]>
git.ipfire.org Git - ipfire-2.x.git/blob - config/forwardfw/convert-outgoingfw
4 require '/var/ipfire/general-functions.pl';
7 my $ipgrouppath = "${General::swroot}/outgoing/groups/ipgroups/";
8 my $macgrouppath = "${General::swroot}/outgoing/groups/macgroups/";
9 my $outgoingrules = "${General::swroot}/outgoing/rules";
10 my $outfwsettings = "${General::swroot}/outgoing/settings";
11 my $host = "Converted ";
12 my $confighosts = "${General::swroot}/fwhosts/customhosts";
13 my $confignets = "${General::swroot}/fwhosts/customnetworks";
14 my $configgroups = "${General::swroot}/fwhosts/customgroups";
15 my $ovpnsettings = "${General::swroot}/ovpn/settings";
16 my $ovpnconfig = "${General::swroot}/ovpn/ovpnconfig";
17 my $ccdconfig = "${General::swroot}/ovpn/ccd.conf";
18 my $fwdfwconfig = "${General::swroot}/forward/config";
19 my $fwdfwsettings = "${General::swroot}/forward/settings";
20 my @ipgroups = qx(ls
$ipgrouppath);
21 my @macgroups = qx(ls
$macgrouppath);
32 &General
::readhash
($outfwsettings,\
%outsettings);
42 if(! -d
"/var/log/firewall"){ mkdir("/var/log/firewall");}
43 if( -f
"/var/log/firewall/ip-convert.log"){unlink ("/var/log/firewall/ip-convert.log");}
44 open (LOG
, ">/var/log/firewall/ip-convert.log") or die $!;
46 foreach my $group (@ipgroups){
48 open (DATEI
, "<$ipgrouppath/$group");
50 foreach my $ip (@zeilen){
53 my $val=&check_ip
($ip);
55 push(@hostarray,$val.",ip");
58 print LOG
"-> IP \"$ip\" from group $group not converted (invalid IP) \n";
62 &new_hostgrp
($group,'ip');
69 foreach my $group (@macgroups){
71 open (DATEI
, "<$macgrouppath/$group");
73 foreach my $mac (@zeilen){
77 if(&General
::validmac
($mac)){
81 push(@hostarray,$val.",mac");
84 print LOG
"-> Mac $mac from group $group not converted (invalid MAC)\n";
88 &new_hostgrp
($group,'mac');
97 #ip with subnet in decimal
98 if($adr =~ m/^(\d\d?\d?).(\d\d?\d?).(\d\d?\d?).(\d\d?\d?)\/(\d
{1,2})$/){
99 $adr=int($1).".".int($2).".".int($3).".".int($4);
100 my $b = &General
::iporsubtodec
($5);
103 if($adr =~ /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/){
104 $adr=int($1).".".int($2).".".int($3).".".int($4);
105 if(&General
::validip
($adr)){
106 $a=$adr."/255.255.255.255";
109 if(&General
::validipandmask
($adr)){
110 $a=&General
::iporsubtodec
($adr);
116 &General
::readhasharray
($confighosts,\
%hosts);
117 &General
::readhasharray
($confignets,\
%nets);
118 &General
::readhasharray
($configgroups,\
%groups);
121 my $name; #"converted"
123 my $name3; #custom host/custom net
124 foreach my $adr (@hostarray){
126 my ($ip,$type) = split(",",$adr);
127 my ($ippart,$subnet) = split("/",$ip);
128 my ($byte1,$byte2,$byte3,$byte4) = split(/\./,$subnet);
130 if(!&check_host
($ip)){
131 my $key = &General
::findhasharraykey
(\
%hosts);
133 $name2=$name.$ippart;
134 $name3="Custom Host";
135 $hosts{$key}[0] = $name2;
136 $hosts{$key}[1] = $type;
137 $hosts{$key}[2] = $ip;
140 print LOG
"Host (IP) $ip already exists\n";
142 }elsif($byte4 < '255'){
143 if(!&check_net
($ippart,$subnet)){
144 my $netkey = &General
::findhasharraykey
(\
%nets);
146 $name2=$name.$ippart;
147 $name3="Custom Network";
148 $nets{$netkey}[0] = $name2;
149 $nets{$netkey}[1] = $ippart;
150 $nets{$netkey}[2] = $subnet;
151 $nets{$netkey}[3] = 1;
153 print LOG
"Network $ippart already exists\n";
157 my $grpkey = &General
::findhasharraykey
(\
%groups);
158 $groups{$grpkey}[0] = $grp;
159 $groups{$grpkey}[1] = '';
160 $groups{$grpkey}[2] = $name2;
161 $groups{$grpkey}[3] = $name3;
162 $groups{$grpkey}[4] = 0;
164 }elsif($run eq 'mac'){
166 my ($mac,$type) = split(",",$adr);
167 if(!&check_host
($mac)){
168 my $key = &General
::findhasharraykey
(\
%hosts);
171 $name3="Custom Host";
172 $hosts{$key}[0] = $name2;
173 $hosts{$key}[1] = $type;
174 $hosts{$key}[2] = $mac;
177 print LOG
"Host (MAC) $mac already exists\n";
180 my $grpkey = &General
::findhasharraykey
(\
%groups);
181 $groups{$grpkey}[0] = $grp;
182 $groups{$grpkey}[1] = '';
183 $groups{$grpkey}[2] = $name2;
184 $groups{$grpkey}[3] = $name3;
185 $groups{$grpkey}[4] = 0;
189 &General
::writehasharray
($confighosts,\
%hosts);
190 &General
::writehasharray
($configgroups,\
%groups);
191 &General
::writehasharray
($confignets,\
%nets);
196 foreach my $key (sort keys %hosts)
198 if($hosts{$key}[2] eq $ip)
209 foreach my $key (sort keys %nets)
211 if($nets{$key}[1] eq $ip && $nets{$key}[2] eq $sub)
222 foreach my $key (sort keys %groups)
224 if($groups{$key}[0] eq $grp && $groups{$key}[2] eq $value)
233 print "Outgoing ist im Mode $outsettings{'POLICY'}\n";
234 &General
::readhash
($fwdfwsettings,\
%fwdsettings);
235 if($fwdsettings{'POLICY'} ne $outsettings{'POLICY'}){
236 $fwdsettings{'POLICY'}=$outsettings{'POLICY'};
237 &General
::writehash
($fwdfwsettings,\
%fwdsettings);
240 if( -f
"/var/log/firewall/rule-convert.log"){unlink ("/var/log/firewall/rule-convert.log");}
241 open (LOG
, ">/var/log/firewall/rule-convert.log") or die $!;
243 my ($type,$action,$active,$grp1,$source,$grp2,$useport,$port,$prot,$grp3,$target,$remark,$log,$time,$time_mon,$time_tue,$time_wed,$time_thu,$time_fri,$time_sat,$time_sun,$time_from,$time_to);
244 if ($outsettings{'POLICY'} eq 'MODE1'){
247 }elsif($outsettings{'POLICY'} eq 'MODE2'){
253 open (DATEI
, "<$outgoingrules");
255 foreach my $rule (@lines)
258 print LOG
"processing: $rule\n";
260 my @configline = split( /\;/, $rule );
262 if($configline[0] eq $type){
263 #some variables we can use from old config
264 if($configline[1] eq 'on'){ $active='ON';}else{$active='';}
265 if($configline[3] eq 'all'){
272 push(@prot,$configline[3]);
276 if($configline[4] ne ''){ $remark=$configline[4];}else{$remark='';}
277 if($configline[9] eq 'aktiv'){ $log='ON';}else{$log='';}
279 if($configline[10] eq 'on' && $configline[11] eq 'on' && $configline[12] eq 'on' && $configline[13] eq 'on' && $configline[14] eq 'on' && $configline[15] eq 'on' && $configline[16] eq 'on'){
280 if($configline[17] eq '00:00' && $configline[18] eq '00:00'){
288 $time_mon=$configline[10];
289 $time_tue=$configline[11];
290 $time_wed=$configline[12];
291 $time_thu=$configline[13];
292 $time_fri=$configline[14];
293 $time_sat=$configline[15];
294 $time_sun=$configline[16];
295 $time_from=$configline[17];
296 $time_to=$configline[18];
297 ############################################################
299 if ($configline[2] eq 'green') {
302 }elsif ($configline[2] eq 'orange') {
305 }elsif ($configline[2] eq 'red') {
306 print LOG
"-> Rule not converted, is an outgoing rule.Please put it manually in /etc/sysconfig/firewall.local \n";
308 }elsif ($configline[2] eq 'blue') {
311 }elsif ($configline[2] eq 'ipsec') {
312 print LOG
"-> Rule not converted, ipsec+ interface is obsolet since IPFire 2.7 \n";
314 }elsif ($configline[2] eq 'ovpn') {
316 }elsif ($configline[2] eq 'ip') {
317 my $z=&check_ip
($configline[5]);
322 print LOG
"-> Rule not converted, missing/invalid source ip \"$configline[5]\"\n";
325 }elsif ($configline[2] eq 'mac') {
326 if(&General
::validmac
($configline[6])){
328 $source=$configline[6];
330 print LOG
"-> Rule not converted, invalid MAC \"$configline[6]\" \n";
333 }elsif ($configline[2] eq 'all') {
337 #&General::readhasharray($configgroups,\%groups);
338 foreach my $key (sort keys %groups){
339 if($groups{$key}[0] eq $configline[2]){
340 $grp1='cust_grp_src';
341 $source=$configline[2];
344 if ($grp1 eq '' || $source eq ''){
345 print LOG
"-> Rule not converted, no valid source recognised\n";
348 ############################################################
350 if($configline[7] ne ''){
351 my $address=&check_ip
($configline[7]);
356 my $getwebsiteip=&get_ip_from_domain
($configline[7]);
359 $target=$getwebsiteip;
361 print LOG
"-> Rule not converted, invalid domain \"$configline[7]\"\n";
369 if($configline[8] ne ''){
370 if (!($configline[8] =~ /^(\d+)\:(\d+)$/)) {
371 if(&General
::validport
($configline[8])){
373 $port=$configline[8];
376 print LOG
"-> Rule not converted, invalid destination Port \"$configline[8]\"\n";
380 my ($a1,$a2) = split(/\:/,$configline[8]);
381 if (&General
::validport
($a1) && &General
::validport
($a2) && $a1 < $a2){
383 $port=$configline[8];
386 print LOG
"-> Rule not converted, invalid destination Port \"$configline[8]\"\n";
392 print LOG
"-> Rule not converted because not for Firewall mode $outsettings{'POLICY'} (we are only converting for actual mode)\n";
394 &General
::readhasharray
($fwdfwconfig,\
%fwconfig);
396 foreach my $protocol (@prot){
397 $protocol=uc($protocol);
398 print"0:$action 1:FORWARDFW 2:$active 3:$grp1 4:$source 5:$grp2 6:$target 7:src_srv(leer) 8:srcprot(leer) 9:icmp(leer) 10:srcport(leer) 11:$useport 12:$protocol 13:icmp(leer) 14:$grp3 15:$port 16:$remark 17:$log 18:$time 19:$time_mon 20:$time_tue 21:$time_wed 22:$time_thu 23:$time_fri 24:$time_sat 25:$time_sun 26:$time_from 27:$time_to\n\n";
399 print LOG
"-> Converted: $action,FORWARDFW,$active,$grp1,$source,$grp2,$target,,,,,$useport,$protocol,,$grp3,$port,$remark,$log,$time,$time_mon,$time_tue,$time_wed,$time_thu,$time_fri,$time_sat,$time_sun,$time_from,$time_to\n";
400 #Put rules into system....
401 ###########################
403 #check for double rules
404 foreach my $key (sort keys %fwconfig){
405 if("$action,FORWARDFW,$active,$grp1,$source,$grp2,$target,,,,,$useport,$protocol,,$grp3,$port,$remark,$log,$time,$time_mon,$time_tue,$time_wed,$time_thu,$time_fri,$time_sat,$time_sun,$time_from,$time_to"
406 eq "$fwconfig{$key}[0],$fwconfig{$key}[1],$fwconfig{$key}[2],$fwconfig{$key}[3],$fwconfig{$key}[4],$fwconfig{$key}[5],$fwconfig{$key}[6],,,,,$fwconfig{$key}[11],$fwconfig{$key}[12],,$fwconfig{$key}[14],$fwconfig{$key}[15],$fwconfig{$key}[16],$fwconfig{$key}[17],$fwconfig{$key}[18],$fwconfig{$key}[19],$fwconfig{$key}[20],$fwconfig{$key}[21],$fwconfig{$key}[22],$fwconfig{$key}[23],$fwconfig{$key}[24],$fwconfig{$key}[25],$fwconfig{$key}[26],$fwconfig{$key}[27]"){
412 #increase groupcounter
414 if($grp1 eq 'cust_grp_src'){
415 foreach my $key (sort keys %groups){
416 if($groups{$key}[0] eq $source){
422 print" schreibe in gruppe\n";
423 &General
::writehasharray
($configgroups,\
%groups);
426 print"SCHREIBE REGEL!\n";
427 my $key = &General
::findhasharraykey
(\
%fwconfig);
428 $fwconfig{$key}[0] = $action;
429 $fwconfig{$key}[1] = "FORWARDFW";
430 $fwconfig{$key}[2] = $active;
431 $fwconfig{$key}[3] = $grp1;
432 $fwconfig{$key}[4] = $source;
433 $fwconfig{$key}[5] = $grp2;
434 $fwconfig{$key}[6] = $target;
435 $fwconfig{$key}[11] = $useport;
436 $fwconfig{$key}[12] = $protocol;
437 $fwconfig{$key}[14] = $grp3;
438 $fwconfig{$key}[15] = $port;
439 $fwconfig{$key}[16] = $remark;
440 $fwconfig{$key}[17] = $log;
441 $fwconfig{$key}[18] = $time;
442 $fwconfig{$key}[19] = $time_mon;
443 $fwconfig{$key}[20] = $time_tue;
444 $fwconfig{$key}[21] = $time_wed;
445 $fwconfig{$key}[22] = $time_thu;
446 $fwconfig{$key}[23] = $time_fri;
447 $fwconfig{$key}[24] = $time_sat;
448 $fwconfig{$key}[25] = $time_sun;
449 $fwconfig{$key}[26] = $time_from;
450 $fwconfig{$key}[27] = $time_to;
453 &General
::writehasharray
($fwdfwconfig,\
%fwconfig);
454 system("/usr/local/bin/forwardfwctrl");
460 sub get_ip_from_domain
465 my ($name,$aliases,$addrtype,$length,@addrs) = gethostbyname($web);
467 $resolvedip=inet_ntoa
($addrs[0]);
474 &General
::readhasharray
($confighosts,\
%hosts);
475 &General
::readhasharray
($confignets,\
%nets);
476 &General
::readhasharray
($configgroups,\
%groups);
477 &General
::readhasharray
($ovpnconfig,\
%configovpn);
478 &General
::readhasharray
($ccdconfig,\
%ccdconf);
479 &General
::readhash
($ovpnsettings,\
%settingsovpn);
482 if($settingsovpn{'DOVPN_SUBNET'}){
483 my ($net,$subnet)=split("/",$settingsovpn{'DOVPN_SUBNET'});
484 push (@ovpnnets,"$net,$subnet,dynamic");
486 foreach my $key (sort keys %ccdconf){
487 my ($net,$subnet)=split("/",$ccdconf{$key}[1]);
488 $subnet=&General
::iporsubtodec
($subnet);
489 push (@ovpnnets,"$net,$subnet,$ccdconf{$key}[0]");
491 foreach my $key (sort keys %configovpn){
492 if ($configovpn{$key}[3] eq 'net'){
493 my ($net,$subnet)=split("/",$configovpn{$key}[27]);
494 push (@ovpnnets,"$net,$subnet,$configovpn{$key}[2]");
497 #add ovpn nets to customnetworks/groups
498 foreach my $line (@ovpnnets){
499 my ($net,$subnet,$name) = split(",",$line);
500 if (!&check_net
($net,$subnet)){
501 my $netkey = &General
::findhasharraykey
(\
%nets);
502 $name2=$name."(ovpn)".$net;
503 $name3="Custom Network";
504 $nets{$netkey}[0] = $name2;
505 $nets{$netkey}[1] = $net;
506 $nets{$netkey}[2] = $subnet;
507 $nets{$netkey}[3] = 1;
509 print LOG
"-> Custom Network with same IP already exist \"$net/$subnet\" (you can ignore this, if this run was manual from shell)\n";
512 my $grpkey = &General
::findhasharraykey
(\
%groups);
513 $groups{$grpkey}[0] = "ovpn";
514 $groups{$grpkey}[1] = '';
515 $groups{$grpkey}[2] = $name2;
516 $groups{$grpkey}[3] = "Custom Network";
517 $groups{$grpkey}[4] = 0;
522 &General
::writehasharray
($confighosts,\
%hosts);
523 &General
::writehasharray
($configgroups,\
%groups);
524 &General
::writehasharray
($confignets,\
%nets);