🌴 Sync 2026-03-05 23:51:42

miniupnpd/files/firewall3.include

@@ -0,0 +1,72 @@
+#!/bin/sh
+# miniupnpd integration for firewall3
+
+IPTABLES="/usr/sbin/iptables"
+IP6TABLES="/usr/sbin/ip6tables"
+IPTARGS="-w 1"
+
+$IPTABLES -t filter -N MINIUPNPD 2>/dev/null
+$IPTABLES -t nat -N MINIUPNPD 2>/dev/null
+$IPTABLES -t nat -N MINIUPNPD-POSTROUTING 2>/dev/null
+
+[ -x $IP6TABLES ] && $IP6TABLES -t filter -N MINIUPNPD 2>/dev/null
+
+. /lib/functions/network.sh
+
+# helper to insert in chain as penultimate
+iptables_prepend_rule() {
+	local iptables="$1"
+	local table="$2"
+	local chain="$3"
+	local target="$4"
+
+	$iptables "$IPTARGS" -t "$table" -I "$chain" $($iptables "$IPTARGS" -t "$table" --line-numbers -nL "$chain" | \
+		sed -ne '$s/[^0-9].*//p') -j "$target"
+}
+
+ADDED=0
+
+add_extzone_rules() {
+    local ext_zone="$1"
+
+    [ -z "$ext_zone" ] && return
+
+    # IPv4 - due to NAT, need to add both to nat and filter table
+    # need to insert as penultimate rule for input & forward & postrouting since final rule might be a fw3 REJECT
+    iptables_prepend_rule "$IPTABLES" filter "zone_${ext_zone}_input" MINIUPNPD
+    iptables_prepend_rule "$IPTABLES" filter "zone_${ext_zone}_forward" MINIUPNPD
+    $IPTABLES -t nat -A "zone_${ext_zone}_prerouting"  -j MINIUPNPD
+    iptables_prepend_rule "$IPTABLES" nat "zone_${ext_zone}_postrouting" MINIUPNPD-POSTROUTING
+
+    # IPv6 if available - filter only
+    [ -x $IP6TABLES ] && {
+	iptables_prepend_rule "$IP6TABLES" filter "zone_${ext_zone}_input" MINIUPNPD
+	iptables_prepend_rule "$IP6TABLES" filter "zone_${ext_zone}_forward" MINIUPNPD
+    }
+    ADDED=$(($ADDED + 1))
+}
+
+# By default, user configuration is king.
+
+for ext_iface in $(uci -q get upnpd.config.external_iface); do
+    add_extzone_rules $(fw3 -q network "$ext_iface")
+done
+
+add_extzone_rules $(uci -q get upnpd.config.external_zone)
+
+[ "$ADDED" -ne 0 ] && exit 0
+
+# If really nothing is available, resort to network_find_wan{,6} and
+# assume external interfaces all have same firewall zone.
+
+# (This heuristic may fail horribly, in case of e.g. multihoming, so
+# please set external_zone in that case!)
+
+network_find_wan wan_iface
+network_find_wan6 wan6_iface
+
+for ext_iface in $wan_iface $wan6_iface; do
+    # fw3 -q network fails on sub-interfaces => map to device first
+    network_get_device ext_device $ext_iface
+    add_extzone_rules $(fw3 -q device "$ext_device")
+done

miniupnpd/files/miniupnpd.defaults.iptables

@@ -0,0 +1,13 @@
+#!/bin/sh
+
+uci -q batch <<-EOT
+	delete firewall.miniupnpd
+	set firewall.miniupnpd=include
+	set firewall.miniupnpd.type=script
+	set firewall.miniupnpd.path=/usr/share/miniupnpd/firewall.include
+	set firewall.miniupnpd.family=any
+	set firewall.miniupnpd.reload=1
+	commit firewall
+EOT
+
+exit 0

miniupnpd/files/miniupnpd.hotplug

@@ -0,0 +1,45 @@
+/etc/init.d/miniupnpd enabled || exit 0
+
+# If miniupnpd is not running:
+# - check on _any_ event (event updates may contribute to network_find_wan*)
+
+# If miniupnpd _is_ running:
+# - check only on ifup (otherwise lease updates etc would cause
+#   miniupnpd state loss)
+
+[ "$ACTION" != "ifup" ] && /etc/init.d/miniupnpd running && exit 0
+
+tmpconf="/var/etc/miniupnpd.conf"
+external_iface=$(uci -q get upnpd.config.external_iface)
+external_iface6=$(uci -q get upnpd.config.external_iface6)
+external_zone=$(uci -q get upnpd.config.external_zone)
+[ -x "$(command -v nft)" ] && FW="fw4" || FW="fw3"
+
+. /lib/functions/network.sh
+
+if [ -n "$external_iface" ] ; then
+	network_get_device ifname "$external_iface"
+else
+	if [ -n "$external_zone" ] ; then
+		ifname=$($FW -q zone "$external_zone" 2>/dev/null | head -1)
+	else
+		network_find_wan external_iface && \
+			network_get_device ifname "$external_iface"
+	fi
+fi
+if [ -n "$external_iface6" ] ; then
+	network_get_device ifname6 "$external_iface6"
+else
+	if [ -n "$external_zone" ] ; then
+		ifname6=$($FW -q zone "$external_zone" 2>/dev/null | head -1)
+	else
+		network_find_wan6 external_iface6 && \
+			network_get_device ifname6 "$external_iface6"
+	fi
+fi
+
+[ "$DEVICE" != "$ifname" ] && [ "$DEVICE" != "$ifname6" ] && exit 0
+
+grep -qs "^ext_ifname=$ifname" "$tmpconf" && grep -qs "^ext_ifname6=$ifname6" "$tmpconf" && exit 0
+
+/etc/init.d/miniupnpd restart

miniupnpd/files/miniupnpd.init

@@ -0,0 +1,227 @@
+#!/bin/sh /etc/rc.common
+# Copyright (C) 2006-2014 OpenWrt.org
+
+START=94
+STOP=15
+USE_PROCD=1
+PROG=/usr/sbin/miniupnpd
+[ -x "$(command -v nft)" ] && FW="fw4" || FW="fw3"
+
+upnpd_get_port_range() {
+	local var="$1"; shift
+	local val
+
+	config_get val "$@"
+
+	case "$val" in
+		[0-9]*[:-][0-9]*)
+			export -n -- "${var}_start=${val%%[:-]*}"
+			export -n -- "${var}_end=${val##*[:-]}"
+		;;
+		[0-9]*)
+			export -n -- "${var}_start=$val"
+			export -n -- "${var}_end="
+		;;
+	esac
+}
+
+conf_rule_add() {
+	local cfg="$1"
+	local action int_addr
+	local ext_start ext_end int_start int_end comment
+
+	config_get action "$cfg" action "deny"                # allow or deny
+	upnpd_get_port_range "ext" "$cfg" ext_ports "0-65535" # external ports: x, x-y, x:y
+	config_get int_addr "$cfg" int_addr "0.0.0.0/0"       # ip or network and subnet mask (internal)
+	upnpd_get_port_range "int" "$cfg" int_ports "0-65535" # internal ports: x, x-y, x:y or range
+	config_get comment "$cfg" comment "ACL"		      # comment
+
+	# Make a single IP IP/32 so that miniupnpd.conf can use it.
+	[ "${int_addr%/*}" = "$int_addr" ] && int_addr="$int_addr/32"
+
+	echo "$action $ext_start${ext_end:+-}$ext_end $int_addr $int_start${int_end:+-}$int_end #$comment"
+}
+
+upnpd_write_bool() {
+	local opt="$1"
+	local def="${2:-0}"
+	local alt="${3:-$opt}"
+	local val
+
+	config_get_bool val config "$opt" "$def"
+	if [ "$val" -eq 0 ]; then
+		echo "$alt=no"
+	else
+		echo "$alt=yes"
+	fi
+}
+
+upnpd() {
+	config_load "upnpd"
+	local external_iface external_iface6 external_zone external_ip internal_iface
+	local upload download log_output port config_file serial_number model_number
+	local use_stun stun_host stun_port uuid notify_interval presentation_url
+	local upnp_lease_file ipv6_disable force_forwarding
+
+	local enabled
+	config_get_bool enabled config enabled 1
+	[ "$enabled" -eq 0 ] && return 1
+
+	config_get external_iface config external_iface
+	config_get external_iface6 config external_iface6
+	config_get external_zone config external_zone
+	config_get external_ip config external_ip
+	config_get internal_iface config internal_iface
+	config_get port config port 5000
+	config_get upload config upload
+	config_get download config download
+	config_get_bool log_output config log_output 0
+	config_get config_file config config_file
+	config_get serial_number config serial_number
+	config_get model_number config model_number
+	config_get uuid config uuid
+	config_get use_stun config use_stun 0
+	config_get stun_host config stun_host
+	config_get stun_port config stun_port
+	config_get notify_interval config notify_interval
+	config_get presentation_url config presentation_url
+	config_get upnp_lease_file config upnp_lease_file
+	config_get ipv6_disable config ipv6_disable 0
+	config_get force_forwarding config force_forwarding 0
+
+	local conf ifname ifname6
+
+	. /lib/functions/network.sh
+
+	if [ -n "$external_iface" ] ; then
+		network_get_device ifname "$external_iface"
+	else
+		if [ -n "$external_zone" ] ; then
+			ifname=$($FW -q zone "$external_zone" 2>/dev/null | head -1)
+		else
+			network_find_wan external_iface && \
+				network_get_device ifname "$external_iface"
+		fi
+	fi
+	if [ -n "$external_iface6" ] ; then
+		network_get_device ifname6 "$external_iface6"
+	else
+		if [ -n "$external_zone" ] ; then
+			ifname6=$($FW -q zone "$external_zone" 2>/dev/null | head -1)
+		else
+			network_find_wan6 external_iface6 && \
+				network_get_device ifname6 "$external_iface6"
+		fi
+	fi
+
+	if [ -n "$config_file" ]; then
+		conf="$config_file"
+	else
+		local tmpconf="/var/etc/miniupnpd.conf"
+		conf="$tmpconf"
+		mkdir -p /var/etc
+
+		{
+		echo "ext_ifname=$ifname"
+		echo "ext_ifname6=$ifname6"
+		[ -n "$external_ip" ] && echo "ext_ip=$external_ip"
+
+		local iface
+		for iface in ${internal_iface:-lan}; do
+			local device
+			network_get_device device "$iface" && echo "listening_ip=$device"
+		done
+
+		config_load "upnpd"
+		upnpd_write_bool enable_natpmp 1 enable_pcp_pmp
+		upnpd_write_bool enable_upnp 1
+		upnpd_write_bool secure_mode 1
+		upnpd_write_bool system_uptime 1
+		upnpd_write_bool igdv1 0 force_igd_desc_v1
+		upnpd_write_bool use_stun 0 ext_perform_stun
+		upnpd_write_bool ipv6_disable $ipv6_disable
+		upnpd_write_bool ext_allow_private_ipv4 $force_forwarding
+
+		[ "$use_stun" -eq 0 ] || {
+			[ -n "$stun_host" ] && echo "ext_stun_host=$stun_host"
+			[ -n "$stun_port" ] && echo "ext_stun_port=$stun_port"
+		}
+
+		[ -n "$upload" ] && [ -n "$download" ] && {
+			echo "bitrate_down=$((download * 1024 * 8))"
+			echo "bitrate_up=$((upload * 1024 * 8))"
+		}
+
+		[ -n "$upnp_lease_file" ] && touch "$upnp_lease_file" && echo "lease_file=$upnp_lease_file"
+		[ -n "$presentation_url" ] && echo "presentation_url=$presentation_url"
+		[ -n "$notify_interval" ] && echo "notify_interval=$notify_interval"
+		[ -n "$serial_number" ] && echo "serial=$serial_number"
+		[ -n "$model_number" ] && echo "model_number=$model_number"
+		[ -n "$port" ] && echo "port=$port"
+
+		[ -z "$uuid" ] && {
+			uuid="$(cat /proc/sys/kernel/random/uuid)"
+			uci set upnpd.config.uuid="$uuid"
+			uci commit upnpd
+		}
+
+		[ "$uuid" = "nocli" ] || echo "uuid=$uuid"
+
+		config_foreach conf_rule_add perm_rule
+
+		if [ "$FW" = "fw4" ]; then
+			#When using nftables configure miniupnpd to use its own table and chains
+			echo "upnp_table_name=fw4"
+			echo "upnp_nat_table_name=fw4"
+			echo "upnp_forward_chain=upnp_forward"
+			echo "upnp_nat_chain=upnp_prerouting"
+			echo "upnp_nat_postrouting_chain=upnp_postrouting"
+		fi
+
+		} > "$tmpconf"
+	fi
+
+	if [ -n "$ifname" ]; then
+		# start firewall
+		if [ "$FW" = "fw4" ]; then
+			nft -s -t -n list chain inet fw4 upnp_forward >/dev/null 2>&1 || fw4 reload
+		else
+			iptables -L MINIUPNPD >/dev/null 2>&1 || fw3 reload
+		fi
+	else
+		logger -t "upnp daemon" "external interface not found, not starting"
+	fi
+
+	procd_open_instance
+	procd_set_param file "$conf" "/etc/config/firewall"
+	procd_set_param command "$PROG"
+	procd_append_param command -f "$conf"
+	[ "$log_output" = "1" ] && procd_append_param command -d
+	procd_close_instance
+}
+
+stop_service() {
+	if [ "$FW" = "fw3" ]; then
+		iptables -t nat -F MINIUPNPD 2>/dev/null
+		iptables -t nat -F MINIUPNPD-POSTROUTING 2>/dev/null
+		iptables -t filter -F MINIUPNPD 2>/dev/null
+		[ -x /usr/sbin/ip6tables ] && ip6tables -t filter -F MINIUPNPD 2>/dev/null
+	else
+		nft flush chain inet fw4 upnp_forward 2>/dev/null
+		nft flush chain inet fw4 upnp_prerouting 2>/dev/null
+		nft flush chain inet fw4 upnp_postrouting 2>/dev/null
+	fi
+}
+
+start_service() {
+	config_load "upnpd"
+	config_foreach upnpd "upnpd"
+}
+
+service_triggers() {
+	procd_add_reload_trigger "upnpd"
+}
+
+reload_service() {
+	restart
+}

miniupnpd/files/nftables.d/chain-post/dstnat/20-miniupnpd.nft

@@ -0,0 +1 @@
+jump upnp_prerouting comment "Hook into miniupnpd prerouting chain";

miniupnpd/files/nftables.d/chain-post/forward/20-miniupnpd.nft

@@ -0,0 +1 @@
+jump upnp_forward comment "Hook into miniupnpd forwarding chain";

miniupnpd/files/nftables.d/chain-post/srcnat/20-miniupnpd.nft

@@ -0,0 +1 @@
+jump upnp_postrouting comment "Hook into miniupnpd postrouting chain";

miniupnpd/files/nftables.d/table-post/20-miniupnpd.nft

@@ -0,0 +1,3 @@
+chain upnp_forward {}
+chain upnp_prerouting {}
+chain upnp_postrouting {}

miniupnpd/files/upnpd.config

@@ -0,0 +1,33 @@
+config upnpd config
+	option enabled		1
+	option enable_natpmp	1
+	option enable_upnp	1
+	option secure_mode	1
+	option log_output	0
+	option download		20480
+	option upload		2048
+#by default, looked up dynamically from ubus
+#	option external_iface	wan
+	option internal_iface	lan
+	option port		5000
+	option upnp_lease_file	/var/run/miniupnpd.leases
+	option igdv1		1
+	option ipv6_disable	1
+	option use_stun		1
+	option stun_host	stun.miwifi.com
+	option stun_port	3478
+	option force_forwarding	1
+
+config perm_rule
+	option action		allow
+	option ext_ports	1024-65535
+	option int_addr		0.0.0.0/0	# Does not override secure_mode
+	option int_ports	1024-65535
+	option comment		"Allow high ports"
+
+config perm_rule
+	option action		deny
+	option ext_ports	0-65535
+	option int_addr		0.0.0.0/0
+	option int_ports	0-65535
+	option comment		"Default deny"