[people/pmueller/ipfire-2.x.git] / config / firewall / firewall-lib.pl

#!/usr/bin/perl
###############################################################################
#                                                                             #
# IPFire.org - A linux based firewall                                         #
# Copyright (C) 2013 Alexander Marx <amarx@ipfire.org>                        #
#                                                                             #
# This program is free software: you can redistribute it and/or modify        #
# it under the terms of the GNU General Public License as published by        #
# the Free Software Foundation, either version 3 of the License, or           #
# (at your option) any later version.                                         #
#                                                                             #
# This program is distributed in the hope that it will be useful,             #
# but WITHOUT ANY WARRANTY; without even the implied warranty of              #
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
# GNU General Public License for more details.                                #
#                                                                             #
# You should have received a copy of the GNU General Public License           #
# along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
#                                                                             #
###############################################################################

use strict;
no warnings 'uninitialized';

package fwlib;

my %customnetwork=();
my %customhost=();
my %customgrp=();
my %customservice=();
my %customservicegrp=();
my %ccdnet=();
my %ccdhost=();
my %ipsecconf=();
my %ipsecsettings=();
my %netsettings=();
my %ovpnsettings=();
my %aliases=();

require '/var/ipfire/general-functions.pl';

my $confignet		= "${General::swroot}/fwhosts/customnetworks";
my $confighost		= "${General::swroot}/fwhosts/customhosts";
my $configgrp 		= "${General::swroot}/fwhosts/customgroups";
my $configsrv 		= "${General::swroot}/fwhosts/customservices";
my $configsrvgrp	= "${General::swroot}/fwhosts/customservicegrp";
my $configccdnet 	= "${General::swroot}/ovpn/ccd.conf";
my $configccdhost	= "${General::swroot}/ovpn/ovpnconfig";
my $configipsec		= "${General::swroot}/vpn/config";
my $configovpn		= "${General::swroot}/ovpn/settings";
my $val;
my $field;
my $netsettings		= "${General::swroot}/ethernet/settings";

&General::readhash("/var/ipfire/ethernet/settings", \%netsettings);
&General::readhash("${General::swroot}/ovpn/settings", \%ovpnsettings);
&General::readhash("${General::swroot}/vpn/settings", \%ipsecsettings);

&General::readhasharray("$confignet", \%customnetwork);
&General::readhasharray("$confighost", \%customhost);
&General::readhasharray("$configgrp", \%customgrp);
&General::readhasharray("$configccdnet", \%ccdnet);
&General::readhasharray("$configccdhost", \%ccdhost);
&General::readhasharray("$configipsec", \%ipsecconf);
&General::readhasharray("$configsrv", \%customservice);
&General::readhasharray("$configsrvgrp", \%customservicegrp);
&General::get_aliases(\%aliases);

sub get_srv_prot
{
	my $val=shift;
	foreach my $key (sort {$a <=> $b} keys %customservice){
		if($customservice{$key}[0] eq $val){
			if ($customservice{$key}[0] eq $val){
				return $customservice{$key}[2];
			}
		}
	}
}
sub get_srvgrp_prot
{
	my $val=shift;
	my @ips=();
	my $tcp;
	my $udp;
	my $icmp;
	foreach my $key (sort {$a <=> $b} keys %customservicegrp){
		if($customservicegrp{$key}[0] eq $val){
			if (&get_srv_prot($customservicegrp{$key}[2]) eq 'TCP'){ 
				$tcp=1;
			}elsif(&get_srv_prot($customservicegrp{$key}[2]) eq 'UDP'){ 
				$udp=1;
			}elsif(&get_srv_prot($customservicegrp{$key}[2]) eq 'ICMP'){
				$icmp=1;
			}else{
				#Protocols used in servicegroups
				push (@ips,$customservicegrp{$key}[2]);
			}
		}
	}
	if ($tcp eq '1'){push (@ips,'TCP');}
	if ($udp eq '1'){push (@ips,'UDP');}
	if ($icmp eq '1'){push (@ips,'ICMP');}
	my $back=join(",",@ips);
	return $back;
	
}
sub get_srv_port
{
	my $val=shift;
	my $field=shift;
	my $prot=shift;
	foreach my $key (sort {$a <=> $b} keys %customservice){
		if($customservice{$key}[0] eq $val && $customservice{$key}[2] eq $prot){
			return $customservice{$key}[$field];
		}
	}
}
sub get_srvgrp_port
{
	my $val=shift;
	my $prot=shift;
	my $back;
	my $value;
	my @ips=();
	foreach my $key (sort {$a <=> $b} keys %customservicegrp){
		if($customservicegrp{$key}[0] eq $val){
			if ($prot ne 'ICMP'){
				$value=&get_srv_port($customservicegrp{$key}[2],1,$prot);
			}elsif ($prot eq 'ICMP'){
				$value=&get_srv_port($customservicegrp{$key}[2],3,$prot);
			}
			push (@ips,$value) if ($value ne '') ;
		}
	}
	if($prot ne 'ICMP'){
		if ($#ips gt 0){$back="-m multiport --dports ";}else{$back="--dport ";}
	}elsif ($prot eq 'ICMP'){
		$back="--icmp-type ";
	}
	
	$back.=join(",",@ips);
	return $back;
}
sub get_ipsec_net_ip
{
	my $val=shift;
	my $field=shift;
	foreach my $key (sort {$a <=> $b} keys %ipsecconf){
		if($ipsecconf{$key}[1] eq $val){
			return $ipsecconf{$key}[$field];
		}
	}
}
sub get_ipsec_host_ip
{
	my $val=shift;
	my $field=shift;
	foreach my $key (sort {$a <=> $b} keys %ipsecconf){
		if($ipsecconf{$key}[1] eq $val){
			return $ipsecconf{$key}[$field];
		}
	}
}
sub get_ovpn_n2n_ip
{
	my $val=shift;
	my $field=shift;
	foreach my $key (sort {$a <=> $b} keys %ccdhost){
		if($ccdhost{$key}[1] eq $val){
			return $ccdhost{$key}[$field];
		}
	}
}
sub get_ovpn_host_ip
{
	my $val=shift;
	my $field=shift;
	foreach my $key (sort {$a <=> $b} keys %ccdhost){
		if($ccdhost{$key}[1] eq $val){
			return $ccdhost{$key}[$field];
		}
	}
}
sub get_ovpn_net_ip
{
	
	my $val=shift;
	my $field=shift;
	foreach my $key (sort {$a <=> $b} keys %ccdnet){
		if($ccdnet{$key}[0] eq $val){
			return $ccdnet{$key}[$field];
		}
	}
}
sub get_grp_ip
{
	my $val=shift;
	my $src=shift;
	foreach my $key (sort {$a <=> $b} keys %customgrp){
		if ($customgrp{$key}[0] eq $val){
			&get_address($customgrp{$key}[3],$src);
		}
	}		
	
}
sub get_std_net_ip
{
	my $val=shift;
	my $con=shift;
	if ($val eq 'ALL'){
		return "0.0.0.0/0.0.0.0";
	}elsif($val eq 'GREEN'){
		return "$netsettings{'GREEN_NETADDRESS'}/$netsettings{'GREEN_NETMASK'}";
	}elsif($val eq 'ORANGE'){
		return "$netsettings{'ORANGE_NETADDRESS'}/$netsettings{'ORANGE_NETMASK'}";
	}elsif($val eq 'BLUE'){
		return "$netsettings{'BLUE_NETADDRESS'}/$netsettings{'BLUE_NETMASK'}";
	}elsif($val eq 'RED'){
		return "0.0.0.0/0 -o $con";
	}elsif($val =~ /OpenVPN/i){
		return "$ovpnsettings{'DOVPN_SUBNET'}";
	}elsif($val =~ /IPsec/i){
		return "$ipsecsettings{'RW_NET'}";
	}elsif($val eq 'IPFire'){
		return ;
	}
}
sub get_net_ip
{
	my $val=shift;
	foreach my $key (sort {$a <=> $b} keys %customnetwork){
		if($customnetwork{$key}[0] eq $val){
			return "$customnetwork{$key}[1]/$customnetwork{$key}[2]";
		}  
	}
}
sub get_host_ip
{
	my $val=shift;
	my $src=shift;
	foreach my $key (sort {$a <=> $b} keys %customhost){
		if($customhost{$key}[0] eq $val){
			if ($customhost{$key}[1] eq 'mac' && $src eq 'src'){
			return "-m mac --mac-source $customhost{$key}[2]";
			}elsif($customhost{$key}[1] eq 'ip' && $src eq 'src'){
				return "$customhost{$key}[2]";
			}elsif($customhost{$key}[1] eq 'ip' && $src eq 'tgt'){
				return "$customhost{$key}[2]";
			}elsif($customhost{$key}[1] eq 'mac' && $src eq 'tgt'){
				return "none";
			}
		}  
	}
}
sub get_addresses
{
	my $hash = shift;
	my $key  = shift;
	my $type = shift;

	my @addresses = ();
	my $addr_type;
	my $value;
	my $group_name;

	if ($type eq "src") {
		$addr_type = $$hash{$key}[3];
		$value = $$hash{$key}[4];

	} elsif ($type eq "tgt") {
		$addr_type = $$hash{$key}[5];
		$value = $$hash{$key}[6];
	}

	if ($addr_type ~~ ["cust_grp_src", "cust_grp_tgt"]) {
		foreach my $grp (sort {$a <=> $b} keys %customgrp) {
			if ($customgrp{$grp}[0] eq $value) {
				my @address = &get_address($customgrp{$grp}[3], $customgrp{$grp}[2], $type);

				if (@address) {
					push(@addresses, @address);
				}
			}
		}
	} else {
		my @address = &get_address($addr_type, $value, $type);

		if (@address) {
			push(@addresses, @address);
		}
	}

	return @addresses;
}
sub get_address
{
	my $key   = shift;
	my $value = shift;
	my $type  = shift;

	my @ret = ();

	# If the user manually typed an address, we just check if it is a MAC
	# address. Otherwise, we assume that it is an IP address.
	if ($key ~~ ["src_addr", "tgt_addr"]) {
		if (&General::validmac($value)) {
			push(@ret, "-m mac --mac-source $value");
		} else {
			push(@ret, $value);
		}

	# If a default network interface (GREEN, BLUE, etc.) is selected, we
	# try to get the corresponding address of the network.
	} elsif ($key ~~ ["std_net_src", "std_net_tgt", "Standard Network"]) {
		my $external_interface = &get_external_interface();

		my $network_address = &get_std_net_ip($value, $external_interface);
		if ($network_address) {
			push(@ret, $network_address);
		}

	# Custom networks.
	} elsif ($key ~~ ["cust_net_src", "cust_net_tgt", "Custom Network"]) {
		my $network_address = &get_net_ip($value);
		if ($network_address) {
			push(@ret, $network_address);
		}

	# Custom hosts.
	} elsif ($key ~~ ["cust_host_src", "cust_host_tgt", "Custom Host"]) {
		my $host_address = &get_host_ip($value, $type);
		if ($host_address) {
			push(@ret, $host_address);
		}

	# OpenVPN networks.
	} elsif ($key ~~ ["ovpn_net_src", "ovpn_net_tgt", "OpenVPN static network"]) {
		my $network_address = &get_ovpn_net_ip($value, 1);
		if ($network_address) {
			push(@ret, $network_address);
		}

	# OpenVPN hosts.
	} elsif ($key ~~ ["ovpn_host_src", "ovpn_host_tgt", "OpenVPN static host"]) {
		my $host_address = &get_ovpn_host_ip($value, 33);
		if ($host_address) {
			push(@ret, $host_address);
		}

	# OpenVPN N2N.
	} elsif ($key ~~ ["ovpn_n2n_src", "ovpn_n2n_tgt", "OpenVPN N-2-N"]) {
		my $network_address = &get_ovpn_n2n_ip($value, 11);
		if ($network_address) {
			push(@ret, $network_address);
		}

	# IPsec networks.
	} elsif ($key ~~ ["ipsec_net_src", "ipsec_net_tgt", "IpSec Network"]) {
		my $network_address = &get_ipsec_net_ip($value, 11);
		if ($network_address) {
			push(@ret, $network_address);
		}

	# The firewall's own IP addresses.
	} elsif ($key ~~ ["ipfire", "ipfire_src"]) {
		# ALL
		if ($value eq "ALL") {
			push(@ret, "0/0");

		# GREEN
		} elsif ($value eq "GREEN") {
			push(@ret, $netsettings{"GREEN_ADDRESS"});

		# BLUE
		} elsif ($value eq "BLUE") {
			push(@ret, $netsettings{"BLUE_ADDRESS"});

		# ORANGE
		} elsif ($value eq "ORANGE") {
			push(@ret, $netsettings{"ORANGE_ADDRESS"});

		# RED
		} elsif ($value ~~ ["RED", "RED1"]) {
			my $address = &get_external_address();
			if ($address) {
				push(@ret, $address);
			}

		# Aliases
		} else {
			my $alias = &get_alias($value);
			if ($alias) {
				push(@ret, $alias);
			}
		}

	# If nothing was selected, we assume "any".
	} else {
		push(@ret, "0/0");
	}

	return @ret;
}
sub get_external_interface()
{
	open(IFACE, "/var/ipfire/red/iface") or return "";
	my $iface = <IFACE>;
	close(IFACE);

	return $iface;
}
sub get_external_address()
{
	open(ADDR, "/var/ipfire/red/local-ipaddress") or return "";
	my $address = <ADDR>;
	close(ADDR);

	return $address;
}
sub get_alias
{
	my $id = shift;

	foreach my $alias (sort keys %aliases) {
		if ($id eq $alias) {
			return $aliases{$alias}{"IPT"};
		}
	}
}

sub get_nat_address {
	my $zone = shift;
	my $source = shift;

	# Any static address of any zone.
	if ($zone eq "AUTO") {
		if ($source && ($source !~ m/mac/i )) {
			my $firewall_ip = &get_internal_firewall_ip_address($source, 1);
			if ($firewall_ip) {
				return $firewall_ip;
			}

			$firewall_ip = &get_matching_firewall_address($source, 1);
			if ($firewall_ip) {
				return $firewall_ip;
			}
		}

		return &get_external_address();

	} elsif ($zone eq "RED" || $zone eq "GREEN" || $zone eq "ORANGE" || $zone eq "BLUE") {
		return $netsettings{$zone . "_ADDRESS"};

	} elsif ($zone ~~ ["Default IP", "ALL"]) {
		return &get_external_address();

	} else {
		my $alias = &get_alias($zone);
		unless ($alias) {
			$alias = &get_external_address();
		}
		return $alias;
	}

	print_error("Could not find NAT address");
}

sub get_internal_firewall_ip_addresses
{
	my $use_orange = shift;

	my @zones = ("GREEN", "BLUE");
	if ($use_orange) {
		push(@zones, "ORANGE");
	}

	my @addresses = ();
	for my $zone (@zones) {
		next unless (exists $netsettings{$zone . "_ADDRESS"});

		my $zone_address = $netsettings{$zone . "_ADDRESS"};
		push(@addresses, $zone_address);
	}

	return @addresses;
}
sub get_matching_firewall_address
{
	my $addr = shift;
	my $use_orange = shift;

	my ($address, $netmask) = split("/", $addr);

	my @zones = ("GREEN", "BLUE");
	if ($use_orange) {
		push(@zones, "ORANGE");
	}

	foreach my $zone (@zones) {
		next unless (exists $netsettings{$zone . "_ADDRESS"});

		my $zone_subnet = $netsettings{$zone . "_NETADDRESS"};
		my $zone_mask   = $netsettings{$zone . "_NETMASK"};

		if (&General::IpInSubnet($address, $zone_subnet, $zone_mask)) {
			return $netsettings{$zone . "_ADDRESS"};
		}
	}

	return 0;
}
sub get_internal_firewall_ip_address
{
	my $subnet = shift;
	my $use_orange = shift;

	my ($net_address, $net_mask) = split("/", $subnet);
	if ((!$net_mask) || ($net_mask ~~ ["32", "255.255.255.255"])) {
		return 0;
	}

	# Convert net mask into correct format for &General::IpInSubnet().
	$net_mask = &General::iporsubtodec($net_mask);

	my @addresses = &get_internal_firewall_ip_addresses($use_orange);
	foreach my $zone_address (@addresses) {
		if (&General::IpInSubnet($zone_address, $net_address, $net_mask)) {
			return $zone_address;
		}
	}

	return 0;
}

return 1;
Commit	Line	Data
2a81ab0d AM	1	#!/usr/bin/perl
	2	###############################################################################
	3	# #
	4	# IPFire.org - A linux based firewall #
5bee9a9d	5	# Copyright (C) 2013 Alexander Marx <amarx@ipfire.org> #
2a81ab0d AM	6	# #
	7	# This program is free software: you can redistribute it and/or modify #
	8	# it under the terms of the GNU General Public License as published by #
	9	# the Free Software Foundation, either version 3 of the License, or #
	10	# (at your option) any later version. #
	11	# #
	12	# This program is distributed in the hope that it will be useful, #
	13	# but WITHOUT ANY WARRANTY; without even the implied warranty of #
	14	# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
	15	# GNU General Public License for more details. #
	16	# #
	17	# You should have received a copy of the GNU General Public License #
	18	# along with this program. If not, see <http://www.gnu.org/licenses/>. #
	19	# #
	20	###############################################################################
2a81ab0d AM	21
	22	use strict;
	23	no warnings 'uninitialized';
	24
	25	package fwlib;
	26
	27	my %customnetwork=();
	28	my %customhost=();
	29	my %customgrp=();
	30	my %customservice=();
	31	my %customservicegrp=();
	32	my %ccdnet=();
	33	my %ccdhost=();
	34	my %ipsecconf=();
	35	my %ipsecsettings=();
	36	my %netsettings=();
	37	my %ovpnsettings=();
4e54e3c6	38	my %aliases=();
2a81ab0d AM	39
	40	require '/var/ipfire/general-functions.pl';
	41
	42	my $confignet = "${General::swroot}/fwhosts/customnetworks";
	43	my $confighost = "${General::swroot}/fwhosts/customhosts";
	44	my $configgrp = "${General::swroot}/fwhosts/customgroups";
	45	my $configsrv = "${General::swroot}/fwhosts/customservices";
	46	my $configsrvgrp = "${General::swroot}/fwhosts/customservicegrp";
	47	my $configccdnet = "${General::swroot}/ovpn/ccd.conf";
	48	my $configccdhost = "${General::swroot}/ovpn/ovpnconfig";
	49	my $configipsec = "${General::swroot}/vpn/config";
	50	my $configovpn = "${General::swroot}/ovpn/settings";
	51	my $val;
	52	my $field;
fd169d0a	53	my $netsettings = "${General::swroot}/ethernet/settings";
2a81ab0d AM	54
	55	&General::readhash("/var/ipfire/ethernet/settings", \%netsettings);
	56	&General::readhash("${General::swroot}/ovpn/settings", \%ovpnsettings);
	57	&General::readhash("${General::swroot}/vpn/settings", \%ipsecsettings);
2a81ab0d AM	58
	59	&General::readhasharray("$confignet", \%customnetwork);
	60	&General::readhasharray("$confighost", \%customhost);
	61	&General::readhasharray("$configgrp", \%customgrp);
	62	&General::readhasharray("$configccdnet", \%ccdnet);
	63	&General::readhasharray("$configccdhost", \%ccdhost);
	64	&General::readhasharray("$configipsec", \%ipsecconf);
	65	&General::readhasharray("$configsrv", \%customservice);
	66	&General::readhasharray("$configsrvgrp", \%customservicegrp);
085a20ec	67	&General::get_aliases(\%aliases);
2a81ab0d AM	68
	69	sub get_srv_prot
	70	{
	71	my $val=shift;
992394d5	72	foreach my $key (sort {$a <=> $b} keys %customservice){
2a81ab0d AM	73	if($customservice{$key}[0] eq $val){
	74	if ($customservice{$key}[0] eq $val){
	75	return $customservice{$key}[2];
	76	}
	77	}
	78	}
	79	}
	80	sub get_srvgrp_prot
	81	{
	82	my $val=shift;
	83	my @ips=();
	84	my $tcp;
	85	my $udp;
	86	my $icmp;
992394d5	87	foreach my $key (sort {$a <=> $b} keys %customservicegrp){
2a81ab0d AM	88	if($customservicegrp{$key}[0] eq $val){
	89	if (&get_srv_prot($customservicegrp{$key}[2]) eq 'TCP'){
	90	$tcp=1;
	91	}elsif(&get_srv_prot($customservicegrp{$key}[2]) eq 'UDP'){
	92	$udp=1;
	93	}elsif(&get_srv_prot($customservicegrp{$key}[2]) eq 'ICMP'){
	94	$icmp=1;
82b837cf AM	95	}else{
	96	#Protocols used in servicegroups
	97	push (@ips,$customservicegrp{$key}[2]);
	98	}
2a81ab0d AM	99	}
	100	}
	101	if ($tcp eq '1'){push (@ips,'TCP');}
	102	if ($udp eq '1'){push (@ips,'UDP');}
	103	if ($icmp eq '1'){push (@ips,'ICMP');}
	104	my $back=join(",",@ips);
	105	return $back;
	106
	107	}
2a81ab0d AM	108	sub get_srv_port
	109	{
	110	my $val=shift;
	111	my $field=shift;
	112	my $prot=shift;
992394d5	113	foreach my $key (sort {$a <=> $b} keys %customservice){
14bcb9a2 AM	114	if($customservice{$key}[0] eq $val && $customservice{$key}[2] eq $prot){
14bcb9a2 AM	115	return $customservice{$key}[$field];
2a81ab0d AM	116	}
	117	}
	118	}
	119	sub get_srvgrp_port
	120	{
	121	my $val=shift;
	122	my $prot=shift;
	123	my $back;
	124	my $value;
	125	my @ips=();
992394d5	126	foreach my $key (sort {$a <=> $b} keys %customservicegrp){
2a81ab0d AM	127	if($customservicegrp{$key}[0] eq $val){
	128	if ($prot ne 'ICMP'){
	129	$value=&get_srv_port($customservicegrp{$key}[2],1,$prot);
	130	}elsif ($prot eq 'ICMP'){
	131	$value=&get_srv_port($customservicegrp{$key}[2],3,$prot);
	132	}
	133	push (@ips,$value) if ($value ne '') ;
	134	}
	135	}
	136	if($prot ne 'ICMP'){
	137	if ($#ips gt 0){$back="-m multiport --dports ";}else{$back="--dport ";}
	138	}elsif ($prot eq 'ICMP'){
	139	$back="--icmp-type ";
	140	}
	141
	142	$back.=join(",",@ips);
	143	return $back;
	144	}
	145	sub get_ipsec_net_ip
	146	{
	147	my $val=shift;
	148	my $field=shift;
992394d5	149	foreach my $key (sort {$a <=> $b} keys %ipsecconf){
2a81ab0d AM	150	if($ipsecconf{$key}[1] eq $val){
	151	return $ipsecconf{$key}[$field];
	152	}
	153	}
	154	}
	155	sub get_ipsec_host_ip
	156	{
	157	my $val=shift;
	158	my $field=shift;
992394d5	159	foreach my $key (sort {$a <=> $b} keys %ipsecconf){
2a81ab0d AM	160	if($ipsecconf{$key}[1] eq $val){
	161	return $ipsecconf{$key}[$field];
	162	}
	163	}
	164	}
	165	sub get_ovpn_n2n_ip
	166	{
	167	my $val=shift;
	168	my $field=shift;
992394d5	169	foreach my $key (sort {$a <=> $b} keys %ccdhost){
2a81ab0d AM	170	if($ccdhost{$key}[1] eq $val){
	171	return $ccdhost{$key}[$field];
	172	}
	173	}
	174	}
	175	sub get_ovpn_host_ip
	176	{
	177	my $val=shift;
	178	my $field=shift;
992394d5	179	foreach my $key (sort {$a <=> $b} keys %ccdhost){
2a81ab0d AM	180	if($ccdhost{$key}[1] eq $val){
	181	return $ccdhost{$key}[$field];
	182	}
	183	}
	184	}
	185	sub get_ovpn_net_ip
	186	{
	187
	188	my $val=shift;
	189	my $field=shift;
992394d5	190	foreach my $key (sort {$a <=> $b} keys %ccdnet){
2a81ab0d AM	191	if($ccdnet{$key}[0] eq $val){
	192	return $ccdnet{$key}[$field];
	193	}
	194	}
	195	}
	196	sub get_grp_ip
	197	{
	198	my $val=shift;
	199	my $src=shift;
992394d5	200	foreach my $key (sort {$a <=> $b} keys %customgrp){
2a81ab0d AM	201	if ($customgrp{$key}[0] eq $val){
	202	&get_address($customgrp{$key}[3],$src);
	203	}
	204	}
	205
	206	}
	207	sub get_std_net_ip
	208	{
	209	my $val=shift;
ddcec9d3	210	my $con=shift;
2a81ab0d AM	211	if ($val eq 'ALL'){
	212	return "0.0.0.0/0.0.0.0";
	213	}elsif($val eq 'GREEN'){
	214	return "$netsettings{'GREEN_NETADDRESS'}/$netsettings{'GREEN_NETMASK'}";
	215	}elsif($val eq 'ORANGE'){
	216	return "$netsettings{'ORANGE_NETADDRESS'}/$netsettings{'ORANGE_NETMASK'}";
	217	}elsif($val eq 'BLUE'){
	218	return "$netsettings{'BLUE_NETADDRESS'}/$netsettings{'BLUE_NETMASK'}";
62fc8511	219	}elsif($val eq 'RED'){
ddcec9d3	220	return "0.0.0.0/0 -o $con";
2a81ab0d AM	221	}elsif($val =~ /OpenVPN/i){
	222	return "$ovpnsettings{'DOVPN_SUBNET'}";
	223	}elsif($val =~ /IPsec/i){
	224	return "$ipsecsettings{'RW_NET'}";
5d7faa45 AM	225	}elsif($val eq 'IPFire'){
5d7faa45 AM	226	return ;
2a81ab0d AM	227	}
	228	}
	229	sub get_net_ip
	230	{
	231	my $val=shift;
992394d5	232	foreach my $key (sort {$a <=> $b} keys %customnetwork){
2a81ab0d AM	233	if($customnetwork{$key}[0] eq $val){
	234	return "$customnetwork{$key}[1]/$customnetwork{$key}[2]";
	235	}
	236	}
	237	}
	238	sub get_host_ip
	239	{
	240	my $val=shift;
	241	my $src=shift;
992394d5	242	foreach my $key (sort {$a <=> $b} keys %customhost){
2a81ab0d AM	243	if($customhost{$key}[0] eq $val){
	244	if ($customhost{$key}[1] eq 'mac' && $src eq 'src'){
	245	return "-m mac --mac-source $customhost{$key}[2]";
	246	}elsif($customhost{$key}[1] eq 'ip' && $src eq 'src'){
	247	return "$customhost{$key}[2]";
	248	}elsif($customhost{$key}[1] eq 'ip' && $src eq 'tgt'){
	249	return "$customhost{$key}[2]";
	250	}elsif($customhost{$key}[1] eq 'mac' && $src eq 'tgt'){
	251	return "none";
	252	}
	253	}
	254	}
	255	}
fd169d0a AM	256	sub get_addresses
fd169d0a AM	257	{
4e54e3c6 AM	258	my $hash = shift;
	259	my $key = shift;
	260	my $type = shift;
	261
	262	my @addresses = ();
	263	my $addr_type;
	264	my $value;
	265	my $group_name;
	266
	267	if ($type eq "src") {
	268	$addr_type = $$hash{$key}[3];
	269	$value = $$hash{$key}[4];
	270
	271	} elsif ($type eq "tgt") {
	272	$addr_type = $$hash{$key}[5];
	273	$value = $$hash{$key}[6];
	274	}
	275
	276	if ($addr_type ~~ ["cust_grp_src", "cust_grp_tgt"]) {
	277	foreach my $grp (sort {$a <=> $b} keys %customgrp) {
	278	if ($customgrp{$grp}[0] eq $value) {
	279	my @address = &get_address($customgrp{$grp}[3], $customgrp{$grp}[2], $type);
	280
	281	if (@address) {
	282	push(@addresses, @address);
	283	}
	284	}
	285	}
	286	} else {
	287	my @address = &get_address($addr_type, $value, $type);
	288
	289	if (@address) {
	290	push(@addresses, @address);
	291	}
	292	}
	293
	294	return @addresses;
	295	}
fd169d0a AM	296	sub get_address
fd169d0a AM	297	{
4e54e3c6 AM	298	my $key = shift;
	299	my $value = shift;
	300	my $type = shift;
	301
	302	my @ret = ();
	303
	304	# If the user manually typed an address, we just check if it is a MAC
	305	# address. Otherwise, we assume that it is an IP address.
	306	if ($key ~~ ["src_addr", "tgt_addr"]) {
	307	if (&General::validmac($value)) {
	308	push(@ret, "-m mac --mac-source $value");
	309	} else {
	310	push(@ret, $value);
	311	}
	312
	313	# If a default network interface (GREEN, BLUE, etc.) is selected, we
	314	# try to get the corresponding address of the network.
	315	} elsif ($key ~~ ["std_net_src", "std_net_tgt", "Standard Network"]) {
	316	my $external_interface = &get_external_interface();
	317
	318	my $network_address = &get_std_net_ip($value, $external_interface);
	319	if ($network_address) {
	320	push(@ret, $network_address);
	321	}
	322
	323	# Custom networks.
	324	} elsif ($key ~~ ["cust_net_src", "cust_net_tgt", "Custom Network"]) {
	325	my $network_address = &get_net_ip($value);
	326	if ($network_address) {
	327	push(@ret, $network_address);
	328	}
	329
	330	# Custom hosts.
	331	} elsif ($key ~~ ["cust_host_src", "cust_host_tgt", "Custom Host"]) {
	332	my $host_address = &get_host_ip($value, $type);
	333	if ($host_address) {
	334	push(@ret, $host_address);
	335	}
	336
	337	# OpenVPN networks.
	338	} elsif ($key ~~ ["ovpn_net_src", "ovpn_net_tgt", "OpenVPN static network"]) {
	339	my $network_address = &get_ovpn_net_ip($value, 1);
	340	if ($network_address) {
	341	push(@ret, $network_address);
	342	}
	343
	344	# OpenVPN hosts.
	345	} elsif ($key ~~ ["ovpn_host_src", "ovpn_host_tgt", "OpenVPN static host"]) {
	346	my $host_address = &get_ovpn_host_ip($value, 33);
	347	if ($host_address) {
	348	push(@ret, $host_address);
	349	}
	350
	351	# OpenVPN N2N.
	352	} elsif ($key ~~ ["ovpn_n2n_src", "ovpn_n2n_tgt", "OpenVPN N-2-N"]) {
	353	my $network_address = &get_ovpn_n2n_ip($value, 11);
	354	if ($network_address) {
	355	push(@ret, $network_address);
	356	}
	357
	358	# IPsec networks.
	359	} elsif ($key ~~ ["ipsec_net_src", "ipsec_net_tgt", "IpSec Network"]) {
	360	my $network_address = &get_ipsec_net_ip($value, 11);
	361	if ($network_address) {
362	push(@ret, $network_address);
363	}
364
365	# The firewall's own IP addresses.
366	} elsif ($key ~~ ["ipfire", "ipfire_src"]) {
367	# ALL
368	if ($value eq "ALL") {
369	push(@ret, "0/0");
370
371	# GREEN
372	} elsif ($value eq "GREEN") {
c71499d8	373	push(@ret, $netsettings{"GREEN_ADDRESS"});
4e54e3c6 AM	374
	375	# BLUE
	376	} elsif ($value eq "BLUE") {
c71499d8	377	push(@ret, $netsettings{"BLUE_ADDRESS"});
4e54e3c6 AM	378
	379	# ORANGE
	380	} elsif ($value eq "ORANGE") {
c71499d8	381	push(@ret, $netsettings{"ORANGE_ADDRESS"});
4e54e3c6 AM	382
	383	# RED
	384	} elsif ($value ~~ ["RED", "RED1"]) {
	385	my $address = &get_external_address();
	386	if ($address) {
	387	push(@ret, $address);
	388	}
	389
	390	# Aliases
	391	} else {
085a20ec MT	392	my $alias = &get_alias($value);
	393	if ($alias) {
	394	push(@ret, $alias);
4e54e3c6 AM	395	}
	396	}
	397
	398	# If nothing was selected, we assume "any".
	399	} else {
	400	push(@ret, "0/0");
	401	}
	402
	403	return @ret;
	404	}
fd169d0a AM	405	sub get_external_interface()
fd169d0a AM	406	{
4e54e3c6 AM	407	open(IFACE, "/var/ipfire/red/iface") or return "";
	408	my $iface = <IFACE>;
	409	close(IFACE);
	410
	411	return $iface;
	412	}
fd169d0a AM	413	sub get_external_address()
fd169d0a AM	414	{
4e54e3c6 AM	415	open(ADDR, "/var/ipfire/red/local-ipaddress") or return "";
	416	my $address = <ADDR>;
	417	close(ADDR);
	418
	419	return $address;
	420	}
fd169d0a AM	421	sub get_alias
fd169d0a AM	422	{
4e54e3c6 AM	423	my $id = shift;
	424
	425	foreach my $alias (sort keys %aliases) {
	426	if ($id eq $alias) {
085a20ec	427	return $aliases{$alias}{"IPT"};
4e54e3c6 AM	428	}
	429	}
	430	}
085a20ec MT	431
085a20ec MT	432	sub get_nat_address {
4e54e3c6 AM	433	my $zone = shift;
	434	my $source = shift;
	435
	436	# Any static address of any zone.
	437	if ($zone eq "AUTO") {
fd169d0a	438	if ($source && ($source !~ m/mac/i )) {
4e54e3c6 AM	439	my $firewall_ip = &get_internal_firewall_ip_address($source, 1);
	440	if ($firewall_ip) {
	441	return $firewall_ip;
	442	}
	443
	444	$firewall_ip = &get_matching_firewall_address($source, 1);
	445	if ($firewall_ip) {
	446	return $firewall_ip;
	447	}
	448	}
	449
	450	return &get_external_address();
	451
	452	} elsif ($zone eq "RED" \|\| $zone eq "GREEN" \|\| $zone eq "ORANGE" \|\| $zone eq "BLUE") {
c71499d8	453	return $netsettings{$zone . "_ADDRESS"};
4e54e3c6	454
085a20ec	455	} elsif ($zone ~~ ["Default IP", "ALL"]) {
4e54e3c6 AM	456	return &get_external_address();
	457
	458	} else {
085a20ec MT	459	my $alias = &get_alias($zone);
	460	unless ($alias) {
	461	$alias = &get_external_address();
	462	}
	463	return $alias;
4e54e3c6 AM	464	}
	465
	466	print_error("Could not find NAT address");
	467	}
085a20ec	468
fd169d0a AM	469	sub get_internal_firewall_ip_addresses
fd169d0a AM	470	{
4e54e3c6 AM	471	my $use_orange = shift;
	472
	473	my @zones = ("GREEN", "BLUE");
	474	if ($use_orange) {
	475	push(@zones, "ORANGE");
	476	}
	477
	478	my @addresses = ();
	479	for my $zone (@zones) {
c71499d8	480	next unless (exists $netsettings{$zone . "_ADDRESS"});
4e54e3c6	481
c71499d8	482	my $zone_address = $netsettings{$zone . "_ADDRESS"};
4e54e3c6 AM	483	push(@addresses, $zone_address);
	484	}
	485
	486	return @addresses;
	487	}
fd169d0a AM	488	sub get_matching_firewall_address
fd169d0a AM	489	{
4e54e3c6 AM	490	my $addr = shift;
	491	my $use_orange = shift;
	492
	493	my ($address, $netmask) = split("/", $addr);
	494
	495	my @zones = ("GREEN", "BLUE");
	496	if ($use_orange) {
	497	push(@zones, "ORANGE");
	498	}
	499
	500	foreach my $zone (@zones) {
c71499d8	501	next unless (exists $netsettings{$zone . "_ADDRESS"});
4e54e3c6	502
c71499d8 AM	503	my $zone_subnet = $netsettings{$zone . "_NETADDRESS"};
c71499d8 AM	504	my $zone_mask = $netsettings{$zone . "_NETMASK"};
4e54e3c6 AM	505
4e54e3c6 AM	506	if (&General::IpInSubnet($address, $zone_subnet, $zone_mask)) {
c71499d8	507	return $netsettings{$zone . "_ADDRESS"};
4e54e3c6 AM	508	}
	509	}
	510
	511	return 0;
	512	}
fd169d0a AM	513	sub get_internal_firewall_ip_address
fd169d0a AM	514	{
4e54e3c6 AM	515	my $subnet = shift;
	516	my $use_orange = shift;
	517
	518	my ($net_address, $net_mask) = split("/", $subnet);
	519	if ((!$net_mask) \|\| ($net_mask ~~ ["32", "255.255.255.255"])) {
	520	return 0;
	521	}
	522
aa5f4b65 MT	523	# Convert net mask into correct format for &General::IpInSubnet().
	524	$net_mask = &General::iporsubtodec($net_mask);
	525
4e54e3c6 AM	526	my @addresses = &get_internal_firewall_ip_addresses($use_orange);
	527	foreach my $zone_address (@addresses) {
	528	if (&General::IpInSubnet($zone_address, $net_address, $net_mask)) {
	529	return $zone_address;
	530	}
	531	}
	532
	533	return 0;
	534	}
	535
2a81ab0d	536	return 1;