]>
Commit | Line | Data |
---|---|---|
2a81ab0d AM |
1 | #!/usr/bin/perl |
2 | ############################################################################### | |
3 | # # | |
4 | # IPFire.org - A linux based firewall # | |
5 | # Copyright (C) 2012 # | |
6 | # # | |
7 | # This program is free software: you can redistribute it and/or modify # | |
8 | # it under the terms of the GNU General Public License as published by # | |
9 | # the Free Software Foundation, either version 3 of the License, or # | |
10 | # (at your option) any later version. # | |
11 | # # | |
12 | # This program is distributed in the hope that it will be useful, # | |
13 | # but WITHOUT ANY WARRANTY; without even the implied warranty of # | |
14 | # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # | |
15 | # GNU General Public License for more details. # | |
16 | # # | |
17 | # You should have received a copy of the GNU General Public License # | |
18 | # along with this program. If not, see <http://www.gnu.org/licenses/>. # | |
19 | # # | |
20 | ############################################################################### | |
21 | # # | |
22 | # Hi folks! I hope this code is useful for all. I needed something to handle # | |
23 | # my VPN Connections in a comfortable way. # | |
24 | # This script builds firewallrules from the webinterface # | |
25 | ############################################################################### | |
26 | ||
2a81ab0d | 27 | use strict; |
472136c9 | 28 | use Time::Local; |
2a81ab0d AM |
29 | no warnings 'uninitialized'; |
30 | ||
31 | # enable only the following on debugging purpose | |
32 | #use warnings; | |
33 | #use CGI::Carp 'fatalsToBrowser'; | |
34 | ||
35 | my %fwdfwsettings=(); | |
36 | my %defaultNetworks=(); | |
37 | my %configfwdfw=(); | |
38 | my %color=(); | |
39 | my %icmptypes=(); | |
40 | my %ovpnSettings=(); | |
41 | my %customgrp=(); | |
42 | our %sourcehash=(); | |
43 | our %targethash=(); | |
44 | my @timeframe=(); | |
45 | my %configinputfw=(); | |
5d7faa45 | 46 | my %configoutgoingfw=(); |
31fef6cc | 47 | my %configdmzfw=(); |
a6edca5a | 48 | my %confignatfw=(); |
2a81ab0d AM |
49 | my %aliases=(); |
50 | my @DPROT=(); | |
36196d0d | 51 | my @p2ps=(); |
2a81ab0d AM |
52 | require '/var/ipfire/general-functions.pl'; |
53 | require "${General::swroot}/lang.pl"; | |
54 | require "${General::swroot}/forward/bin/firewall-lib.pl"; | |
55 | ||
31fef6cc | 56 | my $configdmz = "${General::swroot}/forward/dmz"; |
2a81ab0d AM |
57 | my $configfwdfw = "${General::swroot}/forward/config"; |
58 | my $configinput = "${General::swroot}/forward/input"; | |
5d7faa45 | 59 | my $configoutgoing = "${General::swroot}/forward/outgoing"; |
a6edca5a | 60 | my $confignat = "${General::swroot}/forward/nat"; |
36196d0d | 61 | my $p2pfile = "${General::swroot}/forward/p2protocols"; |
2a81ab0d | 62 | my $configgrp = "${General::swroot}/fwhosts/customgroups"; |
210ee67b | 63 | my $netsettings = "${General::swroot}/ethernet/settings"; |
2a81ab0d | 64 | my $errormessage=''; |
210ee67b AM |
65 | my $orange; |
66 | my $green; | |
6adcf156 | 67 | my $blue; |
2a81ab0d AM |
68 | my ($TYPE,$PROT,$SPROT,$DPROT,$SPORT,$DPORT,$TIME,$TIMEFROM,$TIMETILL,$SRC_TGT); |
69 | my $CHAIN="FORWARDFW"; | |
ddcec9d3 | 70 | my $conexists='off'; |
a6edca5a AM |
71 | my $command = 'iptables -A'; |
72 | my $dnat=''; | |
73 | my $snat=''; | |
2a81ab0d | 74 | &General::readhash("${General::swroot}/forward/settings", \%fwdfwsettings); |
210ee67b | 75 | &General::readhash("$netsettings", \%defaultNetworks); |
31fef6cc | 76 | &General::readhasharray($configdmz, \%configdmzfw); |
2a81ab0d AM |
77 | &General::readhasharray($configfwdfw, \%configfwdfw); |
78 | &General::readhasharray($configinput, \%configinputfw); | |
5d7faa45 | 79 | &General::readhasharray($configoutgoing, \%configoutgoingfw); |
a6edca5a | 80 | &General::readhasharray($confignat, \%confignatfw); |
2a81ab0d AM |
81 | &General::readhasharray($configgrp, \%customgrp); |
82 | &General::get_aliases(\%aliases); | |
83 | ||
ddcec9d3 AM |
84 | #check if we have an internetconnection |
85 | open (CONN,"/var/ipfire/red/iface"); | |
86 | my $con = <CONN>; | |
87 | close(CONN); | |
88 | if (-f "/var/ipfire/red/active"){ | |
89 | $conexists='on'; | |
90 | } | |
a6edca5a AM |
91 | open (CONN1,"/var/ipfire/red/local-ipaddress"); |
92 | my $redip = <CONN1>; | |
93 | close(CONN1); | |
2a81ab0d AM |
94 | ################################ |
95 | # DEBUG/TEST # | |
96 | ################################ | |
54cb7ff0 | 97 | my $MODE=1; # 0 - normal operation |
2a81ab0d AM |
98 | # 1 - print configline and rules to console |
99 | # | |
100 | ################################ | |
101 | my $param=shift; | |
102 | ||
103 | if($param eq 'flush'){ | |
104 | if ($MODE eq '1'){ | |
105 | print " Flushing chains...\n"; | |
106 | } | |
107 | &flush; | |
108 | }else{ | |
109 | if ($MODE eq '1'){ | |
110 | print " Flushing chains...\n"; | |
111 | } | |
112 | &flush; | |
113 | if ($MODE eq '1'){ | |
114 | print " Preparing rules...\n"; | |
115 | } | |
116 | &preparerules; | |
117 | if($MODE eq '0'){ | |
118 | if ($fwdfwsettings{'POLICY'} eq 'MODE1'){ | |
af49e367 | 119 | &p2pblock; |
5d7faa45 | 120 | system ("/usr/sbin/firewall-policy"); |
2a81ab0d | 121 | }elsif($fwdfwsettings{'POLICY'} eq 'MODE2'){ |
6adcf156 AM |
122 | $defaultNetworks{'GREEN_NETMASK'}=&General::iporsubtocidr($defaultNetworks{'GREEN_NETMASK'}); |
123 | $green="$defaultNetworks{'GREEN_ADDRESS'}/$defaultNetworks{'GREEN_NETMASK'}"; | |
6adcf156 AM |
124 | if ($defaultNetworks{'BLUE_DEV'}){ |
125 | $defaultNetworks{'BLUE_NETMASK'}=&General::iporsubtocidr($defaultNetworks{'BLUE_NETMASK'}); | |
126 | $blue="$defaultNetworks{'BLUE_ADDRESS'}/$defaultNetworks{'BLUE_NETMASK'}"; | |
127 | #set default rules for BLUE | |
128 | system ("iptables -A $CHAIN -s $blue -d $green -j RETURN"); | |
129 | } | |
5b7ed8bb AM |
130 | if ($defaultNetworks{'ORANGE_DEV'}){ |
131 | $defaultNetworks{'ORANGE_NETMASK'}=&General::iporsubtocidr($defaultNetworks{'ORANGE_NETMASK'}); | |
132 | $orange="$defaultNetworks{'ORANGE_ADDRESS'}/$defaultNetworks{'ORANGE_NETMASK'}"; | |
133 | #set default rules for DMZ | |
134 | system ("iptables -A $CHAIN -s $orange -d $green -j RETURN"); | |
135 | if ($defaultNetworks{'BLUE_DEV'}){ | |
136 | system ("iptables -A $CHAIN -s $orange -d $blue -j RETURN"); | |
137 | } | |
138 | } | |
6adcf156 | 139 | &p2pblock; |
fd10a52c | 140 | system ("iptables -A $CHAIN -m state --state NEW -j ACCEPT"); |
5d7faa45 | 141 | system ("/usr/sbin/firewall-policy"); |
2a81ab0d AM |
142 | } |
143 | } | |
144 | } | |
2a81ab0d AM |
145 | sub flush |
146 | { | |
147 | system ("iptables -F FORWARDFW"); | |
148 | system ("iptables -F INPUTFW"); | |
5d7faa45 | 149 | system ("iptables -F OUTGOINGFW"); |
28640b73 AM |
150 | system ("iptables -F PORTFWACCESS"); |
151 | system ("iptables -t nat -F NAT_DESTINATION"); | |
152 | system ("iptables -t nat -F NAT_SOURCE"); | |
2a81ab0d AM |
153 | } |
154 | sub preparerules | |
155 | { | |
31fef6cc AM |
156 | if (! -z "${General::swroot}/forward/dmz"){ |
157 | &buildrules(\%configdmzfw); | |
158 | } | |
2a81ab0d AM |
159 | if (! -z "${General::swroot}/forward/config"){ |
160 | &buildrules(\%configfwdfw); | |
161 | } | |
162 | if (! -z "${General::swroot}/forward/input"){ | |
163 | &buildrules(\%configinputfw); | |
164 | } | |
5d7faa45 AM |
165 | if (! -z "${General::swroot}/forward/outgoing"){ |
166 | &buildrules(\%configoutgoingfw); | |
167 | } | |
a6edca5a AM |
168 | if (! -z "${General::swroot}/forward/nat"){ |
169 | &buildrules(\%confignatfw); | |
170 | } | |
2a81ab0d AM |
171 | } |
172 | sub buildrules | |
173 | { | |
174 | my $hash=shift; | |
b5269091 | 175 | my $STAG; |
a6edca5a AM |
176 | my $natip; |
177 | my $snatport; | |
178 | my $fireport; | |
bc912c6e | 179 | my $nat; |
98cee89f | 180 | my $fwaccessdport; |
992394d5 | 181 | foreach my $key (sort {$a <=> $b} keys %$hash){ |
ff4770c7 | 182 | next if (($$hash{$key}[6] eq 'RED' || $$hash{$key}[6] eq 'RED1') && $conexists eq 'off' ); |
a6edca5a AM |
183 | if ($$hash{$key}[28] eq 'ON'){ |
184 | $command='iptables -t nat -A'; | |
08e1c65d | 185 | $natip=&get_nat_ip($$hash{$key}[29],$$hash{$key}[31]); |
a6edca5a | 186 | if($$hash{$key}[31] eq 'dnat'){ |
bc912c6e | 187 | $nat='DNAT'; |
98cee89f AM |
188 | if ($$hash{$key}[30] =~ /\|/){ |
189 | $$hash{$key}[30]=~ tr/|/,/; | |
190 | $fireport='-m multiport --dport '.$$hash{$key}[30]; | |
191 | }else{ | |
192 | $fireport='--dport '.$$hash{$key}[30] if ($$hash{$key}[30]>0); | |
193 | } | |
a6edca5a | 194 | }else{ |
bc912c6e | 195 | $nat='SNAT'; |
a6edca5a AM |
196 | } |
197 | } | |
b5269091 | 198 | $STAG=''; |
2a81ab0d AM |
199 | if($$hash{$key}[2] eq 'ON'){ |
200 | #get source ip's | |
201 | if ($$hash{$key}[3] eq 'cust_grp_src'){ | |
992394d5 | 202 | foreach my $grp (sort {$a <=> $b} keys %customgrp){ |
2a81ab0d AM |
203 | if($customgrp{$grp}[0] eq $$hash{$key}[4]){ |
204 | &get_address($customgrp{$grp}[3],$customgrp{$grp}[2],"src"); | |
205 | } | |
206 | } | |
207 | }else{ | |
208 | &get_address($$hash{$key}[3],$$hash{$key}[4],"src"); | |
209 | } | |
210 | #get target ip's | |
211 | if ($$hash{$key}[5] eq 'cust_grp_tgt'){ | |
992394d5 | 212 | foreach my $grp (sort {$a <=> $b} keys %customgrp){ |
2a81ab0d AM |
213 | if($customgrp{$grp}[0] eq $$hash{$key}[6]){ |
214 | &get_address($customgrp{$grp}[3],$customgrp{$grp}[2],"tgt"); | |
215 | } | |
216 | } | |
217 | }elsif($$hash{$key}[5] eq 'ipfire'){ | |
05d4f131 AM |
218 | if($$hash{$key}[6] eq 'GREEN'){ |
219 | $targethash{$key}[0]=$defaultNetworks{'GREEN_ADDRESS'}; | |
220 | } | |
221 | if($$hash{$key}[6] eq 'BLUE'){ | |
222 | $targethash{$key}[0]=$defaultNetworks{'BLUE_ADDRESS'}; | |
223 | } | |
224 | if($$hash{$key}[6] eq 'ORANGE'){ | |
225 | $targethash{$key}[0]=$defaultNetworks{'ORANGE_ADDRESS'}; | |
226 | } | |
8762442c AM |
227 | if($$hash{$key}[6] eq 'ALL'){ |
228 | $targethash{$key}[0]='0.0.0.0/0'; | |
229 | } | |
690b0bd7 | 230 | if($$hash{$key}[6] eq 'RED' || $$hash{$key}[6] eq 'RED1'){ |
ff4770c7 | 231 | open(FILE, "/var/ipfire/red/local-ipaddress")or die "Couldn't open local-ipaddress"; |
2a81ab0d AM |
232 | $targethash{$key}[0]= <FILE>; |
233 | close(FILE); | |
234 | }else{ | |
235 | foreach my $alias (sort keys %aliases){ | |
236 | if ($$hash{$key}[6] eq $alias){ | |
237 | $targethash{$key}[0]=$aliases{$alias}{'IPT'}; | |
238 | } | |
239 | } | |
240 | } | |
241 | }else{ | |
242 | &get_address($$hash{$key}[5],$$hash{$key}[6],"tgt"); | |
243 | } | |
2a81ab0d AM |
244 | ##get source prot and port |
245 | $SRC_TGT='SRC'; | |
246 | $SPROT = &get_prot($hash,$key); | |
247 | $SPORT = &get_port($hash,$key); | |
248 | $SRC_TGT=''; | |
14f7cb87 | 249 | |
2a81ab0d AM |
250 | ##get target prot and port |
251 | $DPROT=&get_prot($hash,$key); | |
14f7cb87 | 252 | |
2a81ab0d AM |
253 | if ($DPROT eq ''){$DPROT=' ';} |
254 | @DPROT=split(",",$DPROT); | |
14f7cb87 | 255 | |
2a81ab0d AM |
256 | #get time if defined |
257 | if($$hash{$key}[18] eq 'ON'){ | |
472136c9 AM |
258 | my ($time1,$time2,$daylight); |
259 | my $daylight=$$hash{$key}[28]; | |
260 | $time1=&get_time($$hash{$key}[26],$daylight); | |
261 | $time2=&get_time($$hash{$key}[27],$daylight); | |
2a81ab0d AM |
262 | if($$hash{$key}[19] ne ''){push (@timeframe,"Mon");} |
263 | if($$hash{$key}[20] ne ''){push (@timeframe,"Tue");} | |
264 | if($$hash{$key}[21] ne ''){push (@timeframe,"Wed");} | |
265 | if($$hash{$key}[22] ne ''){push (@timeframe,"Thu");} | |
266 | if($$hash{$key}[23] ne ''){push (@timeframe,"Fri");} | |
267 | if($$hash{$key}[24] ne ''){push (@timeframe,"Sat");} | |
268 | if($$hash{$key}[25] ne ''){push (@timeframe,"Sun");} | |
269 | $TIME=join(",",@timeframe); | |
472136c9 AM |
270 | |
271 | $TIMEFROM="--timestart $time1 "; | |
272 | $TIMETILL="--timestop $time2 "; | |
a0f267b9 | 273 | $TIME="-m time --weekdays $TIME $TIMEFROM $TIMETILL"; |
2a81ab0d | 274 | } |
2a81ab0d AM |
275 | if ($MODE eq '1'){ |
276 | print "NR:$key "; | |
277 | foreach my $i (0 .. $#{$$hash{$key}}){ | |
278 | print "$i: $$hash{$key}[$i] "; | |
279 | } | |
280 | print "\n"; | |
281 | print"##################################\n"; | |
282 | #print rules to console | |
2a81ab0d AM |
283 | foreach my $DPROT (@DPROT){ |
284 | $DPORT = &get_port($hash,$key,$DPROT); | |
285 | if ($SPROT ne ''){$PROT=$SPROT;}else{$PROT=$DPROT;} | |
286 | $PROT="-p $PROT" if ($PROT ne '' && $PROT ne ' '); | |
287 | foreach my $a (sort keys %sourcehash){ | |
288 | foreach my $b (sort keys %targethash){ | |
d7dc9718 | 289 | if ($sourcehash{$a}[0] ne $targethash{$b}[0] && $targethash{$b}[0] ne 'none' || $sourcehash{$a}[0] eq '0.0.0.0/0.0.0.0'){ |
2a81ab0d | 290 | if($SPROT eq '' || $SPROT eq $DPROT || $DPROT eq ' '){ |
5d7faa45 | 291 | if(substr($sourcehash{$a}[0], 3, 3) ne 'mac' && $sourcehash{$a}[0] ne ''){ $STAG="-s";} |
8cb1afc8 AM |
292 | if(substr($DPORT, 2, 4) eq 'icmp'){ |
293 | my @icmprule= split(",",substr($DPORT, 12,)); | |
294 | foreach (@icmprule){ | |
295 | if ($$hash{$key}[17] eq 'ON'){ | |
a6edca5a | 296 | print "$command $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] --icmp-type $_ $TIME -j LOG\n"; |
8cb1afc8 | 297 | } |
a6edca5a | 298 | print "$command $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] --icmp-type $_ $TIME -j $$hash{$key}[0]\n"; |
8cb1afc8 | 299 | } |
a6edca5a | 300 | }elsif($$hash{$key}[28] ne 'ON'){ |
8cb1afc8 | 301 | if ($$hash{$key}[17] eq 'ON'){ |
a6edca5a | 302 | print "$command $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j LOG\n"; |
8cb1afc8 | 303 | } |
a6edca5a | 304 | print "$command $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j $$hash{$key}[0]\n"; |
28640b73 AM |
305 | }elsif($$hash{$key}[28] eq 'ON' && $$hash{$key}[31] eq 'dnat'){ |
306 | if ($$hash{$key}[17] eq 'ON'){ | |
307 | print "$command $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $fireport $TIME -j LOG --log-prefix 'DNAT' \n"; | |
308 | } | |
28640b73 | 309 | my ($ip,$sub) =split("/",$targethash{$b}[0]); |
bc912c6e | 310 | print "$command $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT $natip $fireport $TIME -j $nat --to $ip$DPORT\n"; |
829697d0 | 311 | $DPORT =~ s/\-/:/g; |
98cee89f AM |
312 | if ($DPORT){ |
313 | $fwaccessdport="--dport ".substr($DPORT,1,); | |
314 | }elsif(! $DPORT && $$hash{$key}[30] ne ''){ | |
315 | if ($$hash{$key}[30]=~m/|/i){ | |
316 | $$hash{$key}[30] =~ s/\|/,/g; | |
317 | $fwaccessdport="-m multiport --dport $$hash{$key}[30]"; | |
318 | }else{ | |
319 | $fwaccessdport="--dport $$hash{$key}[30]"; | |
320 | } | |
321 | } | |
bc912c6e | 322 | print "iptables -A PORTFWACCESS $PROT -i $con $STAG $sourcehash{$a}[0] -d $ip $fwaccessdport $TIME -j $$hash{$key}[0]\n"; |
08e1c65d AM |
323 | }elsif($$hash{$key}[28] eq 'ON' && $$hash{$key}[31] eq 'snat'){ |
324 | print "$command $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j $nat --to $natip\n"; | |
2a81ab0d | 325 | } |
2a81ab0d AM |
326 | } |
327 | } | |
328 | } | |
329 | } | |
330 | print"\n"; | |
331 | } | |
2a81ab0d AM |
332 | }elsif($MODE eq '0'){ |
333 | foreach my $DPROT (@DPROT){ | |
334 | $DPORT = &get_port($hash,$key,$DPROT); | |
335 | if ($SPROT ne ''){$PROT=$SPROT;}else{$PROT=$DPROT;} | |
336 | $PROT="-p $PROT" if ($PROT ne '' && $PROT ne ' '); | |
337 | foreach my $a (sort keys %sourcehash){ | |
338 | foreach my $b (sort keys %targethash){ | |
d7dc9718 | 339 | if ($sourcehash{$a}[0] ne $targethash{$b}[0] && $targethash{$b}[0] ne 'none' || $sourcehash{$a}[0] eq '0.0.0.0/0.0.0.0'){ |
2a81ab0d | 340 | if($SPROT eq '' || $SPROT eq $DPROT || $DPROT eq ' '){ |
5d7faa45 | 341 | if(substr($sourcehash{$a}[0], 3, 3) ne 'mac' && $sourcehash{$a}[0] ne ''){ $STAG="-s";} |
8cb1afc8 AM |
342 | if(substr($DPORT, 2, 4) eq 'icmp'){ |
343 | my @icmprule= split(",",substr($DPORT, 12,)); | |
344 | foreach (@icmprule){ | |
345 | if ($$hash{$key}[17] eq 'ON'){ | |
a6edca5a | 346 | system ("$command $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] -- icmp-type $_ $TIME -j LOG"); |
8cb1afc8 | 347 | } |
a6edca5a AM |
348 | system ("$command $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] --icmp-type $_ $TIME -j $$hash{$key}[0]"); |
349 | } | |
350 | }elsif($$hash{$key}[28] ne 'ON'){ | |
351 | if ($$hash{$key}[17] eq 'ON'){ | |
352 | system "$command $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j LOG\n"; | |
353 | } | |
354 | system "$command $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j $$hash{$key}[0]\n"; | |
355 | }elsif($$hash{$key}[28] eq 'ON' && $$hash{$key}[31] eq 'dnat'){ | |
356 | if ($$hash{$key}[17] eq 'ON'){ | |
357 | system "$command $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT $natip $fireport $TIME -j LOG --log-prefix 'DNAT' \n"; | |
8cb1afc8 | 358 | } |
a6edca5a | 359 | my ($ip,$sub) =split("/",$targethash{$b}[0]); |
bc912c6e | 360 | system "$command $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT $natip $fireport $TIME -j $nat --to $ip$DPORT\n"; |
829697d0 | 361 | $DPORT =~ s/\-/:/g; |
98cee89f AM |
362 | if ($DPORT){ |
363 | $fwaccessdport="--dport ".substr($DPORT,1,); | |
364 | }elsif(! $DPORT && $$hash{$key}[30] ne ''){ | |
365 | if ($$hash{$key}[30]=~m/|/i){ | |
366 | $$hash{$key}[30] =~ s/\|/,/g; | |
367 | $fwaccessdport="-m multiport --dport $$hash{$key}[30]"; | |
368 | }else{ | |
369 | $fwaccessdport="--dport $$hash{$key}[30]"; | |
370 | } | |
371 | } | |
bc912c6e | 372 | system "iptables -A PORTFWACCESS $PROT -i $con $STAG $sourcehash{$a}[0] -d $ip $fwaccessdport $TIME -j $$hash{$key}[0]\n"; |
a6edca5a | 373 | }elsif($$hash{$key}[28] eq 'ON' && $$hash{$key}[31] eq 'snat'){ |
8cb1afc8 | 374 | if ($$hash{$key}[17] eq 'ON'){ |
a6edca5a | 375 | system "$command $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j LOG --log-prefix 'SNAT '\n"; |
8cb1afc8 | 376 | } |
bc912c6e | 377 | system "$command $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j $nat --to $natip$fireport\n"; |
2a81ab0d | 378 | } |
2a81ab0d AM |
379 | } |
380 | } | |
381 | } | |
382 | } | |
2a81ab0d AM |
383 | } |
384 | } | |
385 | } | |
386 | %sourcehash=(); | |
387 | %targethash=(); | |
388 | undef $TIME; | |
389 | undef $TIMEFROM; | |
390 | undef $TIMETILL; | |
a6edca5a | 391 | undef $fireport; |
2a81ab0d AM |
392 | } |
393 | } | |
a6edca5a AM |
394 | sub get_nat_ip |
395 | { | |
396 | my $val=shift; | |
08e1c65d | 397 | my $type=shift; |
a6edca5a AM |
398 | my $result; |
399 | if($val eq 'RED' || $val eq 'GREEN' || $val eq 'ORANGE' || $val eq 'BLUE'){ | |
400 | $result=$defaultNetworks{$val.'_ADDRESS'}; | |
401 | }elsif($val eq 'ALL'){ | |
402 | $result='-i '.$con; | |
08e1c65d | 403 | }elsif($val eq 'Default IP' && $type eq 'dnat'){ |
a6edca5a | 404 | $result='-d '.$redip; |
08e1c65d AM |
405 | }elsif($val eq 'Default IP' && $type eq 'snat'){ |
406 | $result=$redip; | |
a6edca5a AM |
407 | }else{ |
408 | foreach my $al (sort keys %aliases){ | |
08e1c65d | 409 | if($val eq $al && $type eq 'dnat'){ |
a6edca5a | 410 | $result='-d '.$aliases{$al}{'IPT'}; |
08e1c65d AM |
411 | }elsif($val eq $al && $type eq 'snat'){ |
412 | $result=$aliases{$al}{'IPT'}; | |
a6edca5a AM |
413 | } |
414 | } | |
415 | } | |
416 | return $result; | |
417 | } | |
472136c9 AM |
418 | sub get_time |
419 | { | |
420 | my $val=shift; | |
421 | my $val1=shift; | |
422 | my $time; | |
423 | my $minutes; | |
424 | my $ruletime; | |
425 | $minutes = &utcmin($val); | |
426 | $ruletime = $minutes + &time_get_utc($val); | |
427 | if ($ruletime < 0){$ruletime +=1440;} | |
428 | if ($ruletime > 1440){$ruletime -=1440;} | |
429 | $time=sprintf "%02d:%02d", $ruletime / 60, $ruletime % 60; | |
430 | return $time; | |
431 | } | |
432 | sub time_get_utc | |
433 | { | |
434 | # Calculates the UTCtime from a given time | |
435 | my $val=shift; | |
436 | my @localtime=localtime(time); | |
437 | my @gmtime=gmtime(time); | |
438 | my $diff = ($gmtime[2]*60+$gmtime[1]%60)-($localtime[2]*60+$localtime[1]%60); | |
439 | return $diff; | |
440 | } | |
441 | sub utcmin | |
442 | { | |
443 | my $ruletime=shift; | |
444 | my ($hrs,$min) = split(":",$ruletime); | |
445 | my $newtime = $hrs*60+$min; | |
446 | return $newtime; | |
447 | } | |
36196d0d AM |
448 | sub p2pblock |
449 | { | |
450 | my $P2PSTRING; | |
451 | my $DO; | |
452 | open( FILE, "< $p2pfile" ) or die "Unable to read $p2pfile"; | |
453 | @p2ps = <FILE>; | |
454 | close FILE; | |
455 | my $CMD = "-m ipp2p"; | |
456 | foreach my $p2pentry (sort @p2ps) { | |
457 | my @p2pline = split( /\;/, $p2pentry ); | |
8d1beadc AM |
458 | if ( $fwdfwsettings{'POLICY'} eq 'MODE1' ) { |
459 | $DO = "ACCEPT"; | |
5238a871 | 460 | if ("$p2pline[2]" eq "on") { |
36196d0d AM |
461 | $P2PSTRING = "$P2PSTRING --$p2pline[1]"; |
462 | } | |
8d1beadc | 463 | }else { |
36196d0d | 464 | $DO = "RETURN"; |
5238a871 | 465 | if ("$p2pline[2]" eq "off") { |
36196d0d AM |
466 | $P2PSTRING = "$P2PSTRING --$p2pline[1]"; |
467 | } | |
468 | } | |
469 | } | |
470 | if ($MODE eq 1){ | |
471 | if($P2PSTRING){ | |
472 | print"/sbin/iptables -A FORWARDFW $CMD $P2PSTRING -j $DO\n"; | |
473 | } | |
474 | }else{ | |
475 | if($P2PSTRING){ | |
476 | system("/sbin/iptables -A FORWARDFW $CMD $P2PSTRING -j $DO"); | |
477 | } | |
478 | } | |
479 | } | |
2a81ab0d AM |
480 | sub get_address |
481 | { | |
482 | my $base=shift; #source of checking ($configfwdfw{$key}[x] or groupkey | |
483 | my $base2=shift; | |
484 | my $type=shift; #src or tgt | |
485 | my $hash; | |
486 | if ($type eq 'src'){ | |
487 | $hash=\%sourcehash; | |
488 | }else{ | |
489 | $hash=\%targethash; | |
490 | } | |
491 | my $key = &General::findhasharraykey($hash); | |
492 | if($base eq 'src_addr' || $base eq 'tgt_addr' ){ | |
b5269091 AM |
493 | if (&General::validmac($base2)){ |
494 | $$hash{$key}[0] = "-m mac --mac-source $base2"; | |
495 | }else{ | |
496 | $$hash{$key}[0] = $base2; | |
497 | } | |
2a81ab0d | 498 | }elsif($base eq 'std_net_src' || $base eq 'std_net_tgt' || $base eq 'Standard Network'){ |
ddcec9d3 | 499 | $$hash{$key}[0]=&fwlib::get_std_net_ip($base2,$con); |
2a81ab0d AM |
500 | }elsif($base eq 'cust_net_src' || $base eq 'cust_net_tgt' || $base eq 'Custom Network'){ |
501 | $$hash{$key}[0]=&fwlib::get_net_ip($base2); | |
502 | }elsif($base eq 'cust_host_src' || $base eq 'cust_host_tgt' || $base eq 'Custom Host'){ | |
503 | $$hash{$key}[0]=&fwlib::get_host_ip($base2,$type); | |
504 | }elsif($base eq 'ovpn_net_src' || $base eq 'ovpn_net_tgt' || $base eq 'OpenVPN static network'){ | |
505 | $$hash{$key}[0]=&fwlib::get_ovpn_net_ip($base2,1); | |
506 | }elsif($base eq 'ovpn_host_src' ||$base eq 'ovpn_host_tgt' || $base eq 'OpenVPN static host'){ | |
507 | $$hash{$key}[0]=&fwlib::get_ovpn_host_ip($base2,33); | |
508 | }elsif($base eq 'ovpn_n2n_src' ||$base eq 'ovpn_n2n_tgt' || $base eq 'OpenVPN N-2-N'){ | |
6fab5bca | 509 | $$hash{$key}[0]=&fwlib::get_ovpn_n2n_ip($base2,11); |
2a81ab0d AM |
510 | }elsif($base eq 'ipsec_net_src' || $base eq 'ipsec_net_tgt' || $base eq 'IpSec Network'){ |
511 | $$hash{$key}[0]=&fwlib::get_ipsec_net_ip($base2,11); | |
512 | } | |
513 | } | |
514 | sub get_prot | |
515 | { | |
516 | my $hash=shift; | |
517 | my $key=shift; | |
518 | if ($$hash{$key}[7] eq 'ON' && $SRC_TGT eq 'SRC'){ | |
519 | if ($$hash{$key}[10] ne ''){ | |
520 | return"$$hash{$key}[8]"; | |
521 | }elsif($$hash{$key}[9] ne ''){ | |
522 | return"$$hash{$key}[8]"; | |
523 | }else{ | |
524 | return "$$hash{$key}[8]"; | |
525 | } | |
526 | }elsif($$hash{$key}[11] eq 'ON' && $SRC_TGT eq ''){ | |
527 | if ($$hash{$key}[14] eq 'TGT_PORT'){ | |
528 | if ($$hash{$key}[15] ne ''){ | |
529 | return "$$hash{$key}[12]"; | |
530 | }elsif($$hash{$key}[13] ne ''){ | |
531 | return "$$hash{$key}[12]"; | |
532 | }else{ | |
533 | return "$$hash{$key}[12]"; | |
534 | } | |
535 | }elsif($$hash{$key}[14] eq 'cust_srv'){ | |
536 | return &fwlib::get_srv_prot($$hash{$key}[15]); | |
537 | ||
538 | }elsif($$hash{$key}[14] eq 'cust_srvgrp'){ | |
539 | return &fwlib::get_srvgrp_prot($$hash{$key}[15]); | |
540 | } | |
541 | } | |
98cee89f AM |
542 | #DNAT |
543 | if ($SRC_TGT eq '' && $$hash{$key}[31] eq 'dnat' && $$hash{$key}[11] eq '' && $$hash{$key}[12] ne ''){ | |
544 | return "$$hash{$key}[12]"; | |
545 | } | |
2a81ab0d AM |
546 | } |
547 | sub get_port | |
548 | { | |
549 | my $hash=shift; | |
550 | my $key=shift; | |
551 | my $prot=shift; | |
552 | if ($$hash{$key}[7] eq 'ON' && $SRC_TGT eq 'SRC'){ | |
553 | if ($$hash{$key}[10] ne ''){ | |
8f0b047b | 554 | $$hash{$key}[10] =~ s/\|/,/g; |
93a5f4a5 AM |
555 | if(index($$hash{$key}[10],",") > 0){ |
556 | return "-m multiport --sport $$hash{$key}[10] "; | |
557 | }else{ | |
a6edca5a AM |
558 | if($$hash{$key}[28] ne 'ON' || ($$hash{$key}[28] eq 'ON' && $$hash{$key}[31] eq 'snat') ||($$hash{$key}[28] eq 'ON' && $$hash{$key}[31] eq 'dnat') ){ |
559 | return "--sport $$hash{$key}[10] "; | |
560 | }else{ | |
561 | return ":$$hash{$key}[10]"; | |
562 | } | |
93a5f4a5 | 563 | } |
62fc8511 | 564 | }elsif($$hash{$key}[9] ne '' && $$hash{$key}[9] ne 'All ICMP-Types'){ |
2a81ab0d | 565 | return "--icmp-type $$hash{$key}[9] "; |
62fc8511 AM |
566 | }elsif($$hash{$key}[9] eq 'All ICMP-Types'){ |
567 | return; | |
2a81ab0d AM |
568 | } |
569 | }elsif($$hash{$key}[11] eq 'ON' && $SRC_TGT eq ''){ | |
2a81ab0d AM |
570 | if($$hash{$key}[14] eq 'TGT_PORT'){ |
571 | if ($$hash{$key}[15] ne ''){ | |
8f0b047b | 572 | $$hash{$key}[15] =~ s/\|/,/g; |
93a5f4a5 AM |
573 | if(index($$hash{$key}[15],",") > 0){ |
574 | return "-m multiport --dport $$hash{$key}[15] "; | |
575 | }else{ | |
a6edca5a AM |
576 | if($$hash{$key}[28] ne 'ON' || ($$hash{$key}[28] eq 'ON' && $$hash{$key}[31] eq 'snat') ){ |
577 | return "--dport $$hash{$key}[15] "; | |
578 | }else{ | |
829697d0 | 579 | $$hash{$key}[15] =~ s/\:/-/g; |
a6edca5a AM |
580 | return ":$$hash{$key}[15]"; |
581 | } | |
93a5f4a5 | 582 | } |
2a81ab0d AM |
583 | }elsif($$hash{$key}[13] ne '' && $$hash{$key}[13] ne 'All ICMP-Types'){ |
584 | return "--icmp-type $$hash{$key}[13] "; | |
585 | }elsif($$hash{$key}[13] ne '' && $$hash{$key}[13] eq 'All ICMP-Types'){ | |
586 | return; | |
587 | } | |
588 | }elsif($$hash{$key}[14] eq 'cust_srv'){ | |
589 | if ($prot ne 'ICMP'){ | |
6be32fe5 AM |
590 | if($$hash{$key}[31] eq 'dnat'){ |
591 | return ":".&fwlib::get_srv_port($$hash{$key}[15],1,$prot); | |
592 | }else{ | |
593 | return "--dport ".&fwlib::get_srv_port($$hash{$key}[15],1,$prot); | |
594 | } | |
2a81ab0d AM |
595 | }elsif($prot eq 'ICMP' && $$hash{$key}[15] ne 'All ICMP-Types'){ |
596 | return "--icmp-type ".&fwlib::get_srv_port($$hash{$key}[15],3,$prot); | |
597 | }elsif($prot eq 'ICMP' && $$hash{$key}[15] eq 'All ICMP-Types'){ | |
598 | return; | |
599 | } | |
600 | }elsif($$hash{$key}[14] eq 'cust_srvgrp'){ | |
601 | if ($prot ne 'ICMP'){ | |
602 | return &fwlib::get_srvgrp_port($$hash{$key}[15],$prot); | |
603 | } | |
604 | elsif($prot eq 'ICMP'){ | |
605 | return &fwlib::get_srvgrp_port($$hash{$key}[15],$prot); | |
606 | } | |
2a81ab0d AM |
607 | } |
608 | } | |
609 | } |