2 ###############################################################################
4 # IPFire.org - A linux based firewall #
5 # Copyright (C) 2013 Alexander Marx <amarx@ipfire.org> #
7 # This program is free software: you can redistribute it and/or modify #
8 # it under the terms of the GNU General Public License as published by #
9 # the Free Software Foundation, either version 3 of the License, or #
10 # (at your option) any later version. #
12 # This program is distributed in the hope that it will be useful, #
13 # but WITHOUT ANY WARRANTY; without even the implied warranty of #
14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
15 # GNU General Public License for more details. #
17 # You should have received a copy of the GNU General Public License #
18 # along with this program. If not, see <http://www.gnu.org/licenses/>. #
20 ###############################################################################
23 no warnings
'uninitialized';
31 my %customservicegrp=();
40 require '/var/ipfire/general-functions.pl';
42 my $confignet = "${General::swroot}/fwhosts/customnetworks";
43 my $confighost = "${General::swroot}/fwhosts/customhosts";
44 my $configgrp = "${General::swroot}/fwhosts/customgroups";
45 my $configsrv = "${General::swroot}/fwhosts/customservices";
46 my $configsrvgrp = "${General::swroot}/fwhosts/customservicegrp";
47 my $configccdnet = "${General::swroot}/ovpn/ccd.conf";
48 my $configccdhost = "${General::swroot}/ovpn/ovpnconfig";
49 my $configipsec = "${General::swroot}/vpn/config";
50 my $configovpn = "${General::swroot}/ovpn/settings";
53 my $netsettings = "${General::swroot}/ethernet/settings";
55 &General
::readhash
("/var/ipfire/ethernet/settings", \
%netsettings);
56 &General
::readhash
("${General::swroot}/ovpn/settings", \
%ovpnsettings);
57 &General
::readhash
("${General::swroot}/vpn/settings", \
%ipsecsettings);
59 &General
::readhasharray
("$confignet", \
%customnetwork);
60 &General
::readhasharray
("$confighost", \
%customhost);
61 &General
::readhasharray
("$configgrp", \
%customgrp);
62 &General
::readhasharray
("$configccdnet", \
%ccdnet);
63 &General
::readhasharray
("$configccdhost", \
%ccdhost);
64 &General
::readhasharray
("$configipsec", \
%ipsecconf);
65 &General
::readhasharray
("$configsrv", \
%customservice);
66 &General
::readhasharray
("$configsrvgrp", \
%customservicegrp);
71 foreach my $key (sort {$a <=> $b} keys %customservice){
72 if($customservice{$key}[0] eq $val){
73 if ($customservice{$key}[0] eq $val){
74 return $customservice{$key}[2];
86 foreach my $key (sort {$a <=> $b} keys %customservicegrp){
87 if($customservicegrp{$key}[0] eq $val){
88 if (&get_srv_prot
($customservicegrp{$key}[2]) eq 'TCP'){
90 }elsif(&get_srv_prot
($customservicegrp{$key}[2]) eq 'UDP'){
92 }elsif(&get_srv_prot
($customservicegrp{$key}[2]) eq 'ICMP'){
95 #Protocols used in servicegroups
96 push (@ips,$customservicegrp{$key}[2]);
100 if ($tcp eq '1'){push (@ips,'TCP');}
101 if ($udp eq '1'){push (@ips,'UDP');}
102 if ($icmp eq '1'){push (@ips,'ICMP');}
103 my $back=join(",",@ips);
112 foreach my $key (sort {$a <=> $b} keys %customservice){
113 if($customservice{$key}[0] eq $val && $customservice{$key}[2] eq $prot){
114 return $customservice{$key}[$field];
125 foreach my $key (sort {$a <=> $b} keys %customservicegrp){
126 if($customservicegrp{$key}[0] eq $val){
127 if ($prot ne 'ICMP'){
128 $value=&get_srv_port
($customservicegrp{$key}[2],1,$prot);
129 }elsif ($prot eq 'ICMP'){
130 $value=&get_srv_port
($customservicegrp{$key}[2],3,$prot);
132 push (@ips,$value) if ($value ne '') ;
136 if ($#ips gt 0){$back="-m multiport --dports ";}else{$back="--dport ";}
137 }elsif ($prot eq 'ICMP'){
138 $back="--icmp-type ";
141 $back.=join(",",@ips);
148 foreach my $key (sort {$a <=> $b} keys %ipsecconf){
149 if($ipsecconf{$key}[1] eq $val){
150 return $ipsecconf{$key}[$field];
154 sub get_ipsec_host_ip
158 foreach my $key (sort {$a <=> $b} keys %ipsecconf){
159 if($ipsecconf{$key}[1] eq $val){
160 return $ipsecconf{$key}[$field];
168 foreach my $key (sort {$a <=> $b} keys %ccdhost){
169 if($ccdhost{$key}[1] eq $val){
170 return $ccdhost{$key}[$field];
178 foreach my $key (sort {$a <=> $b} keys %ccdhost){
179 if($ccdhost{$key}[1] eq $val){
180 return $ccdhost{$key}[$field];
189 foreach my $key (sort {$a <=> $b} keys %ccdnet){
190 if($ccdnet{$key}[0] eq $val){
191 return $ccdnet{$key}[$field];
199 foreach my $key (sort {$a <=> $b} keys %customgrp){
200 if ($customgrp{$key}[0] eq $val){
201 &get_address
($customgrp{$key}[3],$src);
211 return "0.0.0.0/0.0.0.0";
212 }elsif($val eq 'GREEN'){
213 return "$netsettings{'GREEN_NETADDRESS'}/$netsettings{'GREEN_NETMASK'}";
214 }elsif($val eq 'ORANGE'){
215 return "$netsettings{'ORANGE_NETADDRESS'}/$netsettings{'ORANGE_NETMASK'}";
216 }elsif($val eq 'BLUE'){
217 return "$netsettings{'BLUE_NETADDRESS'}/$netsettings{'BLUE_NETMASK'}";
218 }elsif($val eq 'RED'){
219 return "0.0.0.0/0 -o $con";
220 }elsif($val =~ /OpenVPN/i){
221 return "$ovpnsettings{'DOVPN_SUBNET'}";
222 }elsif($val =~ /IPsec/i){
223 return "$ipsecsettings{'RW_NET'}";
224 }elsif($val eq 'IPFire'){
231 foreach my $key (sort {$a <=> $b} keys %customnetwork){
232 if($customnetwork{$key}[0] eq $val){
233 return "$customnetwork{$key}[1]/$customnetwork{$key}[2]";
241 foreach my $key (sort {$a <=> $b} keys %customhost){
242 if($customhost{$key}[0] eq $val){
243 if ($customhost{$key}[1] eq 'mac' && $src eq 'src'){
244 return "-m mac --mac-source $customhost{$key}[2]";
245 }elsif($customhost{$key}[1] eq 'ip' && $src eq 'src'){
246 return "$customhost{$key}[2]";
247 }elsif($customhost{$key}[1] eq 'ip' && $src eq 'tgt'){
248 return "$customhost{$key}[2]";
249 }elsif($customhost{$key}[1] eq 'mac' && $src eq 'tgt'){
266 if ($type eq "src") {
267 $addr_type = $$hash{$key}[3];
268 $value = $$hash{$key}[4];
270 } elsif ($type eq "tgt") {
271 $addr_type = $$hash{$key}[5];
272 $value = $$hash{$key}[6];
275 if ($addr_type ~~ ["cust_grp_src", "cust_grp_tgt"]) {
276 foreach my $grp (sort {$a <=> $b} keys %customgrp) {
277 if ($customgrp{$grp}[0] eq $value) {
278 my @address = &get_address
($customgrp{$grp}[3], $customgrp{$grp}[2], $type);
281 push(@addresses, @address);
286 my @address = &get_address
($addr_type, $value, $type);
289 push(@addresses, @address);
303 # If the user manually typed an address, we just check if it is a MAC
304 # address. Otherwise, we assume that it is an IP address.
305 if ($key ~~ ["src_addr", "tgt_addr"]) {
306 if (&General
::validmac
($value)) {
307 push(@ret, "-m mac --mac-source $value");
312 # If a default network interface (GREEN, BLUE, etc.) is selected, we
313 # try to get the corresponding address of the network.
314 } elsif ($key ~~ ["std_net_src", "std_net_tgt", "Standard Network"]) {
315 my $external_interface = &get_external_interface
();
317 my $network_address = &get_std_net_ip
($value, $external_interface);
318 if ($network_address) {
319 push(@ret, $network_address);
323 } elsif ($key ~~ ["cust_net_src", "cust_net_tgt", "Custom Network"]) {
324 my $network_address = &get_net_ip
($value);
325 if ($network_address) {
326 push(@ret, $network_address);
330 } elsif ($key ~~ ["cust_host_src", "cust_host_tgt", "Custom Host"]) {
331 my $host_address = &get_host_ip
($value, $type);
333 push(@ret, $host_address);
337 } elsif ($key ~~ ["ovpn_net_src", "ovpn_net_tgt", "OpenVPN static network"]) {
338 my $network_address = &get_ovpn_net_ip
($value, 1);
339 if ($network_address) {
340 push(@ret, $network_address);
344 } elsif ($key ~~ ["ovpn_host_src", "ovpn_host_tgt", "OpenVPN static host"]) {
345 my $host_address = &get_ovpn_host_ip
($value, 33);
347 push(@ret, $host_address);
351 } elsif ($key ~~ ["ovpn_n2n_src", "ovpn_n2n_tgt", "OpenVPN N-2-N"]) {
352 my $network_address = &get_ovpn_n2n_ip
($value, 11);
353 if ($network_address) {
354 push(@ret, $network_address);
358 } elsif ($key ~~ ["ipsec_net_src", "ipsec_net_tgt", "IpSec Network"]) {
359 my $network_address = &get_ipsec_net_ip
($value, 11);
360 if ($network_address) {
361 push(@ret, $network_address);
364 # The firewall's own IP addresses.
365 } elsif ($key ~~ ["ipfire", "ipfire_src"]) {
367 if ($value eq "ALL") {
371 } elsif ($value eq "GREEN") {
372 push(@ret, $netsettings{"GREEN_ADDRESS"});
375 } elsif ($value eq "BLUE") {
376 push(@ret, $netsettings{"BLUE_ADDRESS"});
379 } elsif ($value eq "ORANGE") {
380 push(@ret, $netsettings{"ORANGE_ADDRESS"});
383 } elsif ($value ~~ ["RED", "RED1"]) {
384 my $address = &get_external_address
();
386 push(@ret, $address);
391 my %alias = &get_alias
($value);
393 push(@ret, $alias{"IPT"});
397 # If nothing was selected, we assume "any".
404 sub get_external_interface
()
406 open(IFACE
, "/var/ipfire/red/iface") or return "";
412 sub get_external_address
()
414 open(ADDR
, "/var/ipfire/red/local-ipaddress") or return "";
415 my $address = <ADDR
>;
424 foreach my $alias (sort keys %aliases) {
426 return $aliases{$alias};
435 # Any static address of any zone.
436 if ($zone eq "AUTO") {
437 if ($source && ($source !~ m/mac/i )) {
438 my $firewall_ip = &get_internal_firewall_ip_address
($source, 1);
443 $firewall_ip = &get_matching_firewall_address
($source, 1);
449 return &get_external_address
();
451 } elsif ($zone eq "RED" || $zone eq "GREEN" || $zone eq "ORANGE" || $zone eq "BLUE") {
452 return $netsettings{$zone . "_ADDRESS"};
454 } elsif ($zone eq "Default IP") {
455 return &get_external_address
();
458 return &get_alias
($zone);
461 print_error
("Could not find NAT address");
463 sub get_internal_firewall_ip_addresses
465 my $use_orange = shift;
467 my @zones = ("GREEN", "BLUE");
469 push(@zones, "ORANGE");
473 for my $zone (@zones) {
474 next unless (exists $netsettings{$zone . "_ADDRESS"});
476 my $zone_address = $netsettings{$zone . "_ADDRESS"};
477 push(@addresses, $zone_address);
482 sub get_matching_firewall_address
485 my $use_orange = shift;
487 my ($address, $netmask) = split("/", $addr);
489 my @zones = ("GREEN", "BLUE");
491 push(@zones, "ORANGE");
494 foreach my $zone (@zones) {
495 next unless (exists $netsettings{$zone . "_ADDRESS"});
497 my $zone_subnet = $netsettings{$zone . "_NETADDRESS"};
498 my $zone_mask = $netsettings{$zone . "_NETMASK"};
500 if (&General
::IpInSubnet
($address, $zone_subnet, $zone_mask)) {
501 return $netsettings{$zone . "_ADDRESS"};
507 sub get_internal_firewall_ip_address
510 my $use_orange = shift;
512 my ($net_address, $net_mask) = split("/", $subnet);
513 if ((!$net_mask) || ($net_mask ~~ ["32", "255.255.255.255"])) {
517 my @addresses = &get_internal_firewall_ip_addresses
($use_orange);
518 foreach my $zone_address (@addresses) {
519 if (&General
::IpInSubnet
($zone_address, $net_address, $net_mask)) {
520 return $zone_address;