2 ###############################################################################
4 # IPFire.org - A linux based firewall #
5 # Copyright (C) 2013 Alexander Marx <amarx@ipfire.org> #
7 # This program is free software: you can redistribute it and/or modify #
8 # it under the terms of the GNU General Public License as published by #
9 # the Free Software Foundation, either version 3 of the License, or #
10 # (at your option) any later version. #
12 # This program is distributed in the hope that it will be useful, #
13 # but WITHOUT ANY WARRANTY; without even the implied warranty of #
14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
15 # GNU General Public License for more details. #
17 # You should have received a copy of the GNU General Public License #
18 # along with this program. If not, see <http://www.gnu.org/licenses/>. #
20 ###############################################################################
23 no warnings
'uninitialized';
30 my %customgeoipgrp=();
32 my %customservicegrp=();
41 require '/var/ipfire/general-functions.pl';
42 require '/var/ipfire/geoip-functions.pl';
44 my $confignet = "${General::swroot}/fwhosts/customnetworks";
45 my $confighost = "${General::swroot}/fwhosts/customhosts";
46 my $configgrp = "${General::swroot}/fwhosts/customgroups";
47 my $configgeoipgrp = "${General::swroot}/fwhosts/customgeoipgrp";
48 my $configsrv = "${General::swroot}/fwhosts/customservices";
49 my $configsrvgrp = "${General::swroot}/fwhosts/customservicegrp";
50 my $configccdnet = "${General::swroot}/ovpn/ccd.conf";
51 my $configccdhost = "${General::swroot}/ovpn/ovpnconfig";
52 my $configipsec = "${General::swroot}/vpn/config";
53 my $configovpn = "${General::swroot}/ovpn/settings";
56 my $netsettings = "${General::swroot}/ethernet/settings";
58 &General
::readhash
("/var/ipfire/ethernet/settings", \
%netsettings);
59 &General
::readhash
("${General::swroot}/ovpn/settings", \
%ovpnsettings);
60 &General
::readhash
("${General::swroot}/vpn/settings", \
%ipsecsettings);
62 &General
::readhasharray
("$confignet", \
%customnetwork);
63 &General
::readhasharray
("$confighost", \
%customhost);
64 &General
::readhasharray
("$configgrp", \
%customgrp);
65 &General
::readhasharray
("$configgeoipgrp", \
%customgeoipgrp);
66 &General
::readhasharray
("$configccdnet", \
%ccdnet);
67 &General
::readhasharray
("$configccdhost", \
%ccdhost);
68 &General
::readhasharray
("$configipsec", \
%ipsecconf);
69 &General
::readhasharray
("$configsrv", \
%customservice);
70 &General
::readhasharray
("$configsrvgrp", \
%customservicegrp);
71 &General
::get_aliases
(\
%aliases);
76 foreach my $key (sort {$a <=> $b} keys %customservice){
77 if($customservice{$key}[0] eq $val){
78 if ($customservice{$key}[0] eq $val){
79 return $customservice{$key}[2];
91 foreach my $key (sort {$a <=> $b} keys %customservicegrp){
92 if($customservicegrp{$key}[0] eq $val){
93 if (&get_srv_prot
($customservicegrp{$key}[2]) eq 'TCP'){
95 }elsif(&get_srv_prot
($customservicegrp{$key}[2]) eq 'UDP'){
97 }elsif(&get_srv_prot
($customservicegrp{$key}[2]) eq 'ICMP'){
100 #Protocols used in servicegroups
101 push (@ips,$customservicegrp{$key}[2]);
105 if ($tcp eq '1'){push (@ips,'TCP');}
106 if ($udp eq '1'){push (@ips,'UDP');}
107 if ($icmp eq '1'){push (@ips,'ICMP');}
108 my $back=join(",",@ips);
117 foreach my $key (sort {$a <=> $b} keys %customservice){
118 if($customservice{$key}[0] eq $val && $customservice{$key}[2] eq $prot){
119 return $customservice{$key}[$field];
130 foreach my $key (sort {$a <=> $b} keys %customservicegrp){
131 if($customservicegrp{$key}[0] eq $val){
132 if ($prot ne 'ICMP'){
133 $value=&get_srv_port
($customservicegrp{$key}[2],1,$prot);
134 }elsif ($prot eq 'ICMP'){
135 $value=&get_srv_port
($customservicegrp{$key}[2],3,$prot);
137 push (@ips,$value) if ($value ne '') ;
141 if ($#ips gt 0){$back="-m multiport --dports ";}else{$back="--dport ";}
142 }elsif ($prot eq 'ICMP'){
143 $back="--icmp-type ";
146 $back.=join(",",@ips);
153 foreach my $key (sort {$a <=> $b} keys %ipsecconf){
154 #adapt $val to reflect real name without subnet (if rule with only one ipsec subnet is created)
155 my @tmpval = split (/\|/, $val);
157 if($ipsecconf{$key}[1] eq $val){
158 return $ipsecconf{$key}[$field];
162 sub get_ipsec_host_ip
166 foreach my $key (sort {$a <=> $b} keys %ipsecconf){
167 if($ipsecconf{$key}[1] eq $val){
168 return $ipsecconf{$key}[$field];
175 foreach my $key (keys %ipsecconf) {
176 if ($ipsecconf{$key}[1] eq $val) {
185 foreach my $key (sort {$a <=> $b} keys %ccdhost){
186 if($ccdhost{$key}[1] eq $val){
187 return $ccdhost{$key}[$field];
195 foreach my $key (sort {$a <=> $b} keys %ccdhost){
196 if($ccdhost{$key}[1] eq $val){
197 return $ccdhost{$key}[$field];
206 foreach my $key (sort {$a <=> $b} keys %ccdnet){
207 if($ccdnet{$key}[0] eq $val){
208 return $ccdnet{$key}[$field];
216 foreach my $key (sort {$a <=> $b} keys %customgrp){
217 if ($customgrp{$key}[0] eq $val){
218 &get_address
($customgrp{$key}[3],$src);
228 return "0.0.0.0/0.0.0.0";
229 }elsif($val eq 'GREEN'){
230 return "$netsettings{'GREEN_NETADDRESS'}/$netsettings{'GREEN_NETMASK'}";
231 }elsif($val eq 'ORANGE'){
232 return "$netsettings{'ORANGE_NETADDRESS'}/$netsettings{'ORANGE_NETMASK'}";
233 }elsif($val eq 'BLUE'){
234 return "$netsettings{'BLUE_NETADDRESS'}/$netsettings{'BLUE_NETMASK'}";
235 }elsif($val eq 'RED'){
237 }elsif($val =~ /OpenVPN/i){
238 return "$ovpnsettings{'DOVPN_SUBNET'}";
239 }elsif($val =~ /IPsec/i){
240 return "$ipsecsettings{'RW_NET'}";
241 }elsif($val eq 'IPFire'){
248 if($net eq "$netsettings{'GREEN_NETADDRESS'}/$netsettings{'GREEN_NETMASK'}"){
249 return "$netsettings{'GREEN_DEV'}";
251 if($net eq "$netsettings{'ORANGE_NETADDRESS'}/$netsettings{'ORANGE_NETMASK'}"){
252 return "$netsettings{'ORANGE_DEV'}";
254 if($net eq "$netsettings{'BLUE_NETADDRESS'}/$netsettings{'BLUE_NETMASK'}"){
255 return "$netsettings{'BLUE_DEV'}";
257 if($net eq "0.0.0.0/0") {
258 return &get_external_interface
();
265 foreach my $key (sort {$a <=> $b} keys %customnetwork){
266 if($customnetwork{$key}[0] eq $val){
267 return "$customnetwork{$key}[1]/$customnetwork{$key}[2]";
275 foreach my $key (sort {$a <=> $b} keys %customhost){
276 if($customhost{$key}[0] eq $val){
277 if ($customhost{$key}[1] eq 'mac' && $src eq 'src'){
278 return "-m mac --mac-source $customhost{$key}[2]";
279 }elsif($customhost{$key}[1] eq 'ip' && $src eq 'src'){
280 return "$customhost{$key}[2]";
281 }elsif($customhost{$key}[1] eq 'ip' && $src eq 'tgt'){
282 return "$customhost{$key}[2]";
283 }elsif($customhost{$key}[1] eq 'mac' && $src eq 'tgt'){
300 if ($type eq "src") {
301 $addr_type = $$hash{$key}[3];
302 $value = $$hash{$key}[4];
304 } elsif ($type eq "tgt") {
305 $addr_type = $$hash{$key}[5];
306 $value = $$hash{$key}[6];
309 if ($addr_type ~~ ["cust_grp_src", "cust_grp_tgt"]) {
310 foreach my $grp (sort {$a <=> $b} keys %customgrp) {
311 if ($customgrp{$grp}[0] eq $value) {
312 my @address = &get_address
($customgrp{$grp}[3], $customgrp{$grp}[2], $type);
315 push(@addresses, @address);
319 }elsif ($addr_type ~~ ["cust_geoip_src", "cust_geoip_tgt"] && $value =~ "group:") {
320 $value=substr($value,6);
321 foreach my $grp (sort {$a <=> $b} keys %customgeoipgrp) {
322 if ($customgeoipgrp{$grp}[0] eq $value) {
323 my @address = &get_address
($addr_type, $customgeoipgrp{$grp}[2], $type);
326 push(@addresses, @address);
331 my @address = &get_address
($addr_type, $value, $type);
334 push(@addresses, @address);
348 # If the user manually typed an address, we just check if it is a MAC
349 # address. Otherwise, we assume that it is an IP address.
350 if ($key ~~ ["src_addr", "tgt_addr"]) {
351 if (&General
::validmac
($value)) {
352 push(@ret, ["-m mac --mac-source $value", ""]);
354 push(@ret, [$value, ""]);
357 # If a default network interface (GREEN, BLUE, etc.) is selected, we
358 # try to get the corresponding address of the network.
359 } elsif ($key ~~ ["std_net_src", "std_net_tgt", "Standard Network"]) {
360 my $external_interface = &get_external_interface
();
362 my $network_address = &get_std_net_ip
($value, $external_interface);
364 if ($network_address) {
365 my $interface = &get_interface
($network_address);
366 push(@ret, [$network_address, $interface]);
370 } elsif ($key ~~ ["cust_net_src", "cust_net_tgt", "Custom Network"]) {
371 my $network_address = &get_net_ip
($value);
372 if ($network_address) {
373 push(@ret, [$network_address, ""]);
377 } elsif ($key ~~ ["cust_host_src", "cust_host_tgt", "Custom Host"]) {
378 my $host_address = &get_host_ip
($value, $type);
380 push(@ret, [$host_address, ""]);
384 } elsif ($key ~~ ["ovpn_net_src", "ovpn_net_tgt", "OpenVPN static network"]) {
385 my $network_address = &get_ovpn_net_ip
($value, 1);
386 if ($network_address) {
387 push(@ret, [$network_address, ""]);
391 } elsif ($key ~~ ["ovpn_host_src", "ovpn_host_tgt", "OpenVPN static host"]) {
392 my $host_address = &get_ovpn_host_ip
($value, 33);
394 push(@ret, [$host_address, ""]);
398 } elsif ($key ~~ ["ovpn_n2n_src", "ovpn_n2n_tgt", "OpenVPN N-2-N"]) {
399 my $network_address = &get_ovpn_n2n_ip
($value, 11);
400 if ($network_address) {
401 push(@ret, [$network_address, ""]);
405 } elsif ($key ~~ ["ipsec_net_src", "ipsec_net_tgt", "IpSec Network"]) {
406 #Check if we have multiple subnets and only want one of them
407 if ( $value =~ /\|/ ){
408 my @parts = split(/\|/, $value);
409 push(@ret, [$parts[1], ""]);
411 my $interface_mode = &get_ipsec_net_ip
($value, 36);
412 if ($interface_mode ~~ ["gre", "vti"]) {
413 my $id = &get_ipsec_id
($value);
414 push(@ret, ["0.0.0.0/0", "${interface_mode}${id}"]);
416 my $network_address = &get_ipsec_net_ip
($value, 11);
417 my @nets = split(/\|/, $network_address);
418 foreach my $net (@nets) {
419 push(@ret, [$net, ""]);
424 # The firewall's own IP addresses.
425 } elsif ($key ~~ ["ipfire", "ipfire_src"]) {
427 if ($value eq "ALL") {
428 push(@ret, ["0/0", ""]);
431 } elsif ($value eq "GREEN") {
432 push(@ret, [$netsettings{"GREEN_ADDRESS"}, ""]);
435 } elsif ($value eq "BLUE") {
436 push(@ret, [$netsettings{"BLUE_ADDRESS"}, ""]);
439 } elsif ($value eq "ORANGE") {
440 push(@ret, [$netsettings{"ORANGE_ADDRESS"}, ""]);
443 } elsif ($value ~~ ["RED", "RED1"]) {
444 my $address = &get_external_address
();
446 push(@ret, [$address, ""]);
451 my $alias = &get_alias
($value);
453 push(@ret, [$alias, ""]);
457 # Handle rule options with GeoIP as source.
458 } elsif ($key eq "cust_geoip_src") {
459 # Get external interface.
460 my $external_interface = &get_external_interface
();
462 push(@ret, ["-m geoip --src-cc $value", "$external_interface"]);
464 # Handle rule options with GeoIP as target.
465 } elsif ($key eq "cust_geoip_tgt") {
466 # Get external interface.
467 my $external_interface = &get_external_interface
();
469 push(@ret, ["-m geoip --dst-cc $value", "$external_interface"]);
471 # If nothing was selected, we assume "any".
473 push(@ret, ["0/0", ""]);
478 sub get_external_interface
()
480 open(IFACE
, "/var/ipfire/red/iface") or return "";
486 sub get_external_address
()
488 open(ADDR
, "/var/ipfire/red/local-ipaddress") or return "";
489 my $address = <ADDR
>;
498 foreach my $alias (sort keys %aliases) {
500 return $aliases{$alias}{"IPT"};
505 sub get_nat_address
{
509 # Any static address of any zone.
510 if ($zone eq "AUTO") {
511 if ($source && ($source !~ m/mac/i )) {
512 my $firewall_ip = &get_internal_firewall_ip_address
($source, 1);
517 $firewall_ip = &get_matching_firewall_address
($source, 1);
523 return &get_external_address
();
525 } elsif ($zone eq "RED" || $zone eq "GREEN" || $zone eq "ORANGE" || $zone eq "BLUE") {
526 return $netsettings{$zone . "_ADDRESS"};
528 } elsif ($zone ~~ ["Default IP", "ALL"]) {
529 return &get_external_address
();
532 my $alias = &get_alias
($zone);
534 $alias = &get_external_address
();
539 print_error
("Could not find NAT address");
542 sub get_internal_firewall_ip_addresses
544 my $use_orange = shift;
546 my @zones = ("GREEN", "BLUE");
548 push(@zones, "ORANGE");
552 for my $zone (@zones) {
553 next unless (exists $netsettings{$zone . "_ADDRESS"});
555 my $zone_address = $netsettings{$zone . "_ADDRESS"};
556 push(@addresses, $zone_address);
561 sub get_matching_firewall_address
564 my $use_orange = shift;
566 my ($address, $netmask) = split("/", $addr);
568 my @zones = ("GREEN", "BLUE");
570 push(@zones, "ORANGE");
573 foreach my $zone (@zones) {
574 next unless (exists $netsettings{$zone . "_ADDRESS"});
576 my $zone_subnet = $netsettings{$zone . "_NETADDRESS"};
577 my $zone_mask = $netsettings{$zone . "_NETMASK"};
579 if (&General
::IpInSubnet
($address, $zone_subnet, $zone_mask)) {
580 return $netsettings{$zone . "_ADDRESS"};
586 sub get_internal_firewall_ip_address
589 my $use_orange = shift;
591 my ($net_address, $net_mask) = split("/", $subnet);
592 if ((!$net_mask) || ($net_mask ~~ ["32", "255.255.255.255"])) {
596 # Convert net mask into correct format for &General::IpInSubnet().
597 $net_mask = &General
::iporsubtodec
($net_mask);
599 my @addresses = &get_internal_firewall_ip_addresses
($use_orange);
600 foreach my $zone_address (@addresses) {
601 if (&General
::IpInSubnet
($zone_address, $net_address, $net_mask)) {
602 return $zone_address;
609 sub get_geoip_locations
() {
610 return &GeoIP
::get_geoip_locations
();