Skip to content

Commit 130cf62

Browse files
Self-Hosting-GroupSelf-Hosting-Group
committed
miniupnpd: using uci-defaults for migration
(proposed for inclusion, to merge with prior) Signed-off-by: Self-Hosting-Group <[email protected]>
1 parent 4c52475 commit 130cf62

File tree

3 files changed

+245
-238
lines changed

3 files changed

+245
-238
lines changed

‎net/miniupnpd/Makefile‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -96,8 +96,10 @@ define Package/miniupnpd/install/Default
9696
$(INSTALL_DIR) $(1)/etc/init.d
9797
$(INSTALL_DIR) $(1)/etc/config
9898
$(INSTALL_DIR) $(1)/etc/hotplug.d/iface
99+
$(INSTALL_DIR) $(1)/etc/uci-defaults
99100
$(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/sbin/miniupnpd $(1)/usr/sbin/miniupnpd
100101
$(INSTALL_BIN) ./files/miniupnpd.init $(1)/etc/init.d/miniupnpd
102+
$(INSTALL_BIN) ./files/upnpd-migration.uci-defaults $(1)/etc/uci-defaults
101103
$(INSTALL_CONF) ./files/upnpd.config $(1)/etc/config/upnpd
102104
$(INSTALL_DATA) ./files/miniupnpd.hotplug $(1)/etc/hotplug.d/iface/50-miniupnpd
103105
endef

‎net/miniupnpd/files/miniupnpd.init‎

Lines changed: 1 addition & 238 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ PROG=/usr/sbin/miniupnpd
88
[ -x "$(command -v nft)" ] && FW="fw4" || FW="fw3"
99

1010
start_service() {
11-
upnpd_uci_migration
11+
[ -f "/etc/uci-defaults/upnpd-migration.uci-defaults" ] && sh /etc/uci-defaults/upnpd-migration.uci-defaults
1212

1313
config_load "upnpd"
1414
local enabled config_file log_output conf
@@ -273,240 +273,3 @@ upnpd_add_custom_acl_entry() {
273273
[ "$action" = "" ] && log "Custom ACL: Entry with no action ignored" daemon.warn && return 0
274274
echo "$action $ext_port $int_addr $int_port${descr_filter} # $comment"
275275
}
276-
277-
upnpd_uci_migration() {
278-
{ uci -q get upnpd.settings >/dev/null || ! uci -q get upnpd.config >/dev/null; } && return 0
279-
log "Check UCI options in /etc/config/upnpd to be migrated to v2.0"
280-
281-
# Set missing enabled option to fix previously different defaults in LuCI/config (0) and init UCI (1)
282-
if ! uci -q get upnpd.config.enabled >/dev/null; then
283-
uci -q set upnpd.config.enabled="1"
284-
fi
285-
286-
# Migrate boolean options to only use 0/1 for LuCI support
287-
for option in enabled ipv6_disable system_uptime; do
288-
if uci -q get upnpd.config.$option >/dev/null; then
289-
uci get upnpd.config.$option | grep -q -E -x "0|off|false|no|disabled" && uci set upnpd.config.$option="0"
290-
uci get upnpd.config.$option | grep -q -E -x "1|on|true|yes|enabled" && uci set upnpd.config.$option="1"
291-
fi
292-
done
293-
294-
# Migrate enable_upnp/enable_natpmp -> enabled_protocols: Combined option
295-
if uci -q get upnpd.config.enable_upnp >/dev/null || uci -q get upnpd.config.enable_natpmp >/dev/null; then
296-
log "enable_upnp/enable_natpmp -> enabled_protocols: Combined option"
297-
if ! uci -q get upnpd.config.enable_upnp | grep -q -E -x "0|off|false|no|disabled"; then
298-
uci -q get upnpd.config.enable_natpmp | grep -q -E -x "0|off|false|no|disabled" &&
299-
uci set upnpd.config.enabled_protocols="upnp-igd" ||
300-
uci set upnpd.config.enabled_protocols="all"
301-
elif ! uci -q get upnpd.config.enable_natpmp | grep -q -E -x "0|off|false|no|disabled"; then
302-
uci set upnpd.config.enabled_protocols="pcp+nat-pmp"
303-
else
304-
uci set upnpd.config.enabled_protocols="all"
305-
uci set upnpd.config.enabled="0"
306-
fi
307-
uci -q delete upnpd.config.enable_upnp
308-
uci -q delete upnpd.config.enable_natpmp
309-
fi
310-
311-
# Rename use_stun -> allow_cgnat
312-
if uci -q get upnpd.config.use_stun >/dev/null; then
313-
log "use_stun -> allow_cgnat"
314-
uci rename upnpd.config.use_stun="allow_cgnat"
315-
fi
316-
317-
# Migrate force_forwarding=1 -> allow_cgnat=allow-filtered:
318-
# Option from X-Wrt (since 2021) gets migrated to new similar daemon option for cross-project upgrades
319-
if uci -q get upnpd.config.force_forwarding >/dev/null; then
320-
log "force_forwarding=1 -> allow_cgnat=allow-filtered: Migrate to new daemon option"
321-
uci get upnpd.config.force_forwarding | grep -q -E -x "1|on|true|yes|enabled" &&
322-
uci set upnpd.config.allow_cgnat="allow-filtered"
323-
uci delete upnpd.config.force_forwarding
324-
fi
325-
326-
# Remove known incompatible (not CGNAT filtering test capable) STUN servers and include stun_port in stun_host
327-
if uci -q get upnpd.config.stun_host | grep -q -E "stun[0-9]?.l.google.com|stun.cloudflare.com"; then
328-
log "stun_host: Incompatible STUN server ($(uci -q get upnpd.config.stun_host)) found, remove to set default"
329-
uci delete upnpd.config.stun_host
330-
uci -q delete upnpd.config.stun_port
331-
elif uci -q get upnpd.config.stun_port >/dev/null; then
332-
uci -q get upnpd.config.stun_host >/dev/null && [ "$(uci -q get upnpd.config.stun_port)" != "3478" ] &&
333-
log "stun_port: Include stun_port in stun_host, and remove option" &&
334-
uci set upnpd.config.stun_host="$(uci -q get upnpd.config.stun_host | cut -d ":" -f 1):$(uci -q get upnpd.config.stun_port)"
335-
uci delete upnpd.config.stun_port
336-
fi
337-
338-
# Migrate secure_mode=1/0 -> allow_third_party_mapping=0/upnp-igd: Invert/extend to PCP
339-
if uci -q get upnpd.config.secure_mode >/dev/null; then
340-
log "secure_mode=1/0 -> allow_third_party_mapping=0/upnp-igd: Invert/extend to PCP"
341-
uci get upnpd.config.secure_mode | grep -q -E -x "0|off|false|no|disabled" &&
342-
uci set upnpd.config.allow_third_party_mapping="upnp-igd" ||
343-
uci set upnpd.config.allow_third_party_mapping="0"
344-
uci delete upnpd.config.secure_mode
345-
fi
346-
347-
# Migrate log_output=1/0 -> log_output=debug/default: Now info also allowed
348-
if uci -q get upnpd.config.log_output >/dev/null; then
349-
uci get upnpd.config.log_output | grep -q -E -x "1|on|true|yes|enabled" &&
350-
log "log_output=1 -> log_output=debug: Now info also allowed" &&
351-
uci set upnpd.config.log_output="debug"
352-
uci get upnpd.config.log_output | grep -q -E -x "0|off|false|no|disabled" &&
353-
uci set upnpd.config.log_output="default"
354-
fi
355-
356-
# Rename upnp_lease_file -> lease_file: To original daemon name, and remove if UCI default
357-
if uci -q get upnpd.config.upnp_lease_file >/dev/null; then
358-
if [ "$(uci -q get upnpd.config.upnp_lease_file)" = "/var/run/miniupnpd.leases" ]; then
359-
log "upnp_lease_file -> lease_file: Remove option as UCI default is set"
360-
uci delete upnpd.config.upnp_lease_file
361-
else
362-
log "upnp_lease_file -> lease_file"
363-
uci rename upnpd.config.upnp_lease_file="lease_file"
364-
fi
365-
fi
366-
367-
# Migrate igdv1=1/0 -> upnp_igd_compat=igdv1/igdv2: Extensible/clearer
368-
if uci -q get upnpd.config.igdv1 >/dev/null; then
369-
log "igdv1=1/0 -> upnp_igd_compat=igdv1/igdv2"
370-
uci get upnpd.config.igdv1 | grep -q -E -x "1|on|true|yes|enabled" &&
371-
uci set upnpd.config.upnp_igd_compat="igdv1" ||
372-
uci set upnpd.config.upnp_igd_compat="igdv2"
373-
uci delete upnpd.config.igdv1
374-
fi
375-
376-
# Migrate download/upload -> download_kbps/upload_kbps: Convert to kbit/s
377-
if uci -q get upnpd.config.download >/dev/null; then
378-
download="$(uci -q get upnpd.config.download)"
379-
if [ "$download" != "1024" ] && [ "$download" -ge "1" ] 2>/dev/null; then
380-
log "download -> download_kbps: Convert to kbit/s"
381-
download_kbps="$((download * 8 * 1000 / 1024))"
382-
uci set upnpd.config.download_kbps="$download_kbps"
383-
fi
384-
uci delete upnpd.config.download
385-
fi
386-
if uci -q get upnpd.config.upload >/dev/null; then
387-
upload="$(uci -q get upnpd.config.upload)"
388-
if [ "$upload" != "512" ] && [ "$upload" -ge "1" ] 2>/dev/null; then
389-
log "upload -> upload_kbps: Convert to kbit/s"
390-
upload_kbps="$((upload * 8 * 1000 / 1024))"
391-
uci set upnpd.config.upload_kbps="$upload_kbps"
392-
fi
393-
uci delete upnpd.config.upload
394-
fi
395-
396-
# Rename port -> http_port: Remove if UCI default
397-
if uci -q get upnpd.config.port >/dev/null; then
398-
if [ "$(uci -q get upnpd.config.port)" = "5000" ]; then
399-
log "port -> http_port: Remove option as UCI default is set"
400-
uci delete upnpd.config.port
401-
else
402-
log "port -> http_port"
403-
uci rename upnpd.config.port="http_port"
404-
fi
405-
fi
406-
407-
# Migrate notify_interval <=900s: Remove to set minimum of 900 (default)
408-
if [ "$(uci -q get upnpd.config.notify_interval)" -le "900" ] 2>/dev/null; then
409-
log "notify_interval <=900s: Remove to set minimum of 900 (default)"
410-
uci delete upnpd.config.notify_interval
411-
fi
412-
413-
# Migrate custom ACL to new section, note that an empty ACL is now rejected alone
414-
# a) Empty/unmodified ACL: Enable appropriate preset, add/update template entries
415-
# b) Modified ACL:
416-
# - Add missing entry action to avoid adding inverted actions when changing via LuCI
417-
# - Update entry action allow/deny -> accept/reject
418-
# - Update entry port options to only use the LuCI (and daemon) supported hyphen (-) as port range separator
419-
# - Not using an preset, add template entries
420-
! uci -q get upnpd.@acl_entry[0] >/dev/null && if ! uci -q get upnpd.@perm_rule[0] >/dev/null; then
421-
log "Empty ACL: Enable preset, add templates, empty ACL now rejected alone"
422-
access_preset=accept-all-ports
423-
addtemplateentries=1
424-
elif ! uci -q get upnpd.@perm_rule[2] >/dev/null &&
425-
[ "$(uci -q get upnpd.@perm_rule[0].int_addr)" = "0.0.0.0/0" ] &&
426-
[ "$(uci -q get upnpd.@perm_rule[0].int_ports)" = "1024-65535" ] &&
427-
[ "$(uci -q get upnpd.@perm_rule[0].ext_ports)" = "1024-65535" ] &&
428-
[ "$(uci -q get upnpd.@perm_rule[0].action)" = "allow" ] &&
429-
[ "$(uci -q get upnpd.@perm_rule[1].int_addr)" = "0.0.0.0/0" ] &&
430-
[ "$(uci -q get upnpd.@perm_rule[1].int_ports)" = "0-65535" ] &&
431-
[ "$(uci -q get upnpd.@perm_rule[1].ext_ports)" = "0-65535" ] &&
432-
[ "$(uci -q get upnpd.@perm_rule[1].action)" = "deny" ]; then
433-
log "Unmodified ACL: Enable preset, update templates, empty ACL rejected"
434-
access_preset=accept-high-ports
435-
addtemplateentries=1
436-
uci delete upnpd.@perm_rule[-1]
437-
uci delete upnpd.@perm_rule[-1]
438-
else
439-
log "Modified ACL: Update ACL entry action/section, empty ACL now rejected"
440-
access_preset=0
441-
addtemplateentries=1
442-
entrynr=0
443-
while uci -q get upnpd.@perm_rule[$entrynr] >/dev/null; do
444-
comment="$(uci -q get upnpd.@perm_rule[$entrynr].comment)"
445-
int_addr="$(uci -q get upnpd.@perm_rule[$entrynr].int_addr)"
446-
int_port="$(uci -q get upnpd.@perm_rule[$entrynr].int_ports)"
447-
ext_port="$(uci -q get upnpd.@perm_rule[$entrynr].ext_ports)"
448-
action="$(uci -q get upnpd.@perm_rule[$entrynr].action)"
449-
echo "$int_port" | grep -q ":" &&
450-
log "Modified ACL: Update entry int_port to only use a hyphen (-) as port range separator" &&
451-
int_port="$(echo "$int_port" | tr ":" "-")"
452-
echo "$ext_port" | grep -q ":" &&
453-
log "Modified ACL: Update entry ext_port to only use a hyphen (-) as port range separator" &&
454-
ext_port="$(echo "$ext_port" | tr ":" "-")"
455-
[ "$action" = "" ] && log "Modified ACL: Add missing entry action" && action=reject
456-
[ "$action" = "allow" ] && action=accept
457-
[ "$action" = "deny" ] && action=reject
458-
uci batch >/dev/null <<-EOF
459-
add upnpd acl_entry
460-
set upnpd.@acl_entry[-1].comment="${comment:-unspecified}"
461-
set upnpd.@acl_entry[-1].int_addr="${int_addr:-0.0.0.0/0}"
462-
set upnpd.@acl_entry[-1].int_port="$int_port"
463-
set upnpd.@acl_entry[-1].ext_port="$ext_port"
464-
set upnpd.@acl_entry[-1].action="$action"
465-
EOF
466-
entrynr=$((entrynr + 1))
467-
done
468-
[ "$int_addr" = "0.0.0.0/0" ] && [ "$int_port" = "0-65535" ] &&
469-
[ "$ext_port" = "0-65535" ] && [ "$action" = "reject" ] &&
470-
uci delete upnpd.@acl_entry[-1]
471-
while uci -q delete upnpd.@perm_rule[-1]; do :; done
472-
fi
473-
if [ "$addtemplateentries" = "1" ]; then
474-
uci batch >/dev/null <<-EOF
475-
add upnpd acl_entry
476-
add upnpd acl_entry
477-
set upnpd.@acl_entry[-2].comment="High ports"
478-
set upnpd.@acl_entry[-2].int_addr="0.0.0.0/0"
479-
set upnpd.@acl_entry[-2].int_port="1024-65535"
480-
set upnpd.@acl_entry[-2].ext_port="1024-65535"
481-
set upnpd.@acl_entry[-2].action="ignore"
482-
set upnpd.@acl_entry[-1].comment="Low/system ports"
483-
set upnpd.@acl_entry[-1].int_addr="0.0.0.0/0"
484-
set upnpd.@acl_entry[-1].int_port="1-1023"
485-
set upnpd.@acl_entry[-1].ext_port="1-1023"
486-
set upnpd.@acl_entry[-1].action="ignore"
487-
EOF
488-
uci -q get upnpd.@acl_entry[-3] >/dev/null &&
489-
uci reorder upnpd.@acl_entry[-2]=0 && uci reorder upnpd.@acl_entry[-1]=1
490-
fi
491-
492-
# Migrate internal_iface option to new internal_network section
493-
if ! uci -q get upnpd.@internal_network[0] >/dev/null; then
494-
ifnr=0
495-
for interface in $(uci -q get upnpd.config.internal_iface || echo lan); do
496-
log "Create new internal_network section for $interface"
497-
uci add upnpd internal_network >/dev/null
498-
uci set upnpd.@internal_network[$ifnr].interface="$interface"
499-
[ "$access_preset" != "" ] && uci set upnpd.@internal_network[$ifnr].access_preset="$access_preset"
500-
ifnr=$((ifnr + 1))
501-
done
502-
uci -q delete upnpd.config.internal_iface
503-
fi
504-
505-
# Finally rename section config -> settings (v2.0)
506-
if uci -q get upnpd.config >/dev/null; then
507-
log "Rename section config -> settings (v2.0)" && uci rename upnpd.config="settings" ||
508-
log "Error renaming the UCI section" daemon.err
509-
fi
510-
511-
uci commit upnpd >/dev/null
512-
}

0 commit comments

Comments
 (0)