firewall: Fix off-by-one error in configuration parser

[ipfire-2.x.git] / config / firewall / rules.pl

diff --git a/config/firewall/rules.pl b/config/firewall/rules.pl
index e0f69554e847d7949fc28b50e657d1cf6101ed9e..a475e2d60ea7cb880746471ea8623e10cb64ffbd 100755 (executable)
--- a/config/firewall/rules.pl
+++ b/config/firewall/rules.pl
@@ -131,6 +131,12 @@ sub print_rule {
        print "\n";
 }
 
+sub count_elements {
+       my $hash = shift;
+
+       return scalar @$hash;
+}
+
 sub flush {
        run("$IPTABLES -F $CHAIN_INPUT");
        run("$IPTABLES -F $CHAIN_FORWARD");
@@ -186,6 +192,9 @@ sub buildrules {
                # Skip disabled rules.
                next unless ($$hash{$key}[2] eq 'ON');
 
+               # Count number of elements in this line
+               my $elements = &count_elements($$hash{$key});
+
                if ($DEBUG) {
                        print_rule($$hash{$key});
                }
@@ -268,6 +277,34 @@ sub buildrules {
                        }
                }
 
+               # Concurrent connection limit
+               my @ratelimit_options = ();
+
+               if (($elements ge 34) && ($$hash{$key}[32] eq 'ON')) {
+                       my $conn_limit = $$hash{$key}[33];
+
+                       if ($conn_limit ge 1) {
+                               push(@ratelimit_options, ("-m", "connlimit"));
+
+                               # Use the the entire source IP address
+                               push(@ratelimit_options, "--connlimit-saddr");
+                               push(@ratelimit_options, ("--connlimit-mask", "32"));
+
+                               # Apply the limit
+                               push(@ratelimit_options, ("--connlimit-upto", $conn_limit));
+                       }
+               }
+
+               # Ratelimit
+               if (($elements ge 37) && ($$hash{$key}[34] eq 'ON')) {
+                       my $rate_limit = "$$hash{$key}[35]/$$hash{$key}[36]";
+
+                       if ($rate_limit) {
+                               push(@ratelimit_options, ("-m", "limit"));
+                               push(@ratelimit_options, ("--limit", $rate_limit));
+                       }
+               }
+
                # Check which protocols are used in this rule and so that we can
                # later group rules by protocols.
                my @protocols = &get_protocols($hash, $key);
@@ -348,6 +385,9 @@ sub buildrules {
                                        # Add time constraint options.
                                        push(@options, @time_options);
 
+                                       # Add ratelimiting option
+                                       push(@options, @ratelimit_options);
+
                                        my $firewall_is_in_source_subnet = 1;
                                        if ($source) {
                                                $firewall_is_in_source_subnet = &firewall_is_in_subnet($source);
@@ -469,6 +509,10 @@ sub buildrules {
                        }
                }
        }
+       #Reload firewall.local if present
+       if ( -f '/etc/sysconfig/firewall.local'){
+               run("/etc/sysconfig/firewall.local reload");
+       }
 }
 
 # Formats the given timestamp into the iptables format which is "hh:mm" UTC.
@@ -510,29 +554,19 @@ sub time_convert_to_minutes {
 }
 
 sub p2pblock {
-       my $search_action;
-       my $target;
-
-       if ($fwdfwsettings{"POLICY"} eq "MODE1") {
-               $search_action = "on";
-               $target = "ACCEPT";
-       } else {
-               $search_action = "off";
-               $target = "DROP";
-       }
-
        open(FILE, "<$p2pfile") or die "Unable to read $p2pfile";
        my @protocols = ();
        foreach my $p2pentry (<FILE>) {
                my @p2pline = split(/\;/, $p2pentry);
-               next unless ($p2pline[2] eq $search_action);
+               next unless ($p2pline[2] eq "off");
 
                push(@protocols, "--$p2pline[1]");
        }
        close(FILE);
 
+       run("$IPTABLES -F P2PBLOCK");
        if (@protocols) {
-               run("$IPTABLES -A FORWARDFW -m ipp2p @protocols -j $target");
+               run("$IPTABLES -A P2PBLOCK -m ipp2p @protocols -j DROP");
        }
 }