script/_nat64 - external/github.com/openthread/borderrouter - Git at Google

 #!/bin/bash
 #
 #  Copyright (c) 2017, The OpenThread Authors.
 #  All rights reserved.
 #
 #  Redistribution and use in source and binary forms, with or without
 #  modification, are permitted provided that the following conditions are met:
 #  1. Redistributions of source code must retain the above copyright
 #     notice, this list of conditions and the following disclaimer.
 #  2. Redistributions in binary form must reproduce the above copyright
 #     notice, this list of conditions and the following disclaimer in the
 #     documentation and/or other materials provided with the distribution.
 #  3. Neither the name of the copyright holder nor the
 #     names of its contributors may be used to endorse or promote products
 #     derived from this software without specific prior written permission.
 #
 #  THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
 #  AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 #  IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 #  ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
 #  LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
 #  CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
 #  SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
 #  INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
 #  CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 #  ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 #  POSSIBILITY OF SUCH DAMAGE.
 #
 #   Description:
 #       This script manipulates nat64 configuration.
 #

 NAT44_SERVICE=/etc/init.d/otbr-nat44
 WLAN_IFNAMES="${INFRA_IF_NAME:-eth0}"
 THREAD_IF="${THREAD_IF:-wpan0}"

 # When otbr-agent is built with the opt-in in-process nftables firewall
 # backend (-DOTBR_NFTABLES=ON), it installs the NAT44 masquerade rules
 # itself, so the legacy iptables otbr-nat44 service must not duplicate them.
 # The build records which backend it chose in a marker file; an explicit
 # OTBR_NFTABLES in the environment overrides it.
 OTBR_NFTABLES_MARKER="/usr/share/otbr/nftables-backend"
 if [ -z "${OTBR_NFTABLES:-}" ]; then
     # The marker carries the value the build decided, not just its presence:
     # installing does not uninstall, so a file that could only say "on" would
     # outlive a rebuild with the option turned back off. Anything missing or
     # unrecognised means the legacy path, which over-filters rather than
     # leaving the router with no ingress filter at all.
     OTBR_NFTABLES=0
     if [ -r "${OTBR_NFTABLES_MARKER}" ] && grep -qx '1' "${OTBR_NFTABLES_MARKER}"; then
         OTBR_NFTABLES=1
     fi
 fi

 nat44_install()
 {
     if [ "${OTBR_NFTABLES}" = "1" ]; then
         echo "OTBR_NFTABLES=1: NAT44 masquerade is managed in-process (nftables); installing only the forwarding authorization."
     fi

     sudo tee $NAT44_SERVICE <<EOF
 #! /bin/sh
 #
 #  Copyright (c) 2017, The OpenThread Authors.
 #  All rights reserved.
 #
 #  Redistribution and use in source and binary forms, with or without
 #  modification, are permitted provided that the following conditions are met:
 #  1. Redistributions of source code must retain the above copyright
 #     notice, this list of conditions and the following disclaimer.
 #  2. Redistributions in binary form must reproduce the above copyright
 #     notice, this list of conditions and the following disclaimer in the
 #     documentation and/or other materials provided with the distribution.
 #  3. Neither the name of the copyright holder nor the
 #     names of its contributors may be used to endorse or promote products
 #     derived from this software without specific prior written permission.
 #
 #  THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
 #  AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 #  IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 #  ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
 #  LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
 #  CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
 #  SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
 #  INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
 #  CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 #  ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 #  POSSIBILITY OF SUCH DAMAGE.
 #
 ### BEGIN INIT INFO
 # Provides:          otbr-nat44
 # Required-Start:
 # Required-Stop:
 # Should-Start:
 # Should-Stop:
 # Default-Start:     2 3 4 5
 # Default-Stop:
 # Short-Description: iptables NAT44
 # Description:       NAT44 is require for OpenThread border router
 #                    to connect to arbitrary IPv4 endpoints.
 ### END INIT INFO

 . /lib/lsb/init-functions
 . /lib/init/vars.sh

 case "\$1" in
     start)
 EOF
     if [ "${OTBR_NFTABLES}" != "1" ]; then
         # Just a random fwmark bits.
         echo "        iptables -t mangle -A PREROUTING -i $THREAD_IF -j MARK --set-mark 0x1001" | sudo tee -a $NAT44_SERVICE
         echo "        iptables -t nat -A POSTROUTING -m mark --mark 0x1001 -j MASQUERADE" | sudo tee -a $NAT44_SERVICE
     fi
     # The forwarding authorization is installed in both modes, the same way the
     # Docker run script does it. The in-process backend cannot provide it: its
     # rules live in an isolated `inet otbr` table, where an accept is not
     # terminal for the hook, so a host with a DROP forward policy would still
     # drop the traffic the masquerade is there to translate (see #3515).
     for IFNAME in $WLAN_IFNAMES; do
         echo "        iptables -t filter -A FORWARD -o $IFNAME -j ACCEPT" | sudo tee -a $NAT44_SERVICE
         echo "        iptables -t filter -A FORWARD -i $IFNAME -j ACCEPT" | sudo tee -a $NAT44_SERVICE
     done
     sudo tee -a $NAT44_SERVICE <<EOF
         ;;
     restart|reload|force-reload)
         echo "Error: argument '\$1' not supported" >&2
         exit 3
         ;;
     stop|status)
         # No-op
         ;;
     *)
         echo "Usage: \$0 start|stop" >&2
         exit 3
         ;;
 esac
 EOF
     sudo chmod a+x $NAT44_SERVICE
     if have systemctl; then
         sudo systemctl enable otbr-nat44 || die 'Unable to enable nat44 service!'
         sudo systemctl start otbr-nat44 || die 'Failed to start nat44 service!'
     fi
 }

 nat44_uninstall()
 {
     if have systemctl; then
         sudo systemctl disable otbr-nat44 || true
     fi

     # systemctl disable doesn't remove sym-links
     if have update-rc.d; then
         sudo update-rc.d otbr-nat44 remove || true
     fi
     test ! -f $NAT44_SERVICE || sudo rm $NAT44_SERVICE
 }

 nat44_start()
 {
     if with DOCKER; then
         service otbr-nat44 start || die 'Failed to start NAT44!'
     elif have systemctl; then
         sudo systemctl start otbr-nat44 || die 'Failed to start NAT44!'
     fi
 }

 nat44_stop()
 {
     if with DOCKER; then
         service otbr-nat44 stop || true
     elif have systemctl; then
         sudo systemctl stop otbr-nat44 || true
     fi
 }

 nat64_install()
 {
     with NAT64 || return 0

     nat44_install
 }

 nat64_uninstall()
 {
     with NAT64 || return 0

     nat64_stop
     nat44_uninstall
 }

 nat64_start()
 {
     with NAT64 || return 0

     nat44_start
 }

 nat64_stop()
 {
     with NAT64 || return 0

     nat44_stop
 }
	#!/bin/bash
	#
	# Copyright (c) 2017, The OpenThread Authors.
	# All rights reserved.
	#
	# Redistribution and use in source and binary forms, with or without
	# modification, are permitted provided that the following conditions are met:
	# 1. Redistributions of source code must retain the above copyright
	# notice, this list of conditions and the following disclaimer.
	# 2. Redistributions in binary form must reproduce the above copyright
	# notice, this list of conditions and the following disclaimer in the
	# documentation and/or other materials provided with the distribution.
	# 3. Neither the name of the copyright holder nor the
	# names of its contributors may be used to endorse or promote products
	# derived from this software without specific prior written permission.
	#
	# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
	# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
	# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
	# ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
	# LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
	# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
	# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
	# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
	# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
	# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
	# POSSIBILITY OF SUCH DAMAGE.
	#
	# Description:
	# This script manipulates nat64 configuration.
	#

	NAT44_SERVICE=/etc/init.d/otbr-nat44
	WLAN_IFNAMES="${INFRA_IF_NAME:-eth0}"
	THREAD_IF="${THREAD_IF:-wpan0}"

	# When otbr-agent is built with the opt-in in-process nftables firewall
	# backend (-DOTBR_NFTABLES=ON), it installs the NAT44 masquerade rules
	# itself, so the legacy iptables otbr-nat44 service must not duplicate them.
	# The build records which backend it chose in a marker file; an explicit
	# OTBR_NFTABLES in the environment overrides it.
	OTBR_NFTABLES_MARKER="/usr/share/otbr/nftables-backend"
	if [ -z "${OTBR_NFTABLES:-}" ]; then
	# The marker carries the value the build decided, not just its presence:
	# installing does not uninstall, so a file that could only say "on" would
	# outlive a rebuild with the option turned back off. Anything missing or
	# unrecognised means the legacy path, which over-filters rather than
	# leaving the router with no ingress filter at all.
	OTBR_NFTABLES=0
	if [ -r "${OTBR_NFTABLES_MARKER}" ] && grep -qx '1' "${OTBR_NFTABLES_MARKER}"; then
	OTBR_NFTABLES=1
	fi
	fi

	nat44_install()
	{
	if [ "${OTBR_NFTABLES}" = "1" ]; then
	echo "OTBR_NFTABLES=1: NAT44 masquerade is managed in-process (nftables); installing only the forwarding authorization."
	fi

	sudo tee $NAT44_SERVICE <<EOF
	#! /bin/sh
	#
	# Copyright (c) 2017, The OpenThread Authors.
	# All rights reserved.
	#
	# Redistribution and use in source and binary forms, with or without
	# modification, are permitted provided that the following conditions are met:
	# 1. Redistributions of source code must retain the above copyright
	# notice, this list of conditions and the following disclaimer.
	# 2. Redistributions in binary form must reproduce the above copyright
	# notice, this list of conditions and the following disclaimer in the
	# documentation and/or other materials provided with the distribution.
	# 3. Neither the name of the copyright holder nor the
	# names of its contributors may be used to endorse or promote products
	# derived from this software without specific prior written permission.
	#
	# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
	# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
	# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
	# ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
	# LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
	# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
	# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
	# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
	# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
	# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
	# POSSIBILITY OF SUCH DAMAGE.
	#
	### BEGIN INIT INFO
	# Provides: otbr-nat44
	# Required-Start:
	# Required-Stop:
	# Should-Start:
	# Should-Stop:
	# Default-Start: 2 3 4 5
	# Default-Stop:
	# Short-Description: iptables NAT44
	# Description: NAT44 is require for OpenThread border router
	# to connect to arbitrary IPv4 endpoints.
	### END INIT INFO

	. /lib/lsb/init-functions
	. /lib/init/vars.sh

	case "\$1" in
	start)
	EOF
	if [ "${OTBR_NFTABLES}" != "1" ]; then
	# Just a random fwmark bits.
	echo " iptables -t mangle -A PREROUTING -i $THREAD_IF -j MARK --set-mark 0x1001" \| sudo tee -a $NAT44_SERVICE
	echo " iptables -t nat -A POSTROUTING -m mark --mark 0x1001 -j MASQUERADE" \| sudo tee -a $NAT44_SERVICE
	fi
	# The forwarding authorization is installed in both modes, the same way the
	# Docker run script does it. The in-process backend cannot provide it: its
	# rules live in an isolated `inet otbr` table, where an accept is not
	# terminal for the hook, so a host with a DROP forward policy would still
	# drop the traffic the masquerade is there to translate (see #3515).
	for IFNAME in $WLAN_IFNAMES; do
	echo " iptables -t filter -A FORWARD -o $IFNAME -j ACCEPT" \| sudo tee -a $NAT44_SERVICE
	echo " iptables -t filter -A FORWARD -i $IFNAME -j ACCEPT" \| sudo tee -a $NAT44_SERVICE
	done
	sudo tee -a $NAT44_SERVICE <<EOF
	;;
	restart\|reload\|force-reload)
	echo "Error: argument '\$1' not supported" >&2
	exit 3
	;;
	stop\|status)
	# No-op
	;;
	*)
	echo "Usage: \$0 start\|stop" >&2
	exit 3
	;;
	esac
	EOF
	sudo chmod a+x $NAT44_SERVICE
	if have systemctl; then
	sudo systemctl enable otbr-nat44 \|\| die 'Unable to enable nat44 service!'
	sudo systemctl start otbr-nat44 \|\| die 'Failed to start nat44 service!'
	fi
	}

	nat44_uninstall()
	{
	if have systemctl; then
	sudo systemctl disable otbr-nat44 \|\| true
	fi

	# systemctl disable doesn't remove sym-links
	if have update-rc.d; then
	sudo update-rc.d otbr-nat44 remove \|\| true
	fi
	test ! -f $NAT44_SERVICE \|\| sudo rm $NAT44_SERVICE
	}

	nat44_start()
	{
	if with DOCKER; then
	service otbr-nat44 start \|\| die 'Failed to start NAT44!'
	elif have systemctl; then
	sudo systemctl start otbr-nat44 \|\| die 'Failed to start NAT44!'
	fi
	}

	nat44_stop()
	{
	if with DOCKER; then
	service otbr-nat44 stop \|\| true
	elif have systemctl; then
	sudo systemctl stop otbr-nat44 \|\| true
	fi
	}

	nat64_install()
	{
	with NAT64 \|\| return 0

	nat44_install
	}

	nat64_uninstall()
	{
	with NAT64 \|\| return 0

	nat64_stop
	nat44_uninstall
	}

	nat64_start()
	{
	with NAT64 \|\| return 0

	nat44_start
	}

	nat64_stop()
	{
	with NAT64 \|\| return 0

	nat44_stop
	}