Skip to content
Snippets Groups Projects
Commit 0953c9be authored by Matthias Schiffer's avatar Matthias Schiffer
Browse files

gluon-ebtables: use Lua instead of sh for the rule DSL to increase flexibility

parent ee829e8c
No related branches found
No related tags found
No related merge requests found
Show whitespace changes
Inline Side-by-side
Showing
with 55 additions and 56 deletions
package/gluon-ebtables-filter-multicast/files/lib/gluon/ebtables/100-mcast-chain
+ 1
− 1
View file @ 0953c9be
chain MULTICAST_OUT DROP chain('MULTICAST_OUT', 'DROP')
package/gluon-ebtables-filter-multicast/files/lib/gluon/ebtables/110-mcast-allow-arp
+ 1
− 1
View file @ 0953c9be
rule MULTICAST_OUT -p ARP -j RETURN rule 'MULTICAST_OUT -p ARP -j RETURN'
package/gluon-ebtables-filter-multicast/files/lib/gluon/ebtables/110-mcast-allow-babel
+ 1
− 1
View file @ 0953c9be
rule MULTICAST_OUT -p IPv6 --ip6-protocol udp --ip6-destination-port 6696 -j RETURN rule 'MULTICAST_OUT -p IPv6 --ip6-protocol udp --ip6-destination-port 6696 -j RETURN'
package/gluon-ebtables-filter-multicast/files/lib/gluon/ebtables/110-mcast-allow-btlpd
+ 1
− 1
View file @ 0953c9be
rule MULTICAST_OUT -p IPv4 --ip-destination 239.192.152.143 --ip-protocol udp --ip-destination-port 6771 -j RETURN rule 'MULTICAST_OUT -p IPv4 --ip-destination 239.192.152.143 --ip-protocol udp --ip-destination-port 6771 -j RETURN'
package/gluon-ebtables-filter-multicast/files/lib/gluon/ebtables/110-mcast-allow-dhcpv4
+ 1
− 1
View file @ 0953c9be
rule MULTICAST_OUT -p IPv4 --ip-protocol udp --ip-destination-port 67 -j RETURN rule 'MULTICAST_OUT -p IPv4 --ip-protocol udp --ip-destination-port 67 -j RETURN'
package/gluon-ebtables-filter-multicast/files/lib/gluon/ebtables/110-mcast-allow-dhcpv6
+ 1
− 1
View file @ 0953c9be
rule MULTICAST_OUT -p IPv6 --ip6-protocol udp --ip6-destination-port 546 -j RETURN rule 'MULTICAST_OUT -p IPv6 --ip6-protocol udp --ip6-destination-port 546 -j RETURN'
package/gluon-ebtables-filter-multicast/files/lib/gluon/ebtables/110-mcast-allow-icmp
+ 1
− 1
View file @ 0953c9be
rule MULTICAST_OUT -p IPv4 --ip-protocol icmp -j RETURN rule 'MULTICAST_OUT -p IPv4 --ip-protocol icmp -j RETURN'
package/gluon-ebtables-filter-multicast/files/lib/gluon/ebtables/110-mcast-allow-icmpv6
+ 1
− 1
View file @ 0953c9be
rule MULTICAST_OUT -p IPv6 --ip6-protocol ipv6-icmp -j RETURN rule 'MULTICAST_OUT -p IPv6 --ip6-protocol ipv6-icmp -j RETURN'
package/gluon-ebtables-filter-multicast/files/lib/gluon/ebtables/110-mcast-allow-igmp
+ 1
− 1
View file @ 0953c9be
rule MULTICAST_OUT -p IPv4 --ip-protocol igmp -j RETURN rule 'MULTICAST_OUT -p IPv4 --ip-protocol igmp -j RETURN'
package/gluon-ebtables-filter-multicast/files/lib/gluon/ebtables/110-mcast-allow-ospf
+ 2
− 2
View file @ 0953c9be
rule MULTICAST_OUT -p IPv4 --ip-protocol ospf -j RETURN rule 'MULTICAST_OUT -p IPv4 --ip-protocol ospf -j RETURN'
rule MULTICAST_OUT -p IPv6 --ip6-protocol ospf -j RETURN rule 'MULTICAST_OUT -p IPv6 --ip6-protocol ospf -j RETURN'
package/gluon-ebtables-filter-multicast/files/lib/gluon/ebtables/300-mcast
+ 2
− 2
View file @ 0953c9be
rule FORWARD --logical-out br-client -o bat0 -d Multicast -j MULTICAST_OUT rule 'FORWARD --logical-out br-client -o bat0 -d Multicast -j MULTICAST_OUT'
rule OUTPUT --logical-out br-client -o bat0 -d Multicast -j MULTICAST_OUT rule 'OUTPUT --logical-out br-client -o bat0 -d Multicast -j MULTICAST_OUT'
package/gluon-ebtables-filter-ra-dhcp/files/lib/gluon/ebtables/200-dir-dhcpv4
+ 4
− 4
View file @ 0953c9be
rule FORWARD -p IPv4 --ip-protocol udp --ip-destination-port 67 -j OUT_ONLY rule 'FORWARD -p IPv4 --ip-protocol udp --ip-destination-port 67 -j OUT_ONLY'
rule OUTPUT -p IPv4 --ip-protocol udp --ip-destination-port 67 -j OUT_ONLY rule 'OUTPUT -p IPv4 --ip-protocol udp --ip-destination-port 67 -j OUT_ONLY'
rule FORWARD -p IPv4 --ip-protocol udp --ip-destination-port 68 -j IN_ONLY rule 'FORWARD -p IPv4 --ip-protocol udp --ip-destination-port 68 -j IN_ONLY'
rule INPUT -p IPv4 --ip-protocol udp --ip-destination-port 68 -j IN_ONLY rule 'INPUT -p IPv4 --ip-protocol udp --ip-destination-port 68 -j IN_ONLY'
package/gluon-ebtables-filter-ra-dhcp/files/lib/gluon/ebtables/200-dir-dhcpv6
+ 4
− 4
View file @ 0953c9be
rule FORWARD -p IPv6 --ip6-protocol udp --ip6-destination-port 546 -j OUT_ONLY rule 'FORWARD -p IPv6 --ip6-protocol udp --ip6-destination-port 546 -j OUT_ONLY'
rule OUTPUT -p IPv6 --ip6-protocol udp --ip6-destination-port 546 -j OUT_ONLY rule 'OUTPUT -p IPv6 --ip6-protocol udp --ip6-destination-port 546 -j OUT_ONLY'
rule FORWARD -p IPv6 --ip6-protocol udp --ip6-destination-port 547 -j IN_ONLY rule 'FORWARD -p IPv6 --ip6-protocol udp --ip6-destination-port 547 -j IN_ONLY'
rule INPUT -p IPv6 --ip6-protocol udp --ip6-destination-port 547 -j IN_ONLY rule 'INPUT -p IPv6 --ip6-protocol udp --ip6-destination-port 547 -j IN_ONLY'
package/gluon-ebtables-filter-ra-dhcp/files/lib/gluon/ebtables/200-dir-radv
+ 4
− 4
View file @ 0953c9be
rule FORWARD -p IPv6 --ip6-protocol ipv6-icmp --ip6-icmp-type router-solicitation -j OUT_ONLY rule 'FORWARD -p IPv6 --ip6-protocol ipv6-icmp --ip6-icmp-type router-solicitation -j OUT_ONLY'
rule OUTPUT -p IPv6 --ip6-protocol ipv6-icmp --ip6-icmp-type router-solicitation -j OUT_ONLY rule 'OUTPUT -p IPv6 --ip6-protocol ipv6-icmp --ip6-icmp-type router-solicitation -j OUT_ONLY'
rule FORWARD -p IPv6 --ip6-protocol ipv6-icmp --ip6-icmp-type router-advertisement -j IN_ONLY rule 'FORWARD -p IPv6 --ip6-protocol ipv6-icmp --ip6-icmp-type router-advertisement -j IN_ONLY'
rule INPUT -p IPv6 --ip6-protocol ipv6-icmp --ip6-icmp-type router-advertisement -j IN_ONLY rule 'INPUT -p IPv6 --ip6-protocol ipv6-icmp --ip6-icmp-type router-advertisement -j IN_ONLY'
package/gluon-ebtables/files/etc/init.d/gluon-ebtables
+ 12
− 13
View file @ 0953c9be
...@@ -23,15 +23,14 @@ STOP=91 ...@@ -23,15 +23,14 @@ STOP=91
exec_file() { exec_file() {
local file="$1" local file="$1"
sh -c " /usr/bin/lua -e "
eval 'rule() { function rule(command)
$EBTABLES_RULE os.execute($EBTABLES_RULE)
}' end
eval 'chain() { function chain(name, policy)
$EBTABLES_CHAIN os.execute($EBTABLES_CHAIN)
}' end
source \"$1\" " "$file"
" - "$file"
} }
exec_all() { exec_all() {
...@@ -49,8 +48,8 @@ exec_all() { ...@@ -49,8 +48,8 @@ exec_all() {
start() { start() {
( (
export EBTABLES_RULE='ebtables -A "$@"' export EBTABLES_RULE='"ebtables -A " .. command'
export EBTABLES_CHAIN='ebtables -N "$1" -P "$2"' export EBTABLES_CHAIN='"ebtables -N " .. name .. " -P " .. policy'
if [ -z "$1" ]; then if [ -z "$1" ]; then
exec_all '' exec_all ''
...@@ -62,8 +61,8 @@ start() { ...@@ -62,8 +61,8 @@ start() {
stop() { stop() {
( (
export EBTABLES_RULE='ebtables -D "$@"' export EBTABLES_RULE='"ebtables -D " .. command'
export EBTABLES_CHAIN='ebtables -X "$1"' export EBTABLES_CHAIN='"ebtables -X " .. name'
if [ -z "$1" ]; then if [ -z "$1" ]; then
exec_all '-r' exec_all '-r'
......
package/gluon-ebtables/files/lib/gluon/ebtables/100-dir-chain
+ 2
− 2
View file @ 0953c9be
chain IN_ONLY RETURN chain('IN_ONLY', 'RETURN')
chain OUT_ONLY RETURN chain('OUT_ONLY', 'RETURN')
package/gluon-ebtables/files/lib/gluon/ebtables/101-dir-rules
+ 2
− 2
View file @ 0953c9be
rule IN_ONLY --logical-in br-client -i ! bat0 -j DROP rule 'IN_ONLY --logical-in br-client -i ! bat0 -j DROP'
rule OUT_ONLY --logical-out br-client -o ! bat0 -j DROP rule 'OUT_ONLY --logical-out br-client -o ! bat0 -j DROP'
package/gluon-next-node/generate/lib/gluon/ebtables/250-next-node
+ 12
− 12
View file @ 0953c9be
rule FORWARD --logical-out br-client -o bat0 -d @next_node.mac@ -j DROP rule 'FORWARD --logical-out br-client -o bat0 -d @next_node.mac@ -j DROP'
rule OUTPUT --logical-out br-client -o bat0 -d @next_node.mac@ -j DROP rule 'OUTPUT --logical-out br-client -o bat0 -d @next_node.mac@ -j DROP'
rule FORWARD --logical-out br-client -o bat0 -s @next_node.mac@ -j DROP rule 'FORWARD --logical-out br-client -o bat0 -s @next_node.mac@ -j DROP'
rule OUTPUT --logical-out br-client -o bat0 -s @next_node.mac@ -j DROP rule 'OUTPUT --logical-out br-client -o bat0 -s @next_node.mac@ -j DROP'
rule FORWARD --logical-out br-client -o bat0 -p IPv4 --ip-destination @next_node.ip4@ -j DROP rule 'FORWARD --logical-out br-client -o bat0 -p IPv4 --ip-destination @next_node.ip4@ -j DROP'
rule OUTPUT --logical-out br-client -o bat0 -p IPv4 --ip-destination @next_node.ip4@ -j DROP rule 'OUTPUT --logical-out br-client -o bat0 -p IPv4 --ip-destination @next_node.ip4@ -j DROP'
rule FORWARD --logical-out br-client -o bat0 -p IPv4 --ip-source @next_node.ip4@ -j DROP rule 'FORWARD --logical-out br-client -o bat0 -p IPv4 --ip-source @next_node.ip4@ -j DROP'
rule OUTPUT --logical-out br-client -o bat0 -p IPv4 --ip-source @next_node.ip4@ -j DROP rule 'OUTPUT --logical-out br-client -o bat0 -p IPv4 --ip-source @next_node.ip4@ -j DROP'
rule FORWARD --logical-out br-client -o bat0 -p IPv6 --ip6-destination @next_node.ip6@ -j DROP rule 'FORWARD --logical-out br-client -o bat0 -p IPv6 --ip6-destination @next_node.ip6@ -j DROP'
rule OUTPUT --logical-out br-client -o bat0 -p IPv6 --ip6-destination @next_node.ip6@ -j DROP rule 'OUTPUT --logical-out br-client -o bat0 -p IPv6 --ip6-destination @next_node.ip6@ -j DROP'
rule FORWARD --logical-out br-client -o bat0 -p IPv6 --ip6-source @next_node.ip6@ -j DROP rule 'FORWARD --logical-out br-client -o bat0 -p IPv6 --ip6-source @next_node.ip6@ -j DROP'
rule OUTPUT --logical-out br-client -o bat0 -p IPv6 --ip6-source @next_node.ip6@ -j DROP rule 'OUTPUT --logical-out br-client -o bat0 -p IPv6 --ip6-source @next_node.ip6@ -j DROP'
package/gluon-radvd/files/lib/gluon/ebtables/300-radv-input-output
+ 2
− 2
View file @ 0953c9be
rule INPUT -p IPv6 --ip6-protocol ipv6-icmp --ip6-icmp-type router-solicitation -i bat0 -j DROP rule 'INPUT -p IPv6 --ip6-protocol ipv6-icmp --ip6-icmp-type router-solicitation -i bat0 -j DROP'
rule OUTPUT -p IPv6 --ip6-protocol ipv6-icmp --ip6-icmp-type router-advertisement -o bat0 -j DROP rule 'OUTPUT -p IPv6 --ip6-protocol ipv6-icmp --ip6-icmp-type router-advertisement -o bat0 -j DROP'
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment

Impressum - Datenschutz