[ipfire-2.x.git] / config / firewall / firewall-lib.pl

#!/usr/bin/perl
###############################################################################
#                                                                             #
# IPFire.org - A linux based firewall                                         #
# Copyright (C) 2013 Alexander Marx <amarx@ipfire.org>                        #
#                                                                             #
# This program is free software: you can redistribute it and/or modify        #
# it under the terms of the GNU General Public License as published by        #
# the Free Software Foundation, either version 3 of the License, or           #
# (at your option) any later version.                                         #
#                                                                             #
# This program is distributed in the hope that it will be useful,             #
# but WITHOUT ANY WARRANTY; without even the implied warranty of              #
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
# GNU General Public License for more details.                                #
#                                                                             #
# You should have received a copy of the GNU General Public License           #
# along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
#                                                                             #
###############################################################################

use strict;
no warnings 'uninitialized';

package fwlib;

my %customnetwork=();
my %customhost=();
my %customgrp=();
my %customservice=();
my %customservicegrp=();
my %ccdnet=();
my %ccdhost=();
my %ipsecconf=();
my %ipsecsettings=();
my %netsettings=();
my %ovpnsettings=();

require '/var/ipfire/general-functions.pl';

my $confignet		= "${General::swroot}/fwhosts/customnetworks";
my $confighost		= "${General::swroot}/fwhosts/customhosts";
my $configgrp 		= "${General::swroot}/fwhosts/customgroups";
my $configsrv 		= "${General::swroot}/fwhosts/customservices";
my $configsrvgrp	= "${General::swroot}/fwhosts/customservicegrp";
my $configccdnet 	= "${General::swroot}/ovpn/ccd.conf";
my $configccdhost	= "${General::swroot}/ovpn/ovpnconfig";
my $configipsec		= "${General::swroot}/vpn/config";
my $configovpn		= "${General::swroot}/ovpn/settings";
my $val;
my $field;

&General::readhash("/var/ipfire/ethernet/settings", \%netsettings);
&General::readhash("${General::swroot}/ovpn/settings", \%ovpnsettings);
&General::readhash("${General::swroot}/vpn/settings", \%ipsecsettings);


&General::readhasharray("$confignet", \%customnetwork);
&General::readhasharray("$confighost", \%customhost);
&General::readhasharray("$configgrp", \%customgrp);
&General::readhasharray("$configccdnet", \%ccdnet);
&General::readhasharray("$configccdhost", \%ccdhost);
&General::readhasharray("$configipsec", \%ipsecconf);
&General::readhasharray("$configsrv", \%customservice);
&General::readhasharray("$configsrvgrp", \%customservicegrp);

sub get_srv_prot
{
	my $val=shift;
	foreach my $key (sort {$a <=> $b} keys %customservice){
		if($customservice{$key}[0] eq $val){
			if ($customservice{$key}[0] eq $val){
				return $customservice{$key}[2];
			}
		}
	}
}
sub get_srvgrp_prot
{
	my $val=shift;
	my @ips=();
	my $tcp;
	my $udp;
	my $icmp;
	foreach my $key (sort {$a <=> $b} keys %customservicegrp){
		if($customservicegrp{$key}[0] eq $val){
			if (&get_srv_prot($customservicegrp{$key}[2]) eq 'TCP'){ 
				$tcp=1;
			}elsif(&get_srv_prot($customservicegrp{$key}[2]) eq 'UDP'){ 
				$udp=1;
			}elsif(&get_srv_prot($customservicegrp{$key}[2]) eq 'ICMP'){
				$icmp=1;
			} 
		}
	}
	if ($tcp eq '1'){push (@ips,'TCP');}
	if ($udp eq '1'){push (@ips,'UDP');}
	if ($icmp eq '1'){push (@ips,'ICMP');}
	my $back=join(",",@ips);
	return $back;
	
}


sub get_srv_port
{
	my $val=shift;
	my $field=shift;
	my $prot=shift;
	foreach my $key (sort {$a <=> $b} keys %customservice){
		if($customservice{$key}[0] eq $val && $customservice{$key}[2] eq $prot){
			return $customservice{$key}[$field];
		}
	}
}
sub get_srvgrp_port
{
	my $val=shift;
	my $prot=shift;
	my $back;
	my $value;
	my @ips=();
	foreach my $key (sort {$a <=> $b} keys %customservicegrp){
		if($customservicegrp{$key}[0] eq $val){
			if ($prot ne 'ICMP'){
				$value=&get_srv_port($customservicegrp{$key}[2],1,$prot);
			}elsif ($prot eq 'ICMP'){
				$value=&get_srv_port($customservicegrp{$key}[2],3,$prot);
			}
			push (@ips,$value) if ($value ne '') ;
		}
	}
	if($prot ne 'ICMP'){
		if ($#ips gt 0){$back="-m multiport --dports ";}else{$back="--dport ";}
	}elsif ($prot eq 'ICMP'){
		$back="--icmp-type ";
	}
	
	$back.=join(",",@ips);
	return $back;
}
sub get_ipsec_net_ip
{
	my $val=shift;
	my $field=shift;
	foreach my $key (sort {$a <=> $b} keys %ipsecconf){
		if($ipsecconf{$key}[1] eq $val){
			return $ipsecconf{$key}[$field];
		}
	}
}
sub get_ipsec_host_ip
{
	my $val=shift;
	my $field=shift;
	foreach my $key (sort {$a <=> $b} keys %ipsecconf){
		if($ipsecconf{$key}[1] eq $val){
			return $ipsecconf{$key}[$field];
		}
	}
}
sub get_ovpn_n2n_ip
{
	my $val=shift;
	my $field=shift;
	foreach my $key (sort {$a <=> $b} keys %ccdhost){
		if($ccdhost{$key}[1] eq $val){
			return $ccdhost{$key}[$field];
		}
	}
}
sub get_ovpn_host_ip
{
	my $val=shift;
	my $field=shift;
	foreach my $key (sort {$a <=> $b} keys %ccdhost){
		if($ccdhost{$key}[1] eq $val){
			return $ccdhost{$key}[$field];
		}
	}
}
sub get_ovpn_net_ip
{
	
	my $val=shift;
	my $field=shift;
	foreach my $key (sort {$a <=> $b} keys %ccdnet){
		if($ccdnet{$key}[0] eq $val){
			return $ccdnet{$key}[$field];
		}
	}
}
sub get_grp_ip
{
	my $val=shift;
	my $src=shift;
	foreach my $key (sort {$a <=> $b} keys %customgrp){
		if ($customgrp{$key}[0] eq $val){
			&get_address($customgrp{$key}[3],$src);
		}
	}		
	
}
sub get_std_net_ip
{
	my $val=shift;
	my $con=shift;
	if ($val eq 'ALL'){
		return "0.0.0.0/0.0.0.0";
	}elsif($val eq 'GREEN'){
		return "$netsettings{'GREEN_NETADDRESS'}/$netsettings{'GREEN_NETMASK'}";
	}elsif($val eq 'ORANGE'){
		return "$netsettings{'ORANGE_NETADDRESS'}/$netsettings{'ORANGE_NETMASK'}";
	}elsif($val eq 'BLUE'){
		return "$netsettings{'BLUE_NETADDRESS'}/$netsettings{'BLUE_NETMASK'}";
	}elsif($val eq 'RED'){
		return "0.0.0.0/0 -o $con";
	}elsif($val =~ /OpenVPN/i){
		return "$ovpnsettings{'DOVPN_SUBNET'}";
	}elsif($val =~ /IPsec/i){
		return "$ipsecsettings{'RW_NET'}";
	}elsif($val eq 'IPFire'){
		return ;
	}
}
sub get_net_ip
{
	my $val=shift;
	foreach my $key (sort {$a <=> $b} keys %customnetwork){
		if($customnetwork{$key}[0] eq $val){
			return "$customnetwork{$key}[1]/$customnetwork{$key}[2]";
		}  
	}
}
sub get_host_ip
{
	my $val=shift;
	my $src=shift;
	foreach my $key (sort {$a <=> $b} keys %customhost){
		if($customhost{$key}[0] eq $val){
			if ($customhost{$key}[1] eq 'mac' && $src eq 'src'){
			return "-m mac --mac-source $customhost{$key}[2]";
			}elsif($customhost{$key}[1] eq 'ip' && $src eq 'src'){
				return "$customhost{$key}[2]";
			}elsif($customhost{$key}[1] eq 'ip' && $src eq 'tgt'){
				return "$customhost{$key}[2]";
			}elsif($customhost{$key}[1] eq 'mac' && $src eq 'tgt'){
				return "none";
			}
		}  
	}
}

return 1;
Commit	Line	Data
2a81ab0d AM	1	#!/usr/bin/perl
	2	###############################################################################
	3	# #
	4	# IPFire.org - A linux based firewall #
5bee9a9d	5	# Copyright (C) 2013 Alexander Marx <amarx@ipfire.org> #
2a81ab0d AM	6	# #
	7	# This program is free software: you can redistribute it and/or modify #
	8	# it under the terms of the GNU General Public License as published by #
	9	# the Free Software Foundation, either version 3 of the License, or #
	10	# (at your option) any later version. #
	11	# #
	12	# This program is distributed in the hope that it will be useful, #
	13	# but WITHOUT ANY WARRANTY; without even the implied warranty of #
	14	# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
	15	# GNU General Public License for more details. #
	16	# #
	17	# You should have received a copy of the GNU General Public License #
	18	# along with this program. If not, see <http://www.gnu.org/licenses/>. #
	19	# #
	20	###############################################################################
2a81ab0d AM	21
	22	use strict;
	23	no warnings 'uninitialized';
	24
	25	package fwlib;
	26
	27	my %customnetwork=();
	28	my %customhost=();
	29	my %customgrp=();
	30	my %customservice=();
	31	my %customservicegrp=();
	32	my %ccdnet=();
	33	my %ccdhost=();
	34	my %ipsecconf=();
	35	my %ipsecsettings=();
	36	my %netsettings=();
	37	my %ovpnsettings=();
	38
	39	require '/var/ipfire/general-functions.pl';
	40
	41	my $confignet = "${General::swroot}/fwhosts/customnetworks";
	42	my $confighost = "${General::swroot}/fwhosts/customhosts";
	43	my $configgrp = "${General::swroot}/fwhosts/customgroups";
	44	my $configsrv = "${General::swroot}/fwhosts/customservices";
	45	my $configsrvgrp = "${General::swroot}/fwhosts/customservicegrp";
	46	my $configccdnet = "${General::swroot}/ovpn/ccd.conf";
	47	my $configccdhost = "${General::swroot}/ovpn/ovpnconfig";
	48	my $configipsec = "${General::swroot}/vpn/config";
	49	my $configovpn = "${General::swroot}/ovpn/settings";
	50	my $val;
	51	my $field;
	52
	53	&General::readhash("/var/ipfire/ethernet/settings", \%netsettings);
	54	&General::readhash("${General::swroot}/ovpn/settings", \%ovpnsettings);
	55	&General::readhash("${General::swroot}/vpn/settings", \%ipsecsettings);
	56
	57
	58	&General::readhasharray("$confignet", \%customnetwork);
	59	&General::readhasharray("$confighost", \%customhost);
	60	&General::readhasharray("$configgrp", \%customgrp);
	61	&General::readhasharray("$configccdnet", \%ccdnet);
	62	&General::readhasharray("$configccdhost", \%ccdhost);
	63	&General::readhasharray("$configipsec", \%ipsecconf);
	64	&General::readhasharray("$configsrv", \%customservice);
	65	&General::readhasharray("$configsrvgrp", \%customservicegrp);
	66
	67	sub get_srv_prot
	68	{
	69	my $val=shift;
992394d5	70	foreach my $key (sort {$a <=> $b} keys %customservice){
2a81ab0d AM	71	if($customservice{$key}[0] eq $val){
	72	if ($customservice{$key}[0] eq $val){
	73	return $customservice{$key}[2];
	74	}
	75	}
	76	}
	77	}
	78	sub get_srvgrp_prot
	79	{
	80	my $val=shift;
	81	my @ips=();
	82	my $tcp;
	83	my $udp;
	84	my $icmp;
992394d5	85	foreach my $key (sort {$a <=> $b} keys %customservicegrp){
2a81ab0d AM	86	if($customservicegrp{$key}[0] eq $val){
	87	if (&get_srv_prot($customservicegrp{$key}[2]) eq 'TCP'){
	88	$tcp=1;
	89	}elsif(&get_srv_prot($customservicegrp{$key}[2]) eq 'UDP'){
	90	$udp=1;
	91	}elsif(&get_srv_prot($customservicegrp{$key}[2]) eq 'ICMP'){
	92	$icmp=1;
	93	}
	94	}
	95	}
	96	if ($tcp eq '1'){push (@ips,'TCP');}
	97	if ($udp eq '1'){push (@ips,'UDP');}
	98	if ($icmp eq '1'){push (@ips,'ICMP');}
	99	my $back=join(",",@ips);
	100	return $back;
	101
	102	}
	103
	104
	105	sub get_srv_port
	106	{
	107	my $val=shift;
	108	my $field=shift;
	109	my $prot=shift;
992394d5	110	foreach my $key (sort {$a <=> $b} keys %customservice){
14bcb9a2 AM	111	if($customservice{$key}[0] eq $val && $customservice{$key}[2] eq $prot){
14bcb9a2 AM	112	return $customservice{$key}[$field];
2a81ab0d AM	113	}
	114	}
	115	}
	116	sub get_srvgrp_port
	117	{
	118	my $val=shift;
	119	my $prot=shift;
	120	my $back;
	121	my $value;
	122	my @ips=();
992394d5	123	foreach my $key (sort {$a <=> $b} keys %customservicegrp){
2a81ab0d AM	124	if($customservicegrp{$key}[0] eq $val){
	125	if ($prot ne 'ICMP'){
	126	$value=&get_srv_port($customservicegrp{$key}[2],1,$prot);
	127	}elsif ($prot eq 'ICMP'){
	128	$value=&get_srv_port($customservicegrp{$key}[2],3,$prot);
	129	}
	130	push (@ips,$value) if ($value ne '') ;
	131	}
	132	}
	133	if($prot ne 'ICMP'){
	134	if ($#ips gt 0){$back="-m multiport --dports ";}else{$back="--dport ";}
	135	}elsif ($prot eq 'ICMP'){
	136	$back="--icmp-type ";
	137	}
	138
	139	$back.=join(",",@ips);
	140	return $back;
	141	}
	142	sub get_ipsec_net_ip
	143	{
	144	my $val=shift;
	145	my $field=shift;
992394d5	146	foreach my $key (sort {$a <=> $b} keys %ipsecconf){
2a81ab0d AM	147	if($ipsecconf{$key}[1] eq $val){
	148	return $ipsecconf{$key}[$field];
	149	}
	150	}
	151	}
	152	sub get_ipsec_host_ip
	153	{
	154	my $val=shift;
	155	my $field=shift;
992394d5	156	foreach my $key (sort {$a <=> $b} keys %ipsecconf){
2a81ab0d AM	157	if($ipsecconf{$key}[1] eq $val){
	158	return $ipsecconf{$key}[$field];
	159	}
	160	}
	161	}
	162	sub get_ovpn_n2n_ip
	163	{
	164	my $val=shift;
	165	my $field=shift;
992394d5	166	foreach my $key (sort {$a <=> $b} keys %ccdhost){
2a81ab0d AM	167	if($ccdhost{$key}[1] eq $val){
	168	return $ccdhost{$key}[$field];
	169	}
	170	}
	171	}
	172	sub get_ovpn_host_ip
	173	{
	174	my $val=shift;
	175	my $field=shift;
992394d5	176	foreach my $key (sort {$a <=> $b} keys %ccdhost){
2a81ab0d AM	177	if($ccdhost{$key}[1] eq $val){
	178	return $ccdhost{$key}[$field];
	179	}
	180	}
	181	}
	182	sub get_ovpn_net_ip
	183	{
	184
	185	my $val=shift;
	186	my $field=shift;
992394d5	187	foreach my $key (sort {$a <=> $b} keys %ccdnet){
2a81ab0d AM	188	if($ccdnet{$key}[0] eq $val){
	189	return $ccdnet{$key}[$field];
	190	}
	191	}
	192	}
	193	sub get_grp_ip
	194	{
	195	my $val=shift;
	196	my $src=shift;
992394d5	197	foreach my $key (sort {$a <=> $b} keys %customgrp){
2a81ab0d AM	198	if ($customgrp{$key}[0] eq $val){
	199	&get_address($customgrp{$key}[3],$src);
	200	}
	201	}
	202
	203	}
	204	sub get_std_net_ip
	205	{
	206	my $val=shift;
ddcec9d3	207	my $con=shift;
2a81ab0d AM	208	if ($val eq 'ALL'){
	209	return "0.0.0.0/0.0.0.0";
	210	}elsif($val eq 'GREEN'){
	211	return "$netsettings{'GREEN_NETADDRESS'}/$netsettings{'GREEN_NETMASK'}";
	212	}elsif($val eq 'ORANGE'){
	213	return "$netsettings{'ORANGE_NETADDRESS'}/$netsettings{'ORANGE_NETMASK'}";
	214	}elsif($val eq 'BLUE'){
	215	return "$netsettings{'BLUE_NETADDRESS'}/$netsettings{'BLUE_NETMASK'}";
62fc8511	216	}elsif($val eq 'RED'){
ddcec9d3	217	return "0.0.0.0/0 -o $con";
2a81ab0d AM	218	}elsif($val =~ /OpenVPN/i){
	219	return "$ovpnsettings{'DOVPN_SUBNET'}";
	220	}elsif($val =~ /IPsec/i){
	221	return "$ipsecsettings{'RW_NET'}";
5d7faa45 AM	222	}elsif($val eq 'IPFire'){
5d7faa45 AM	223	return ;
2a81ab0d AM	224	}
	225	}
	226	sub get_net_ip
	227	{
	228	my $val=shift;
992394d5	229	foreach my $key (sort {$a <=> $b} keys %customnetwork){
2a81ab0d AM	230	if($customnetwork{$key}[0] eq $val){
	231	return "$customnetwork{$key}[1]/$customnetwork{$key}[2]";
	232	}
	233	}
	234	}
	235	sub get_host_ip
	236	{
	237	my $val=shift;
	238	my $src=shift;
992394d5	239	foreach my $key (sort {$a <=> $b} keys %customhost){
2a81ab0d AM	240	if($customhost{$key}[0] eq $val){
	241	if ($customhost{$key}[1] eq 'mac' && $src eq 'src'){
	242	return "-m mac --mac-source $customhost{$key}[2]";
	243	}elsif($customhost{$key}[1] eq 'ip' && $src eq 'src'){
	244	return "$customhost{$key}[2]";
	245	}elsif($customhost{$key}[1] eq 'ip' && $src eq 'tgt'){
	246	return "$customhost{$key}[2]";
	247	}elsif($customhost{$key}[1] eq 'mac' && $src eq 'tgt'){
	248	return "none";
	249	}
	250	}
	251	}
	252	}
	253
	254	return 1;