miniupnpd/miniupnpd.conf.example
|
||||
$(INSTALL_DATA) ./files/upnpd.config.example $(1)/etc/config/upnpd.example
|
||||
endef
|
||||
|
||||
$(eval $(call BuildPackage,miniupnpd))
|
||||
|
||||
@ -1,6 +1,50 @@
|
||||
#!/bin/sh /etc/rc.common
|
||||
START=95
|
||||
|
||||
upnpd_get_port_range() {
|
||||
local _var="$1"; shift
|
||||
local _val
|
||||
|
||||
config_get _val "$@"
|
||||
|
||||
case "$_val" in
|
||||
[0-9]*[:-][0-9]*)
|
||||
export -n -- "${_var}_start=${_val%%[:-]*}"
|
||||
export -n -- "${_var}_end=${_val##*[:-]}"
|
||||
;;
|
||||
[0-9]*)
|
||||
export -n -- "${_var}_start=$_val"
|
||||
export -n -- "${_var}_end="
|
||||
;;
|
||||
esac
|
||||
}
|
||||
|
||||
conf_rule_add() {
|
||||
local cfg="$1"
|
||||
local tmpconf="$2"
|
||||
local action external_port_start external_port_end ip_mask
|
||||
local internal_port_start internal_port_end
|
||||
config_get action "$cfg" action "deny" # allow or deny
|
||||
upnpd_get_port_range "ext" "$cfg" ext_ports "0-65535" # external ports: x, x-y, x:y
|
||||
config_get int_addr "$cfg" int_addr "0.0.0.0/0" # ip or network and subnet mask (internal)
|
||||
upnpd_get_port_range "int" "$cfg" int_ports "0-65535" # internal ports: x, x-y, x:y or range
|
||||
echo "${action} ${ext_start}${ext_end:+-}${ext_end} ${int_addr} ${int_start}${int_end:+-}${int_end}" >>$tmpconf
|
||||
}
|
||||
|
||||
upnpd_write_bool() {
|
||||
local opt="$1"
|
||||
local def="${2:-0}"
|
||||
local alt="$3"
|
||||
|
||||
local val
|
||||
config_get_bool val config "$opt" "$def"
|
||||
if [ "$val" -eq 0 ]; then
|
||||
echo "${alt:-$opt}=no" >> $tmpconf
|
||||
else
|
||||
echo "${alt:-$opt}=yes" >> $tmpconf
|
||||
fi
|
||||
}
|
||||
|
||||
start() {
|
||||
type miniupnpd_add_rules >/dev/null 2>/dev/null || \
|
||||
ACTION=- . /etc/hotplug.d/firewall/50-miniupnpd
|
||||
@ -8,7 +52,8 @@ start() {
|
||||
config_load "upnpd"
|
||||
local extiface intiface upload download logging secure enabled natpmp
|
||||
local extip port usesysuptime conffile serial_number model_number
|
||||
local uuid notify_interval presentation_url
|
||||
local uuid notify_interval presentation_url enable_upnp
|
||||
local upnp_lease_file clean_ruleset_threshold clean_ruleset_interval
|
||||
|
||||
config_get extiface config external_iface
|
||||
config_get intiface config internal_iface
|
||||
@ -17,86 +62,106 @@ start() {
|
||||
config_get upload config upload
|
||||
config_get download config download
|
||||
config_get_bool logging config log_output 0
|
||||
config_get_bool secure config secure_mode 0
|
||||
config_get_bool natpmp config enable_natpmp 0
|
||||
config_get_bool enabled config enabled 0
|
||||
config_get_bool usesysuptime config use_system_uptime 1
|
||||
config_get conffile config config_file
|
||||
config_get serial_number config serial_number
|
||||
config_get model_number config model_number
|
||||
config_get uuid config uuid
|
||||
config_get notify_interval config notify_interval
|
||||
config_get presentation_url config presentation_url
|
||||
config_get upnp_lease_file config upnp_lease_file
|
||||
config_get clean_ruleset_threshold config clean_ruleset_threshold
|
||||
config_get clean_ruleset_interval config clean_ruleset_interval
|
||||
|
||||
local args
|
||||
|
||||
include /lib/network
|
||||
scan_interfaces
|
||||
|
||||
local ifname
|
||||
config_get ifname ${extiface:-wan} ifname
|
||||
|
||||
if [ -n "$conffile" ]; then
|
||||
args="-f $conffile"
|
||||
else
|
||||
local tmpconf="/var/etc/miniupnpd.conf"
|
||||
args="-f $tmpconf"
|
||||
mkdir -p /var/etc
|
||||
|
||||
echo "ext_ifname=$ifname" >$tmpconf
|
||||
|
||||
local iface
|
||||
|
||||
[ -n "$extip" ] && \
|
||||
echo "ext_ip=$extip" >>$tmpconf
|
||||
|
||||
for iface in ${intiface:-lan}; do
|
||||
local ipaddr
|
||||
config_get ipaddr "$iface" ipaddr
|
||||
[ -n "$ipaddr" ] && \
|
||||
echo "listening_ip=$ipaddr" >>$tmpconf
|
||||
done
|
||||
|
||||
[ "$port" != "auto" ] && \
|
||||
echo "port=$port" >>$tmpconf
|
||||
|
||||
config_load "upnpd"
|
||||
upnpd_write_bool enable_natpmp 1
|
||||
upnpd_write_bool enable_upnp 1
|
||||
upnpd_write_bool enable_secure 1 secure_mode
|
||||
upnpd_write_bool system_uptime 1
|
||||
|
||||
[ -n "$upnp_lease_file" ] && \
|
||||
echo "lease_file=$upnp_lease_file" >>$tmpconf
|
||||
|
||||
[ -n "$upload" -a -n "$download" ] && {
|
||||
echo "bitrate_down=$(($download * 1024 * 8))" >>$tmpconf
|
||||
echo "bitrate_up=$(($upload * 1024 * 8))" >>$tmpconf
|
||||
}
|
||||
|
||||
[ -n "${presentation_url}" ] && \
|
||||
echo "presentation_url=${presentation_url}" >>$tmpconf
|
||||
|
||||
[ -n "${notify_interval}" ] && \
|
||||
echo "notify_interval=${notify_interval}" >>$tmpconf
|
||||
|
||||
[ -n "${clean_ruleset_threshold}" ] && \
|
||||
echo "clean_ruleset_threshold=${clean_ruleset_threshold}" >>$tmpconf
|
||||
|
||||
[ -n "${clean_ruleset_interval}" ] && \
|
||||
echo "clean_ruleset_interval=${clean_ruleset_interval}" >>$tmpconf
|
||||
|
||||
[ -z "$uuid" ] && {
|
||||
uuid="$(cat /proc/sys/kernel/random/uuid)"
|
||||
uci set upnpd.config.uuid=$uuid
|
||||
uci commit upnpd
|
||||
}
|
||||
|
||||
[ "$uuid" = "nocli" ] || \
|
||||
echo "uuid=$uuid" >>$tmpconf
|
||||
|
||||
[ -n "${serial_number}" ] && \
|
||||
echo "serial=${serial_number}" >>$tmpconf
|
||||
|
||||
[ -n "${model_number}" ] && \
|
||||
echo "model_number=${model_number}" >>$tmpconf
|
||||
|
||||
config_foreach conf_rule_add perm_rule "$tmpconf"
|
||||
fi
|
||||
|
||||
|
||||
if [ -n "$ifname" ]; then
|
||||
local args="-i $ifname"
|
||||
local iface
|
||||
# start firewall
|
||||
local zone
|
||||
config_load firewall
|
||||
config_get zone core "${extiface:-wan}_zone"
|
||||
[ -n "$zone" ] && \
|
||||
miniupnpd_add_rules "$zone" "${extiface:-wan}" "$ifname"
|
||||
|
||||
[ -n "$extip" ] && \
|
||||
append args "-o $extip"
|
||||
|
||||
for iface in ${intiface:-lan}; do
|
||||
local ipaddr
|
||||
config_get ipaddr "$iface" ipaddr
|
||||
[ -n "$ipaddr" ] && append args "-a $ipaddr"
|
||||
done
|
||||
|
||||
[ "$port" != "auto" ] && \
|
||||
append args "-p $port"
|
||||
|
||||
[ "$usesysuptime" -eq 1 ] && \
|
||||
append args "-U"
|
||||
|
||||
[ -n "$upload" -a -n "$download" ] && \
|
||||
append args "-B $(($download * 1024 * 8)) $(($upload * 1024 * 8))"
|
||||
|
||||
[ "$secure" -gt 0 ] && \
|
||||
append args "-S"
|
||||
|
||||
[ "$natpmp" -gt 0 ] && \
|
||||
append args "-N"
|
||||
|
||||
[ -n "$conffile" ] && \
|
||||
append args "-f $conffile"
|
||||
|
||||
[ -n "${serial_number}" ] && \
|
||||
append args "-s ${serial_number}"
|
||||
|
||||
[ -n "${model_number}" ] && \
|
||||
append args "-m ${model_number}"
|
||||
|
||||
[ -z "$uuid" ] && {
|
||||
uuid="$(cat /proc/sys/kernel/random/uuid)"
|
||||
uci set upnpd.config.uuid=$uuid
|
||||
uci commit upnpd
|
||||
}
|
||||
|
||||
[ "$uuid" = "nocli" ] || \
|
||||
append args "-u $uuid"
|
||||
|
||||
[ -n "${notify_interval}" ] && \
|
||||
append args "-t ${notify_interval}"
|
||||
|
||||
[ -n "${presentation_url}" ] && \
|
||||
append args "-w \"${presentation_url}\""
|
||||
# start firewall
|
||||
local zone
|
||||
config_load firewall
|
||||
config_get zone core "${extiface:-wan}_zone"
|
||||
[ -n "$zone" ] && \
|
||||
miniupnpd_add_rules "$zone" "${extiface:-wan}" "$ifname"
|
||||
|
||||
if [ "$logging" = "1" ]; then
|
||||
[ "$enabled" -gt 0 ] && eval start-stop-daemon -S -x miniupnpd -- $args -d | logger -t miniupnpd &
|
||||
else
|
||||
[ "$enabled" -gt 0 ] && eval start-stop-daemon -S -x miniupnpd -- $args 2>/dev/null
|
||||
fi
|
||||
if [ "$logging" = "1" ]; then
|
||||
eval start-stop-daemon -S -x miniupnpd -- $args -d | logger -t miniupnpd &
|
||||
else
|
||||
eval start-stop-daemon -S -x miniupnpd -- $args 2>/dev/null
|
||||
fi
|
||||
else
|
||||
logger -t "upnp daemon" "external interface not found, not starting"
|
||||
fi
|
||||
|
||||
@ -1,8 +1,14 @@
|
||||
config upnpd config
|
||||
option enabled 0
|
||||
option enable_natpmp 1
|
||||
option secure_mode 1
|
||||
option log_output 0
|
||||
option download 1024
|
||||
option upload 512
|
||||
option external_iface wan
|
||||
option internal_iface lan
|
||||
|
||||
config perm_rule
|
||||
option action deny
|
||||
option ext_ports 0-65535
|
||||
option ip_mask 0.0.0.0/0
|
||||
option int_ports '0:65535'
|
||||
|
||||
43
net/miniupnpd/files/upnpd.config.example
Normal file
43
net/miniupnpd/files/upnpd.config.example
Normal file
@ -0,0 +1,43 @@
|
||||
config upnpd config
|
||||
option enable_natpmp 1
|
||||
option secure_mode 1
|
||||
option log_output 0
|
||||
option download 1024
|
||||
option upload 512
|
||||
option external_iface wan
|
||||
option internal_iface lan
|
||||
|
||||
config perm_rule
|
||||
option action deny
|
||||
option ext_ports 0-65535
|
||||
option int_addr 0.0.0.0/0
|
||||
option int_ports '0:65535'
|
||||
|
||||
# Allow rule
|
||||
# Allow incoming on a port in the range 1024 to 65535 to be redirected to
|
||||
# any 192.168.1.0/24 subnet host (depending on secure_mod) on a port in the
|
||||
# range 1024 to 65535
|
||||
# config perm_rule
|
||||
# option action allow
|
||||
# option ext_ports 1024-65535
|
||||
# option int_addr 192.168.1.0/24
|
||||
# option int_ports 1024-65535
|
||||
|
||||
# Single port
|
||||
# Allow incoming on 12233 to be redirected to 192.168.1.24 on a port in the
|
||||
# range 12233 to 12345 (inclusive)
|
||||
# config perm_rule
|
||||
# option action allow
|
||||
# option ext_ports 12233
|
||||
# option int_addr 192.168.1.24/24
|
||||
# option int_ports 12233-12345
|
||||
#
|
||||
|
||||
# Deny rule (recommended at end)
|
||||
# Deny any redirection that matchs:
|
||||
# incoming on port 0-65535, redirected to any port numbered 0-65535 on any ip
|
||||
# config perm_rule
|
||||
# option action deny
|
||||
# option ext_ports 0-65535
|
||||
# option int_addr 0.0.0.0/0
|
||||
# option int_ports 0-65535
|
||||
Loading…
x
Reference in New Issue
Block a user