From 0953c9befb39ed6c8aeb8d9c2b24022aeb64a05b Mon Sep 17 00:00:00 2001 From: Matthias Schiffer Date: Wed, 14 May 2014 15:02:57 +0200 Subject: [PATCH] gluon-ebtables: use Lua instead of sh for the rule DSL to increase flexibility --- .../files/lib/gluon/ebtables/100-mcast-chain | 2 +- .../lib/gluon/ebtables/110-mcast-allow-arp | 2 +- .../lib/gluon/ebtables/110-mcast-allow-babel | 2 +- .../lib/gluon/ebtables/110-mcast-allow-btlpd | 2 +- .../lib/gluon/ebtables/110-mcast-allow-dhcpv4 | 2 +- .../lib/gluon/ebtables/110-mcast-allow-dhcpv6 | 2 +- .../lib/gluon/ebtables/110-mcast-allow-icmp | 2 +- .../lib/gluon/ebtables/110-mcast-allow-icmpv6 | 2 +- .../lib/gluon/ebtables/110-mcast-allow-igmp | 2 +- .../lib/gluon/ebtables/110-mcast-allow-ospf | 4 +-- .../files/lib/gluon/ebtables/300-mcast | 4 +-- .../files/lib/gluon/ebtables/200-dir-dhcpv4 | 8 +++--- .../files/lib/gluon/ebtables/200-dir-dhcpv6 | 8 +++--- .../files/lib/gluon/ebtables/200-dir-radv | 8 +++--- .../files/etc/init.d/gluon-ebtables | 25 +++++++++---------- .../files/lib/gluon/ebtables/100-dir-chain | 4 +-- .../files/lib/gluon/ebtables/101-dir-rules | 4 +-- .../generate/lib/gluon/ebtables/250-next-node | 24 +++++++++--------- .../lib/gluon/ebtables/300-radv-input-output | 4 +-- 19 files changed, 55 insertions(+), 56 deletions(-) diff --git a/package/gluon-ebtables-filter-multicast/files/lib/gluon/ebtables/100-mcast-chain b/package/gluon-ebtables-filter-multicast/files/lib/gluon/ebtables/100-mcast-chain index 93382f30..ec0013a3 100644 --- a/package/gluon-ebtables-filter-multicast/files/lib/gluon/ebtables/100-mcast-chain +++ b/package/gluon-ebtables-filter-multicast/files/lib/gluon/ebtables/100-mcast-chain @@ -1 +1 @@ -chain MULTICAST_OUT DROP +chain('MULTICAST_OUT', 'DROP') diff --git a/package/gluon-ebtables-filter-multicast/files/lib/gluon/ebtables/110-mcast-allow-arp b/package/gluon-ebtables-filter-multicast/files/lib/gluon/ebtables/110-mcast-allow-arp index fdb20b1f..1083966d 100644 --- a/package/gluon-ebtables-filter-multicast/files/lib/gluon/ebtables/110-mcast-allow-arp +++ b/package/gluon-ebtables-filter-multicast/files/lib/gluon/ebtables/110-mcast-allow-arp @@ -1 +1 @@ -rule MULTICAST_OUT -p ARP -j RETURN +rule 'MULTICAST_OUT -p ARP -j RETURN' diff --git a/package/gluon-ebtables-filter-multicast/files/lib/gluon/ebtables/110-mcast-allow-babel b/package/gluon-ebtables-filter-multicast/files/lib/gluon/ebtables/110-mcast-allow-babel index 096ae50e..d5b81771 100644 --- a/package/gluon-ebtables-filter-multicast/files/lib/gluon/ebtables/110-mcast-allow-babel +++ b/package/gluon-ebtables-filter-multicast/files/lib/gluon/ebtables/110-mcast-allow-babel @@ -1 +1 @@ -rule MULTICAST_OUT -p IPv6 --ip6-protocol udp --ip6-destination-port 6696 -j RETURN +rule 'MULTICAST_OUT -p IPv6 --ip6-protocol udp --ip6-destination-port 6696 -j RETURN' diff --git a/package/gluon-ebtables-filter-multicast/files/lib/gluon/ebtables/110-mcast-allow-btlpd b/package/gluon-ebtables-filter-multicast/files/lib/gluon/ebtables/110-mcast-allow-btlpd index 9776157a..20b709f8 100644 --- a/package/gluon-ebtables-filter-multicast/files/lib/gluon/ebtables/110-mcast-allow-btlpd +++ b/package/gluon-ebtables-filter-multicast/files/lib/gluon/ebtables/110-mcast-allow-btlpd @@ -1 +1 @@ -rule MULTICAST_OUT -p IPv4 --ip-destination 239.192.152.143 --ip-protocol udp --ip-destination-port 6771 -j RETURN +rule 'MULTICAST_OUT -p IPv4 --ip-destination 239.192.152.143 --ip-protocol udp --ip-destination-port 6771 -j RETURN' diff --git a/package/gluon-ebtables-filter-multicast/files/lib/gluon/ebtables/110-mcast-allow-dhcpv4 b/package/gluon-ebtables-filter-multicast/files/lib/gluon/ebtables/110-mcast-allow-dhcpv4 index 440107a9..2fca2223 100644 --- a/package/gluon-ebtables-filter-multicast/files/lib/gluon/ebtables/110-mcast-allow-dhcpv4 +++ b/package/gluon-ebtables-filter-multicast/files/lib/gluon/ebtables/110-mcast-allow-dhcpv4 @@ -1 +1 @@ -rule MULTICAST_OUT -p IPv4 --ip-protocol udp --ip-destination-port 67 -j RETURN +rule 'MULTICAST_OUT -p IPv4 --ip-protocol udp --ip-destination-port 67 -j RETURN' diff --git a/package/gluon-ebtables-filter-multicast/files/lib/gluon/ebtables/110-mcast-allow-dhcpv6 b/package/gluon-ebtables-filter-multicast/files/lib/gluon/ebtables/110-mcast-allow-dhcpv6 index 1b523ec4..d156de4f 100644 --- a/package/gluon-ebtables-filter-multicast/files/lib/gluon/ebtables/110-mcast-allow-dhcpv6 +++ b/package/gluon-ebtables-filter-multicast/files/lib/gluon/ebtables/110-mcast-allow-dhcpv6 @@ -1 +1 @@ -rule MULTICAST_OUT -p IPv6 --ip6-protocol udp --ip6-destination-port 546 -j RETURN +rule 'MULTICAST_OUT -p IPv6 --ip6-protocol udp --ip6-destination-port 546 -j RETURN' diff --git a/package/gluon-ebtables-filter-multicast/files/lib/gluon/ebtables/110-mcast-allow-icmp b/package/gluon-ebtables-filter-multicast/files/lib/gluon/ebtables/110-mcast-allow-icmp index e52e5c78..25a95f39 100644 --- a/package/gluon-ebtables-filter-multicast/files/lib/gluon/ebtables/110-mcast-allow-icmp +++ b/package/gluon-ebtables-filter-multicast/files/lib/gluon/ebtables/110-mcast-allow-icmp @@ -1 +1 @@ -rule MULTICAST_OUT -p IPv4 --ip-protocol icmp -j RETURN +rule 'MULTICAST_OUT -p IPv4 --ip-protocol icmp -j RETURN' diff --git a/package/gluon-ebtables-filter-multicast/files/lib/gluon/ebtables/110-mcast-allow-icmpv6 b/package/gluon-ebtables-filter-multicast/files/lib/gluon/ebtables/110-mcast-allow-icmpv6 index 7c50ff5e..b670ff45 100644 --- a/package/gluon-ebtables-filter-multicast/files/lib/gluon/ebtables/110-mcast-allow-icmpv6 +++ b/package/gluon-ebtables-filter-multicast/files/lib/gluon/ebtables/110-mcast-allow-icmpv6 @@ -1 +1 @@ -rule MULTICAST_OUT -p IPv6 --ip6-protocol ipv6-icmp -j RETURN +rule 'MULTICAST_OUT -p IPv6 --ip6-protocol ipv6-icmp -j RETURN' diff --git a/package/gluon-ebtables-filter-multicast/files/lib/gluon/ebtables/110-mcast-allow-igmp b/package/gluon-ebtables-filter-multicast/files/lib/gluon/ebtables/110-mcast-allow-igmp index 521af563..2d3814ae 100644 --- a/package/gluon-ebtables-filter-multicast/files/lib/gluon/ebtables/110-mcast-allow-igmp +++ b/package/gluon-ebtables-filter-multicast/files/lib/gluon/ebtables/110-mcast-allow-igmp @@ -1 +1 @@ -rule MULTICAST_OUT -p IPv4 --ip-protocol igmp -j RETURN +rule 'MULTICAST_OUT -p IPv4 --ip-protocol igmp -j RETURN' diff --git a/package/gluon-ebtables-filter-multicast/files/lib/gluon/ebtables/110-mcast-allow-ospf b/package/gluon-ebtables-filter-multicast/files/lib/gluon/ebtables/110-mcast-allow-ospf index 6e540751..da928d4b 100644 --- a/package/gluon-ebtables-filter-multicast/files/lib/gluon/ebtables/110-mcast-allow-ospf +++ b/package/gluon-ebtables-filter-multicast/files/lib/gluon/ebtables/110-mcast-allow-ospf @@ -1,2 +1,2 @@ -rule MULTICAST_OUT -p IPv4 --ip-protocol ospf -j RETURN -rule MULTICAST_OUT -p IPv6 --ip6-protocol ospf -j RETURN +rule 'MULTICAST_OUT -p IPv4 --ip-protocol ospf -j RETURN' +rule 'MULTICAST_OUT -p IPv6 --ip6-protocol ospf -j RETURN' diff --git a/package/gluon-ebtables-filter-multicast/files/lib/gluon/ebtables/300-mcast b/package/gluon-ebtables-filter-multicast/files/lib/gluon/ebtables/300-mcast index afbc8057..c52f122f 100644 --- a/package/gluon-ebtables-filter-multicast/files/lib/gluon/ebtables/300-mcast +++ b/package/gluon-ebtables-filter-multicast/files/lib/gluon/ebtables/300-mcast @@ -1,2 +1,2 @@ -rule FORWARD --logical-out br-client -o bat0 -d Multicast -j MULTICAST_OUT -rule OUTPUT --logical-out br-client -o bat0 -d Multicast -j MULTICAST_OUT +rule 'FORWARD --logical-out br-client -o bat0 -d Multicast -j MULTICAST_OUT' +rule 'OUTPUT --logical-out br-client -o bat0 -d Multicast -j MULTICAST_OUT' diff --git a/package/gluon-ebtables-filter-ra-dhcp/files/lib/gluon/ebtables/200-dir-dhcpv4 b/package/gluon-ebtables-filter-ra-dhcp/files/lib/gluon/ebtables/200-dir-dhcpv4 index 8771ee15..ec56ff1d 100644 --- a/package/gluon-ebtables-filter-ra-dhcp/files/lib/gluon/ebtables/200-dir-dhcpv4 +++ b/package/gluon-ebtables-filter-ra-dhcp/files/lib/gluon/ebtables/200-dir-dhcpv4 @@ -1,5 +1,5 @@ -rule FORWARD -p IPv4 --ip-protocol udp --ip-destination-port 67 -j OUT_ONLY -rule OUTPUT -p IPv4 --ip-protocol udp --ip-destination-port 67 -j OUT_ONLY +rule 'FORWARD -p IPv4 --ip-protocol udp --ip-destination-port 67 -j OUT_ONLY' +rule 'OUTPUT -p IPv4 --ip-protocol udp --ip-destination-port 67 -j OUT_ONLY' -rule FORWARD -p IPv4 --ip-protocol udp --ip-destination-port 68 -j IN_ONLY -rule INPUT -p IPv4 --ip-protocol udp --ip-destination-port 68 -j IN_ONLY +rule 'FORWARD -p IPv4 --ip-protocol udp --ip-destination-port 68 -j IN_ONLY' +rule 'INPUT -p IPv4 --ip-protocol udp --ip-destination-port 68 -j IN_ONLY' diff --git a/package/gluon-ebtables-filter-ra-dhcp/files/lib/gluon/ebtables/200-dir-dhcpv6 b/package/gluon-ebtables-filter-ra-dhcp/files/lib/gluon/ebtables/200-dir-dhcpv6 index 234e54e5..d433cdde 100644 --- a/package/gluon-ebtables-filter-ra-dhcp/files/lib/gluon/ebtables/200-dir-dhcpv6 +++ b/package/gluon-ebtables-filter-ra-dhcp/files/lib/gluon/ebtables/200-dir-dhcpv6 @@ -1,5 +1,5 @@ -rule FORWARD -p IPv6 --ip6-protocol udp --ip6-destination-port 546 -j OUT_ONLY -rule OUTPUT -p IPv6 --ip6-protocol udp --ip6-destination-port 546 -j OUT_ONLY +rule 'FORWARD -p IPv6 --ip6-protocol udp --ip6-destination-port 546 -j OUT_ONLY' +rule 'OUTPUT -p IPv6 --ip6-protocol udp --ip6-destination-port 546 -j OUT_ONLY' -rule FORWARD -p IPv6 --ip6-protocol udp --ip6-destination-port 547 -j IN_ONLY -rule INPUT -p IPv6 --ip6-protocol udp --ip6-destination-port 547 -j IN_ONLY +rule 'FORWARD -p IPv6 --ip6-protocol udp --ip6-destination-port 547 -j IN_ONLY' +rule 'INPUT -p IPv6 --ip6-protocol udp --ip6-destination-port 547 -j IN_ONLY' diff --git a/package/gluon-ebtables-filter-ra-dhcp/files/lib/gluon/ebtables/200-dir-radv b/package/gluon-ebtables-filter-ra-dhcp/files/lib/gluon/ebtables/200-dir-radv index c7257032..b34d4c76 100644 --- a/package/gluon-ebtables-filter-ra-dhcp/files/lib/gluon/ebtables/200-dir-radv +++ b/package/gluon-ebtables-filter-ra-dhcp/files/lib/gluon/ebtables/200-dir-radv @@ -1,5 +1,5 @@ -rule FORWARD -p IPv6 --ip6-protocol ipv6-icmp --ip6-icmp-type router-solicitation -j OUT_ONLY -rule OUTPUT -p IPv6 --ip6-protocol ipv6-icmp --ip6-icmp-type router-solicitation -j OUT_ONLY +rule 'FORWARD -p IPv6 --ip6-protocol ipv6-icmp --ip6-icmp-type router-solicitation -j OUT_ONLY' +rule 'OUTPUT -p IPv6 --ip6-protocol ipv6-icmp --ip6-icmp-type router-solicitation -j OUT_ONLY' -rule FORWARD -p IPv6 --ip6-protocol ipv6-icmp --ip6-icmp-type router-advertisement -j IN_ONLY -rule INPUT -p IPv6 --ip6-protocol ipv6-icmp --ip6-icmp-type router-advertisement -j IN_ONLY +rule 'FORWARD -p IPv6 --ip6-protocol ipv6-icmp --ip6-icmp-type router-advertisement -j IN_ONLY' +rule 'INPUT -p IPv6 --ip6-protocol ipv6-icmp --ip6-icmp-type router-advertisement -j IN_ONLY' diff --git a/package/gluon-ebtables/files/etc/init.d/gluon-ebtables b/package/gluon-ebtables/files/etc/init.d/gluon-ebtables index cbc3d6ae..5a770452 100755 --- a/package/gluon-ebtables/files/etc/init.d/gluon-ebtables +++ b/package/gluon-ebtables/files/etc/init.d/gluon-ebtables @@ -23,15 +23,14 @@ STOP=91 exec_file() { local file="$1" - sh -c " - eval 'rule() { - $EBTABLES_RULE - }' - eval 'chain() { - $EBTABLES_CHAIN - }' - source \"$1\" - " - "$file" + /usr/bin/lua -e " + function rule(command) + os.execute($EBTABLES_RULE) + end + function chain(name, policy) + os.execute($EBTABLES_CHAIN) + end + " "$file" } exec_all() { @@ -49,8 +48,8 @@ exec_all() { start() { ( - export EBTABLES_RULE='ebtables -A "$@"' - export EBTABLES_CHAIN='ebtables -N "$1" -P "$2"' + export EBTABLES_RULE='"ebtables -A " .. command' + export EBTABLES_CHAIN='"ebtables -N " .. name .. " -P " .. policy' if [ -z "$1" ]; then exec_all '' @@ -62,8 +61,8 @@ start() { stop() { ( - export EBTABLES_RULE='ebtables -D "$@"' - export EBTABLES_CHAIN='ebtables -X "$1"' + export EBTABLES_RULE='"ebtables -D " .. command' + export EBTABLES_CHAIN='"ebtables -X " .. name' if [ -z "$1" ]; then exec_all '-r' diff --git a/package/gluon-ebtables/files/lib/gluon/ebtables/100-dir-chain b/package/gluon-ebtables/files/lib/gluon/ebtables/100-dir-chain index 99908dc4..31c19c53 100644 --- a/package/gluon-ebtables/files/lib/gluon/ebtables/100-dir-chain +++ b/package/gluon-ebtables/files/lib/gluon/ebtables/100-dir-chain @@ -1,2 +1,2 @@ -chain IN_ONLY RETURN -chain OUT_ONLY RETURN +chain('IN_ONLY', 'RETURN') +chain('OUT_ONLY', 'RETURN') diff --git a/package/gluon-ebtables/files/lib/gluon/ebtables/101-dir-rules b/package/gluon-ebtables/files/lib/gluon/ebtables/101-dir-rules index 6c8f44cc..b1cd4e24 100644 --- a/package/gluon-ebtables/files/lib/gluon/ebtables/101-dir-rules +++ b/package/gluon-ebtables/files/lib/gluon/ebtables/101-dir-rules @@ -1,2 +1,2 @@ -rule IN_ONLY --logical-in br-client -i ! bat0 -j DROP -rule OUT_ONLY --logical-out br-client -o ! bat0 -j DROP +rule 'IN_ONLY --logical-in br-client -i ! bat0 -j DROP' +rule 'OUT_ONLY --logical-out br-client -o ! bat0 -j DROP' diff --git a/package/gluon-next-node/generate/lib/gluon/ebtables/250-next-node b/package/gluon-next-node/generate/lib/gluon/ebtables/250-next-node index 08b70dad..7595df29 100644 --- a/package/gluon-next-node/generate/lib/gluon/ebtables/250-next-node +++ b/package/gluon-next-node/generate/lib/gluon/ebtables/250-next-node @@ -1,14 +1,14 @@ -rule FORWARD --logical-out br-client -o bat0 -d @next_node.mac@ -j DROP -rule OUTPUT --logical-out br-client -o bat0 -d @next_node.mac@ -j DROP -rule FORWARD --logical-out br-client -o bat0 -s @next_node.mac@ -j DROP -rule OUTPUT --logical-out br-client -o bat0 -s @next_node.mac@ -j DROP +rule 'FORWARD --logical-out br-client -o bat0 -d @next_node.mac@ -j DROP' +rule 'OUTPUT --logical-out br-client -o bat0 -d @next_node.mac@ -j DROP' +rule 'FORWARD --logical-out br-client -o bat0 -s @next_node.mac@ -j DROP' +rule 'OUTPUT --logical-out br-client -o bat0 -s @next_node.mac@ -j DROP' -rule FORWARD --logical-out br-client -o bat0 -p IPv4 --ip-destination @next_node.ip4@ -j DROP -rule OUTPUT --logical-out br-client -o bat0 -p IPv4 --ip-destination @next_node.ip4@ -j DROP -rule FORWARD --logical-out br-client -o bat0 -p IPv4 --ip-source @next_node.ip4@ -j DROP -rule OUTPUT --logical-out br-client -o bat0 -p IPv4 --ip-source @next_node.ip4@ -j DROP +rule 'FORWARD --logical-out br-client -o bat0 -p IPv4 --ip-destination @next_node.ip4@ -j DROP' +rule 'OUTPUT --logical-out br-client -o bat0 -p IPv4 --ip-destination @next_node.ip4@ -j DROP' +rule 'FORWARD --logical-out br-client -o bat0 -p IPv4 --ip-source @next_node.ip4@ -j DROP' +rule 'OUTPUT --logical-out br-client -o bat0 -p IPv4 --ip-source @next_node.ip4@ -j DROP' -rule FORWARD --logical-out br-client -o bat0 -p IPv6 --ip6-destination @next_node.ip6@ -j DROP -rule OUTPUT --logical-out br-client -o bat0 -p IPv6 --ip6-destination @next_node.ip6@ -j DROP -rule FORWARD --logical-out br-client -o bat0 -p IPv6 --ip6-source @next_node.ip6@ -j DROP -rule OUTPUT --logical-out br-client -o bat0 -p IPv6 --ip6-source @next_node.ip6@ -j DROP +rule 'FORWARD --logical-out br-client -o bat0 -p IPv6 --ip6-destination @next_node.ip6@ -j DROP' +rule 'OUTPUT --logical-out br-client -o bat0 -p IPv6 --ip6-destination @next_node.ip6@ -j DROP' +rule 'FORWARD --logical-out br-client -o bat0 -p IPv6 --ip6-source @next_node.ip6@ -j DROP' +rule 'OUTPUT --logical-out br-client -o bat0 -p IPv6 --ip6-source @next_node.ip6@ -j DROP' diff --git a/package/gluon-radvd/files/lib/gluon/ebtables/300-radv-input-output b/package/gluon-radvd/files/lib/gluon/ebtables/300-radv-input-output index 379e486a..377d11cd 100644 --- a/package/gluon-radvd/files/lib/gluon/ebtables/300-radv-input-output +++ b/package/gluon-radvd/files/lib/gluon/ebtables/300-radv-input-output @@ -1,2 +1,2 @@ -rule INPUT -p IPv6 --ip6-protocol ipv6-icmp --ip6-icmp-type router-solicitation -i bat0 -j DROP -rule OUTPUT -p IPv6 --ip6-protocol ipv6-icmp --ip6-icmp-type router-advertisement -o bat0 -j DROP +rule 'INPUT -p IPv6 --ip6-protocol ipv6-icmp --ip6-icmp-type router-solicitation -i bat0 -j DROP' +rule 'OUTPUT -p IPv6 --ip6-protocol ipv6-icmp --ip6-icmp-type router-advertisement -o bat0 -j DROP'