[net] miniupnpd: Added uci setting of allow/deny rules, amongst other things. This involved switching to the use of /var/etc/miniupnpd.conf that is generated on the fly, instead of command-line parameters.

git-svn-id: svn://svn.openwrt.org/openwrt/packages@25953 3c298f89-4303-0410-b956-a3cf2f4a3e73

net/miniupnpd/Makefile

@@ -49,7 +49,9 @@ define Package/miniupnpd/install
 	$(INSTALL_CONF) ./files/upnpd.config $(1)/etc/config/upnpd
 	$(INSTALL_DATA) ./files/miniupnpd.iface.hotplug $(1)/etc/hotplug.d/iface/50-miniupnpd
 	$(INSTALL_DATA) ./files/miniupnpd.firewall.hotplug $(1)/etc/hotplug.d/firewall/50-miniupnpd
-	$(INSTALL_DATA) $(PKG_BUILD_DIR)/miniupnpd.conf $(1)/etc/miniupnpd.conf.example
+	$(INSTALL_DIR) $(1)/usr/share/miniupnpd
+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/miniupnpd.conf $(1)/usr/share/miniupnpd/miniupnpd.conf.example
+	$(INSTALL_DATA) ./files/upnpd.config.example $(1)/etc/config/upnpd.example
 endef
 
 $(eval $(call BuildPackage,miniupnpd))

net/miniupnpd/files/miniupnpd.init

@@ -1,6 +1,50 @@
 #!/bin/sh /etc/rc.common
 START=95
 
+upnpd_get_port_range() {
+    local _var="$1"; shift
+    local _val
+   
+    config_get _val "$@"
+
+    case "$_val" in
+	[0-9]*[:-][0-9]*)
+	    export -n -- "${_var}_start=${_val%%[:-]*}"
+	    export -n -- "${_var}_end=${_val##*[:-]}"
+	;;
+	[0-9]*)
+	    export -n -- "${_var}_start=$_val"
+	    export -n -- "${_var}_end="
+	;;
+    esac
+}
+
+conf_rule_add() {
+    local cfg="$1"
+    local tmpconf="$2"
+    local action external_port_start external_port_end ip_mask
+    local internal_port_start internal_port_end
+    config_get action "$cfg" action "deny"               # allow or deny
+    upnpd_get_port_range "ext" "$cfg" ext_ports "0-65535" # external ports: x, x-y, x:y
+    config_get int_addr "$cfg" int_addr "0.0.0.0/0"       # ip or network and subnet mask (internal)
+    upnpd_get_port_range "int" "$cfg" int_ports "0-65535" # internal ports: x, x-y, x:y or range
+    echo "${action} ${ext_start}${ext_end:+-}${ext_end} ${int_addr} ${int_start}${int_end:+-}${int_end}" >>$tmpconf   
+}
+
+upnpd_write_bool() {
+    local opt="$1"
+    local def="${2:-0}"
+    local alt="$3"
+
+    local val
+    config_get_bool val config "$opt" "$def"
+    if [ "$val" -eq 0 ]; then
+	echo "${alt:-$opt}=no" >> $tmpconf
+    else
+	echo "${alt:-$opt}=yes" >> $tmpconf
+    fi
+}
+
 start() {
 	type miniupnpd_add_rules >/dev/null 2>/dev/null || \
 		ACTION=- . /etc/hotplug.d/firewall/50-miniupnpd
@@ -8,7 +52,8 @@ start() {
 	config_load "upnpd"
 	local extiface intiface upload download logging secure enabled natpmp
 	local extip port usesysuptime conffile serial_number model_number
-	local uuid notify_interval presentation_url
+	local uuid notify_interval presentation_url enable_upnp
+	local upnp_lease_file clean_ruleset_threshold clean_ruleset_interval
 
 	config_get extiface config external_iface
 	config_get intiface config internal_iface
@@ -17,86 +62,106 @@ start() {
 	config_get upload   config upload
 	config_get download config download
 	config_get_bool logging config log_output 0
-	config_get_bool secure config secure_mode 0
-	config_get_bool natpmp config enable_natpmp 0
-	config_get_bool enabled config enabled 0 
-	config_get_bool usesysuptime config use_system_uptime 1
 	config_get conffile config config_file
 	config_get serial_number config serial_number
 	config_get model_number config model_number
 	config_get uuid config uuid
 	config_get notify_interval config notify_interval
 	config_get presentation_url config presentation_url
+	config_get upnp_lease_file config upnp_lease_file
+	config_get clean_ruleset_threshold config clean_ruleset_threshold
+	config_get clean_ruleset_interval config clean_ruleset_interval
+
+	local args
 
 	include /lib/network
 	scan_interfaces
 
 	local ifname
 	config_get ifname ${extiface:-wan} ifname
+	
+	if [ -n "$conffile" ]; then
+	    args="-f $conffile"
+	else
+	    local tmpconf="/var/etc/miniupnpd.conf"
+	    args="-f $tmpconf"
+	    mkdir -p /var/etc
 
+	    echo "ext_ifname=$ifname" >$tmpconf
+
+	    local iface
+	    
+	    [ -n "$extip" ] && \
+		echo "ext_ip=$extip" >>$tmpconf
+		
+	    for iface in ${intiface:-lan}; do
+		local ipaddr
+		config_get ipaddr "$iface" ipaddr
+		[ -n "$ipaddr" ] && \
+		    echo "listening_ip=$ipaddr" >>$tmpconf
+	    done
+	    
+	    [ "$port" != "auto" ] && \
+		echo "port=$port" >>$tmpconf
+
+	    config_load "upnpd"
+	    upnpd_write_bool enable_natpmp 1
+	    upnpd_write_bool enable_upnp 1
+	    upnpd_write_bool enable_secure 1 secure_mode
+	    upnpd_write_bool system_uptime 1
+
+	    [ -n "$upnp_lease_file" ] && \
+		echo "lease_file=$upnp_lease_file" >>$tmpconf
+		
+	    [ -n "$upload" -a -n "$download" ] && {
+		echo "bitrate_down=$(($download * 1024 * 8))" >>$tmpconf
+		echo "bitrate_up=$(($upload * 1024 * 8))" >>$tmpconf
+	    }
+
+	    [ -n "${presentation_url}" ] && \
+		echo "presentation_url=${presentation_url}" >>$tmpconf
+
+	    [ -n "${notify_interval}" ] && \
+		echo "notify_interval=${notify_interval}" >>$tmpconf
+
+	    [ -n "${clean_ruleset_threshold}" ] && \
+		echo "clean_ruleset_threshold=${clean_ruleset_threshold}" >>$tmpconf
+
+	    [ -n "${clean_ruleset_interval}" ] && \
+		echo "clean_ruleset_interval=${clean_ruleset_interval}" >>$tmpconf
+
+	    [ -z "$uuid" ] && {
+		uuid="$(cat /proc/sys/kernel/random/uuid)"
+		uci set upnpd.config.uuid=$uuid
+		uci commit upnpd
+	    }
+
+	    [ "$uuid" = "nocli" ] || \
+		echo "uuid=$uuid" >>$tmpconf
+		
+	    [ -n "${serial_number}" ] && \
+		echo "serial=${serial_number}" >>$tmpconf
+		
+	    [ -n "${model_number}" ] && \
+		echo "model_number=${model_number}" >>$tmpconf
+	    
+	    config_foreach conf_rule_add perm_rule "$tmpconf"
+	fi    
+	
+			
 	if [ -n "$ifname" ]; then
-		local args="-i $ifname"
+	    # start firewall
-		local iface
+	    local zone
+	    config_load firewall
+	    config_get zone core "${extiface:-wan}_zone"
+	    [ -n "$zone" ] && \
+		miniupnpd_add_rules "$zone" "${extiface:-wan}" "$ifname"
 
-		[ -n "$extip" ] && \
+	    if [ "$logging" = "1" ]; then
-			append args "-o $extip"
+		eval start-stop-daemon -S -x miniupnpd -- $args -d | logger -t miniupnpd &
-		
+	    else
-		for iface in ${intiface:-lan}; do
+		eval start-stop-daemon -S -x miniupnpd -- $args 2>/dev/null
-			local ipaddr
+	    fi
-			config_get ipaddr "$iface" ipaddr
-			[ -n "$ipaddr" ] && append args "-a $ipaddr"
-		done
-
-		[ "$port" != "auto" ] && \
-			append args "-p $port"
-		
-		[ "$usesysuptime" -eq 1 ] && \
-			append args "-U"
-
-		[ -n "$upload" -a -n "$download" ] && \
-			append args "-B $(($download * 1024 * 8)) $(($upload * 1024 * 8))"
-
-		[ "$secure" -gt 0 ] && \
-			append args "-S"
-
-		[ "$natpmp" -gt 0 ] && \
-			append args "-N"
-
-		[ -n "$conffile" ] && \
-			append args "-f $conffile"
-
-		[ -n "${serial_number}" ] && \
-			append args "-s ${serial_number}"
-		
-		[ -n "${model_number}" ] && \
-			append args "-m ${model_number}"
-			
-		[ -z "$uuid" ] && {
-			uuid="$(cat /proc/sys/kernel/random/uuid)"
-			uci set upnpd.config.uuid=$uuid
-			uci commit upnpd
-		}
-
-		[ "$uuid" = "nocli" ] || \
-			append args "-u $uuid"
-		
-		[ -n "${notify_interval}" ] && \
-			append args "-t ${notify_interval}"
-			
-		[ -n "${presentation_url}" ] && \
-			append args "-w \"${presentation_url}\""			
-		# start firewall
-		local zone
-		config_load firewall
-		config_get zone core "${extiface:-wan}_zone"
-		[ -n "$zone" ] && \
-			miniupnpd_add_rules "$zone" "${extiface:-wan}" "$ifname"
-
-		if [ "$logging" = "1" ]; then
-			[ "$enabled" -gt 0 ] && eval start-stop-daemon -S -x miniupnpd -- $args -d | logger -t miniupnpd &
-		else
-			[ "$enabled" -gt 0 ] && eval start-stop-daemon -S -x miniupnpd -- $args 2>/dev/null
-		fi
 	else
 		logger -t "upnp daemon" "external interface not found, not starting"
 	fi

net/miniupnpd/files/upnpd.config

@@ -1,8 +1,14 @@
 config upnpd config
-	option enabled		0
+	option enable_natpmp	1
 	option secure_mode	1
 	option log_output	0
 	option download 	1024
 	option upload   	512
 	option external_iface	wan
 	option internal_iface	lan
+
+config perm_rule
+       option action deny
+       option ext_ports 0-65535
+       option ip_mask 0.0.0.0/0
+       option int_ports '0:65535'

net/miniupnpd/files/upnpd.config.example

@@ -0,0 +1,43 @@
+config upnpd config
+	option enable_natpmp	1
+	option secure_mode	1
+	option log_output	0
+	option download 	1024
+	option upload   	512
+	option external_iface	wan
+	option internal_iface	lan
+
+config perm_rule
+       option action deny
+       option ext_ports 0-65535
+       option int_addr 0.0.0.0/0
+       option int_ports '0:65535'
+
+# Allow rule
+# Allow incoming on a port in the range 1024 to 65535 to be redirected to
+# any 192.168.1.0/24 subnet host (depending on secure_mod) on a port in the
+# range 1024 to 65535
+# config perm_rule
+#	option action allow
+#	option ext_ports 1024-65535
+#	option int_addr 192.168.1.0/24
+#	option int_ports 1024-65535
+
+# Single port
+# Allow incoming on 12233 to be redirected to 192.168.1.24 on a port in the
+# range 12233 to 12345 (inclusive)
+# config perm_rule
+#	option action allow
+#	option ext_ports 12233
+#	option int_addr 192.168.1.24/24
+#	option int_ports 12233-12345
+#
+
+# Deny rule (recommended at end)
+# Deny any redirection that matchs:
+#  incoming on port 0-65535, redirected to any port numbered 0-65535 on any ip
+# config perm_rule
+#       option action deny
+#       option ext_ports 0-65535
+#       option int_addr 0.0.0.0/0
+#       option int_ports 0-65535