]>
git.ipfire.org Git - ipfire-2.x.git/blob - config/firewall/convert-dmz
3 ###############################################################################
5 # IPFire.org - A linux based firewall #
6 # Copyright (C) 2013 Alexander Marx <amarx@ipfire.org> #
8 # This program is free software: you can redistribute it and/or modify #
9 # it under the terms of the GNU General Public License as published by #
10 # the Free Software Foundation, either version 3 of the License, or #
11 # (at your option) any later version. #
13 # This program is distributed in the hope that it will be useful, #
14 # but WITHOUT ANY WARRANTY; without even the implied warranty of #
15 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
16 # GNU General Public License for more details. #
18 # You should have received a copy of the GNU General Public License #
19 # along with this program. If not, see <http://www.gnu.org/licenses/>. #
21 ###############################################################################
23 # This script converts old dmz holes rules from old firewall #
24 # to the new one. This is a 2-step process. #
25 # STEP1: read old config and normalize settings #
26 # STEP2: check valid ip and save valid rules to new firewall #
28 ###############################################################################
34 require '/var/ipfire/general-functions.pl';
35 my $dmzconfig = "${General::swroot}/dmzholes/config";
36 my $fwdfwconfig = "${General::swroot}/firewall/config";
37 my $ifacesettings = "${General::swroot}/ethernet/settings";
38 my $field0 = 'ACCEPT';
39 my $field1 = 'FORWARDFW';
40 my $field2 = ''; #ON or emtpy
41 my $field3 = ''; #std_net_src or src_addr
42 my $field4 = ''; #ALL or IP-Address with /32
43 my $field5 = ''; #std_net_tgt or tgt_addr
44 my $field6 = ''; #IP or network name
45 my $field11 = 'ON'; #use target port
46 my $field12 = ''; #TCP or UDP
47 my $field13 = 'All ICMP-Types';
48 my $field14 = 'TGT_PORT';
49 my $field15 = ''; #Port Number
50 my $field16 = ''; #remark
51 my $field26 = '00:00';
52 my $field27 = '00:00';
58 if (! -e
"$dmzconfig") {
59 print "DMZ config file not found. Exiting!\n";
63 if (! -s
"$dmzconfig") {
64 print "Empty DMZ configuration file. Nothing to do. Exiting...\n";
68 open(FILE
, $dmzconfig) or die 'Unable to open config file.';
72 open (LOG
, ">/var/log/converters/dmz-convert.log") or die $!;
73 &General
::readhash
($ifacesettings, \
%ifaces);
74 &General
::readhasharray
($fwdfwconfig,\
%configfwdfw);
77 foreach my $line (@current){
79 #get values from old configfile
80 my ($a,$b,$c,$d,$e,$f,$g,$h) = split (",",$line);
82 print LOG
"$now Processing A: $a B: $b C: $c D: $d E: $e F: $f G: $g H: $h\n";
83 #Now convert values and check ip addresses
86 $field2=$e if($e eq 'ON');
89 if (&General
::validipandmask
($b)){
90 #When ip valid, check if we have a network
91 my ($ip,$subnet) = split ("/",$b);
92 if ($f eq 'orange' && $ip eq $ifaces{'ORANGE_NETADDRESS'}){
93 $field3='std_net_src';
95 }elsif($f eq 'blue' && $ip eq $ifaces{'BLUE_NETADDRESS'}){
96 $field3='std_net_src';
98 }elsif($f eq 'orange' && &General
::IpInSubnet
($ip,$ifaces{'ORANGE_NETADDRESS'},$ifaces{'ORANGE_NETMASK'})){
101 }elsif($f eq 'blue' && &General
::IpInSubnet
($ip,$ifaces{'BLUE_NETADDRESS'},$ifaces{'BLUE_NETMASK'})){
105 print LOG
"$now ->NOT Converted, source ip $b not part of source network $f \n\n";
109 print LOG
"$now -> SOURCE IP INVALID. \n\n";
114 if (&General
::validipandmask
($c)){
116 #When ip valid, check if we have a network
117 my ($ip,$subnet) = split ("/",$c);
118 if ($g eq 'green' && $ip eq $ifaces{'GREEN_NETADDRESS'}){
119 $field5='std_net_tgt';
121 }elsif($g eq 'blue' && $ip eq $ifaces{'BLUE_NETADDRESS'}){
122 $field5='std_net_tgt';
124 }elsif($g eq 'green' && &General
::IpInSubnet
($ip,$ifaces{'GREEN_NETADDRESS'},$ifaces{'GREEN_NETMASK'})){
127 }elsif($g eq 'blue' && &General
::IpInSubnet
($ip,$ifaces{'BLUE_NETADDRESS'},$ifaces{'BLUE_NETMASK'})){
131 print LOG
"$now ->NOT Converted, target ip $c not part of target network $g \n\n";
135 print LOG
"$now -> TARGET IP INVALID. \n\n";
143 my $key = &General
::findhasharraykey
(\
%configfwdfw);
144 foreach my $i (0 .. 27) { $configfwdfw{$key}[$i] = "";}
145 $configfwdfw{$key}[0] = $field0;
146 $configfwdfw{$key}[1] = $field1;
147 $configfwdfw{$key}[2] = $field2;
148 $configfwdfw{$key}[3] = $field3;
149 $configfwdfw{$key}[4] = $field4;
150 $configfwdfw{$key}[5] = $field5;
151 $configfwdfw{$key}[6] = $field6;
152 $configfwdfw{$key}[7] = '';
153 $configfwdfw{$key}[8] = $field12;
154 $configfwdfw{$key}[9] = '';
155 $configfwdfw{$key}[10] = '';
156 $configfwdfw{$key}[11] = $field11;
157 $configfwdfw{$key}[12] = '';
158 $configfwdfw{$key}[13] = '';
159 $configfwdfw{$key}[14] = $field14;
160 $configfwdfw{$key}[15] = $field15;
161 $configfwdfw{$key}[16] = $field16;
162 $configfwdfw{$key}[17] = '';
163 $configfwdfw{$key}[18] = '';
164 $configfwdfw{$key}[19] = '';
165 $configfwdfw{$key}[20] = '';
166 $configfwdfw{$key}[21] = '';
167 $configfwdfw{$key}[22] = '';
168 $configfwdfw{$key}[23] = '';
169 $configfwdfw{$key}[24] = '';
170 $configfwdfw{$key}[25] = '';
171 $configfwdfw{$key}[26] = $field26;
172 $configfwdfw{$key}[27] = $field27;
173 $configfwdfw{$key}[28] = $field28;
174 $configfwdfw{$key}[29] = $field29;
175 $configfwdfw{$key}[30] = $field30;
176 $configfwdfw{$key}[31] = $field31;
177 print LOG
"$Now -> Converted to $field0,$field1,$field2,$field3,$field4,$field5,$field6,,$field12,,,$field11,,,$field14,$field15,$field16,,,,,,,,,,$field26,$field27,$field28,$field29,$field30,$field31\n";
179 &General
::writehasharray
($fwdfwconfig,\
%configfwdfw);
187 #ip with subnet in decimal
188 if($adr =~ m/^(\d\d?\d?).(\d\d?\d?).(\d\d?\d?).(\d\d?\d?)\/(\d
{1,2})$/){
189 $adr=int($1).".".int($2).".".int($3).".".int($4);
190 my $b = &General
::iporsubtodec
($5);
192 }elsif($adr =~ /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/){
193 $adr=int($1).".".int($2).".".int($3).".".int($4);
194 if(&General
::validip
($adr)){
198 if(&General
::validipandmask
($adr)){
199 $a=&General
::iporsubtodec
($adr);