html/cgi-bin/firewall.cgi

   1 #!/usr/bin/perl
   2 ###############################################################################
   3 #                                                                             #
   4 # IPFire.org - A linux based firewall                                         #
   5 # Copyright (C) 2013 Alexander Marx <amarx@ipfire.org>                        #
   6 #                                                                             #
   7 # This program is free software: you can redistribute it and/or modify        #
   8 # it under the terms of the GNU General Public License as published by        #
   9 # the Free Software Foundation, either version 3 of the License, or           #
  10 # (at your option) any later version.                                         #
  11 #                                                                             #
  12 # This program is distributed in the hope that it will be useful,             #
  13 # but WITHOUT ANY WARRANTY; without even the implied warranty of              #
  14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
  15 # GNU General Public License for more details.                                #
  16 #                                                                             #
  17 # You should have received a copy of the GNU General Public License           #
  18 # along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
  19 #                                                                             #
  20 ###############################################################################
  21
  22 use strict;
  23 use Sort::Naturally;
  24 use utf8;
  25 use feature 'unicode_strings';
  26
  27 no warnings 'uninitialized';
  28
  29 # enable only the following on debugging purpose
  30 #use warnings;
  31 #use CGI::Carp 'fatalsToBrowser';
  32
  33 require '/var/ipfire/general-functions.pl';
  34 require "${General::swroot}/lang.pl";
  35 require "${General::swroot}/header.pl";
  36 require "/usr/lib/firewall/firewall-lib.pl";
  37
  38 unless (-d "${General::swroot}/firewall")                       { system("mkdir ${General::swroot}/firewall"); }
  39 unless (-e "${General::swroot}/firewall/settings")      { system("touch ${General::swroot}/firewall/settings"); }
  40 unless (-e "${General::swroot}/firewall/config")        { system("touch ${General::swroot}/firewall/config"); }
  41 unless (-e "${General::swroot}/firewall/input")         { system("touch ${General::swroot}/firewall/input"); }
  42 unless (-e "${General::swroot}/firewall/outgoing")      { system("touch ${General::swroot}/firewall/outgoing"); }
  43
  44 my %fwdfwsettings=();
  45 my %selected=() ;
  46 my %defaultNetworks=();
  47 my %netsettings=();
  48 my %customhost=();
  49 my %customgrp=();
  50 my %customnetworks=();
  51 my %customservice=();
  52 my %customservicegrp=();
  53 my %ccdnet=();
  54 my %customnetwork=();
  55 my %ccdhost=();
  56 my %configfwdfw=();
  57 my %configinputfw=();
  58 my %configoutgoingfw=();
  59 my %ipsecconf=();
  60 my %color=();
  61 my %mainsettings=();
  62 my %checked=();
  63 my %icmptypes=();
  64 my %ovpnsettings=();
  65 my %ipsecsettings=();
  66 my %aliases=();
  67 my %optionsfw=();
  68 my %ifaces=();
  69 my %rulehash=();
  70
  71 my @PROTOCOLS = ("TCP", "UDP", "ICMP", "IGMP", "AH", "ESP", "GRE","IPv6","IPIP");
  72
  73 my $color;
  74 my $confignet           = "${General::swroot}/fwhosts/customnetworks";
  75 my $confighost          = "${General::swroot}/fwhosts/customhosts";
  76 my $configgrp           = "${General::swroot}/fwhosts/customgroups";
  77 my $configsrv           = "${General::swroot}/fwhosts/customservices";
  78 my $configsrvgrp        = "${General::swroot}/fwhosts/customservicegrp";
  79 my $configccdnet        = "${General::swroot}/ovpn/ccd.conf";
  80 my $configccdhost       = "${General::swroot}/ovpn/ovpnconfig";
  81 my $configipsec         = "${General::swroot}/vpn/config";
  82 my $configipsecrw       = "${General::swroot}/vpn/settings";
  83 my $configfwdfw         = "${General::swroot}/firewall/config";
  84 my $configinput         = "${General::swroot}/firewall/input";
  85 my $configoutgoing      = "${General::swroot}/firewall/outgoing";
  86 my $configovpn          = "${General::swroot}/ovpn/settings";
  87 my $fwoptions           = "${General::swroot}/optionsfw/settings";
  88 my $ifacesettings       = "${General::swroot}/ethernet/settings";
  89 my $errormessage='';
  90 my $hint='';
  91 my $ipgrp="${General::swroot}/outgoing/groups";
  92 my $tdcolor='';
  93 my $checkorange='';
  94 my @protocols;
  95 &General::readhash("${General::swroot}/firewall/settings", \%fwdfwsettings);
  96 &General::readhash("${General::swroot}/main/settings", \%mainsettings);
  97 &General::readhash("/srv/web/ipfire/html/themes/".$mainsettings{'THEME'}."/include/colors.txt", \%color);
  98 &General::readhash($fwoptions, \%optionsfw);
  99 &General::readhash($ifacesettings, \%ifaces);
 100 &General::readhash("$configovpn", \%ovpnsettings);
 101 &General::readhash("$configipsecrw", \%ipsecsettings);
 102 &General::readhasharray("$configipsec", \%ipsecconf);
 103 &Header::showhttpheaders();
 104 &Header::getcgihash(\%fwdfwsettings);
 105 &Header::openpage($Lang::tr{'firewall rules'}, 1, '');
 106 &Header::openbigbox('100%', 'center',$errormessage);
 107 #### JAVA SCRIPT ####
 108 print<<END;
 109 <script>
 110         var PROTOCOLS_WITH_PORTS = ["TCP", "UDP"];
 111
 112         var update_protocol = function() {
 113                 var protocol = \$("#protocol").val();
 114
 115                 if (protocol === undefined)
 116                         return;
 117
 118                 // Check if a template is/should be used.
 119                 if (protocol === "template") {
 120                         \$("#PROTOCOL_TEMPLATE").show();
 121                 } else {
 122                         \$("#PROTOCOL_TEMPLATE").hide();
 123                 }
 124
 125                 // Check if we are dealing with a protocol, that knows ports.
 126                 if (\$.inArray(protocol, PROTOCOLS_WITH_PORTS) >= 0) {
 127                         \$("#PROTOCOL_PORTS").show();
 128                 } else {
 129                         \$("#PROTOCOL_PORTS").hide();
 130                 }
 131
 132                 // Handle ICMP.
 133                 if (protocol === "ICMP") {
 134                         \$("#PROTOCOL_ICMP_TYPES").show();
 135                 } else {
 136                         \$("#PROTOCOL_ICMP_TYPES").hide();
 137                 }
 138         };
 139
 140         \$(document).ready(function() {
 141                 \$("#protocol").change(update_protocol);
 142                 update_protocol();
 143
 144                 // Show/Hide elements when NAT checkbox is checked.
 145                 if (\$("#USE_NAT").attr("checked")) {
 146                         \$("#actions").hide();
 147                 } else {
 148                         \$(".NAT").hide();
 149                 }
 150
 151                 // Show NAT area when "use nat" checkbox is clicked
 152                 \$("#USE_NAT").change(function() {
 153                         \$(".NAT").toggle();
 154                         \$("#actions").toggle();
 155                 });
 156
 157                 // Time constraints
 158                 if(!\$("#USE_TIME_CONSTRAINTS").attr("checked")) {
 159                         \$("#TIME_CONSTRAINTS").hide();
 160                 }
 161                 \$("#USE_TIME_CONSTRAINTS").change(function() {
 162                         \$("#TIME_CONSTRAINTS").toggle();
 163                 });
 164
 165                 // Limit concurrent connections per ip
 166                 if(!\$("#USE_LIMIT_CONCURRENT_CONNECTIONS_PER_IP").attr("checked")) {
 167                         \$("#LIMIT_CON").hide();
 168                 }
 169                 \$("#USE_LIMIT_CONCURRENT_CONNECTIONS_PER_IP").change(function() {
 170                         \$("#LIMIT_CON").toggle();
 171                 });
 172
 173                 // Rate-limit new connections
 174                 if(!\$("#USE_RATELIMIT").attr("checked")) {
 175                         \$("#RATELIMIT").hide();
 176                 }
 177                 \$("#USE_RATELIMIT").change(function() {
 178                         \$("#RATELIMIT").toggle();
 179                 });
 180
 181                 // Automatically select radio buttons when corresponding
 182                 // dropdown menu changes.
 183                 \$("select").change(function() {
 184                         var id = \$(this).attr("name");
 185                         \$('#' + id).prop("checked", true);
 186                 });
 187         });
 188 </script>
 189 END
 190
 191 ####  ACTION  #####
 192
 193 if ($fwdfwsettings{'ACTION'} eq 'saverule')
 194 {
 195         &General::readhasharray("$configfwdfw", \%configfwdfw);
 196         &General::readhasharray("$configinput", \%configinputfw);
 197         &General::readhasharray("$configoutgoing", \%configoutgoingfw);
 198         my $maxkey;
 199         #Set Variables according to the JQuery code in protocol section
 200         if ($fwdfwsettings{'PROT'} eq 'TCP' || $fwdfwsettings{'PROT'} eq 'UDP')
 201         {
 202                 if ($fwdfwsettings{'SRC_PORT'} ne '')
 203                 {
 204                         $fwdfwsettings{'USE_SRC_PORT'} = 'ON';
 205                 }
 206                 if ($fwdfwsettings{'TGT_PORT'} ne '')
 207                 {
 208                         $fwdfwsettings{'USESRV'} = 'ON';
 209                         $fwdfwsettings{'grp3'} = 'TGT_PORT';
 210                 }
 211         }
 212         if ($fwdfwsettings{'PROT'} eq 'template')
 213         {
 214                 $fwdfwsettings{'USESRV'} = 'ON';
 215         }
 216         $errormessage=&checksource;
 217         if(!$errormessage){&checktarget;}
 218         if(!$errormessage){&checkrule;}
 219
 220         #check if manual ip (source) is orange network
 221         if ($fwdfwsettings{'grp1'} eq 'src_addr'){
 222                 my ($sip,$scidr) = split("/",$fwdfwsettings{$fwdfwsettings{'grp1'}});
 223                 if ( &General::IpInSubnet($sip,$netsettings{'ORANGE_ADDRESS'},$netsettings{'ORANGE_NETMASK'})){
 224                         $checkorange='on';
 225                 }
 226         }
 227         #check useless rules
 228         if(     ($fwdfwsettings{$fwdfwsettings{'grp1'}} eq 'ORANGE' || $checkorange eq 'on') && $fwdfwsettings{'grp2'} eq 'ipfire'){
 229                 $errormessage.=$Lang::tr{'fwdfw useless rule'}."<br>";
 230         }
 231         #check if we try to break rules
 232         if(     $fwdfwsettings{'grp1'} eq 'ipfire_src' && $fwdfwsettings{'grp2'} eq 'ipfire'){
 233                 $errormessage=$Lang::tr{'fwdfw err same'};
 234         }
 235         # INPUT part
 236         if ($fwdfwsettings{'grp2'} eq 'ipfire' && $fwdfwsettings{$fwdfwsettings{'grp1'}} ne 'ORANGE'){
 237                 $fwdfwsettings{'config'}=$configinput;
 238                 $fwdfwsettings{'chain'} = 'INPUTFW';
 239                 $maxkey=&General::findhasharraykey(\%configinputfw);
 240                 %rulehash=%configinputfw;
 241         }elsif ($fwdfwsettings{'grp1'} eq 'ipfire_src' ){
 242         # OUTGOING PART
 243                 $fwdfwsettings{'config'}=$configoutgoing;
 244                 $fwdfwsettings{'chain'} = 'OUTGOINGFW';
 245                 $maxkey=&General::findhasharraykey(\%configoutgoingfw);
 246                 %rulehash=%configoutgoingfw;
 247         }else {
 248         # FORWARD PART
 249                 $fwdfwsettings{'config'}=$configfwdfw;
 250                 $fwdfwsettings{'chain'} = 'FORWARDFW';
 251                 $maxkey=&General::findhasharraykey(\%configfwdfw);
 252                 %rulehash=%configfwdfw;
 253         }
 254         #check if we have an identical rule already
 255         if($fwdfwsettings{'oldrulenumber'} eq $fwdfwsettings{'rulepos'}){
 256                 foreach my $key (sort keys %rulehash){
 257                         if (   "$fwdfwsettings{'RULE_ACTION'},$fwdfwsettings{'ACTIVE'},$fwdfwsettings{'grp1'},$fwdfwsettings{$fwdfwsettings{'grp1'}},$fwdfwsettings{'grp2'},$fwdfwsettings{$fwdfwsettings{'grp2'}},$fwdfwsettings{'USE_SRC_PORT'},$fwdfwsettings{'PROT'},$fwdfwsettings{'ICMP_TYPES'},$fwdfwsettings{'SRC_PORT'},$fwdfwsettings{'USESRV'},$fwdfwsettings{'TGT_PROT'},$fwdfwsettings{'ICMP_TGT'},$fwdfwsettings{'grp3'},$fwdfwsettings{$fwdfwsettings{'grp3'}},$fwdfwsettings{'ruleremark'},$fwdfwsettings{'LOG'},$fwdfwsettings{'TIME'},$fwdfwsettings{'TIME_MON'},$fwdfwsettings{'TIME_TUE'},$fwdfwsettings{'TIME_WED'},$fwdfwsettings{'TIME_THU'},$fwdfwsettings{'TIME_FRI'},$fwdfwsettings{'TIME_SAT'},$fwdfwsettings{'TIME_SUN'},$fwdfwsettings{'TIME_FROM'},$fwdfwsettings{'TIME_TO'},$fwdfwsettings{'USE_NAT'},$fwdfwsettings{$fwdfwsettings{'nat'}},$fwdfwsettings{'dnatport'},$fwdfwsettings{'nat'},$fwdfwsettings{'LIMIT_CON_CON'},$fwdfwsettings{'concon'},$fwdfwsettings{'RATE_LIMIT'},$fwdfwsettings{'ratecon'},$fwdfwsettings{'RATETIME'}"
 258                                 eq "$rulehash{$key}[0],$rulehash{$key}[2],$rulehash{$key}[3],$rulehash{$key}[4],$rulehash{$key}[5],$rulehash{$key}[6],$rulehash{$key}[7],$rulehash{$key}[8],$rulehash{$key}[9],$rulehash{$key}[10],$rulehash{$key}[11],$rulehash{$key}[12],$rulehash{$key}[13],$rulehash{$key}[14],$rulehash{$key}[15],$rulehash{$key}[16],$rulehash{$key}[17],$rulehash{$key}[18],$rulehash{$key}[19],$rulehash{$key}[20],$rulehash{$key}[21],$rulehash{$key}[22],$rulehash{$key}[23],$rulehash{$key}[24],$rulehash{$key}[25],$rulehash{$key}[26],$rulehash{$key}[27],$rulehash{$key}[28],$rulehash{$key}[29],$rulehash{$key}[30],$rulehash{$key}[31],$rulehash{$key}[32],$rulehash{$key}[33],$rulehash{$key}[34],$rulehash{$key}[35],$rulehash{$key}[36]"){
 259                                         $errormessage.=$Lang::tr{'fwdfw err ruleexists'};
 260                                         if($fwdfwsettings{'oldruleremark'} ne $fwdfwsettings{'ruleremark'} && $fwdfwsettings{'updatefwrule'} eq 'on' && $fwdfwsettings{'ruleremark'} ne '' && !&validremark($fwdfwsettings{'ruleremark'})){
 261                                                 $errormessage=$Lang::tr{'fwdfw err remark'}."<br>";
 262                                         }
 263                                         if($fwdfwsettings{'oldruleremark'} ne $fwdfwsettings{'ruleremark'} && $fwdfwsettings{'updatefwrule'} eq 'on' && $fwdfwsettings{'ruleremark'} ne '' && &validremark($fwdfwsettings{'ruleremark'})){
 264                                                 $errormessage='';
 265                                         }
 266                                         if ($fwdfwsettings{'oldruleremark'} eq $fwdfwsettings{'ruleremark'}){
 267                                                 $fwdfwsettings{'nosave'} = 'on';
 268                                         }
 269                         }
 270                 }
 271         }
 272         #check Rulepos on new Rule
 273         if($fwdfwsettings{'rulepos'} > 0 && !$fwdfwsettings{'oldrulenumber'}){
 274                 $fwdfwsettings{'oldrulenumber'}=$maxkey;
 275                 foreach my $key (sort keys %rulehash){
 276                         if (   "$fwdfwsettings{'RULE_ACTION'},$fwdfwsettings{'ACTIVE'},$fwdfwsettings{'grp1'},$fwdfwsettings{$fwdfwsettings{'grp1'}},$fwdfwsettings{'grp2'},$fwdfwsettings{$fwdfwsettings{'grp2'}},$fwdfwsettings{'USE_SRC_PORT'},$fwdfwsettings{'PROT'},$fwdfwsettings{'ICMP_TYPES'},$fwdfwsettings{'SRC_PORT'},$fwdfwsettings{'USESRV'},$fwdfwsettings{'TGT_PROT'},$fwdfwsettings{'ICMP_TGT'},$fwdfwsettings{'grp3'},$fwdfwsettings{$fwdfwsettings{'grp3'}},$fwdfwsettings{'TIME'},$fwdfwsettings{'TIME_MON'},$fwdfwsettings{'TIME_TUE'},$fwdfwsettings{'TIME_WED'},$fwdfwsettings{'TIME_THU'},$fwdfwsettings{'TIME_FRI'},$fwdfwsettings{'TIME_SAT'},$fwdfwsettings{'TIME_SUN'},$fwdfwsettings{'TIME_FROM'},$fwdfwsettings{'TIME_TO'},$fwdfwsettings{'USE_NAT'},$fwdfwsettings{$fwdfwsettings{'nat'}},$fwdfwsettings{'dnatport'},$fwdfwsettings{'nat'},$fwdfwsettings{'LIMIT_CON_CON'},$fwdfwsettings{'concon'},$fwdfwsettings{'RATE_LIMIT'},$fwdfwsettings{'ratecon'},$fwdfwsettings{'RATETIME'}"
 277                                 eq "$rulehash{$key}[0],$rulehash{$key}[2],$rulehash{$key}[3],$rulehash{$key}[4],$rulehash{$key}[5],$rulehash{$key}[6],$rulehash{$key}[7],$rulehash{$key}[8],$rulehash{$key}[9],$rulehash{$key}[10],$rulehash{$key}[11],$rulehash{$key}[12],$rulehash{$key}[13],$rulehash{$key}[14],$rulehash{$key}[15],$rulehash{$key}[18],$rulehash{$key}[19],$rulehash{$key}[20],$rulehash{$key}[21],$rulehash{$key}[22],$rulehash{$key}[23],$rulehash{$key}[24],$rulehash{$key}[25],$rulehash{$key}[26],$rulehash{$key}[27],$rulehash{$key}[28],$rulehash{$key}[29],$rulehash{$key}[30],$rulehash{$key}[31],$rulehash{$key}[32],$rulehash{$key}[33],$rulehash{$key}[34],$rulehash{$key}[35],$rulehash{$key}[36]"){
 278                                         $errormessage.=$Lang::tr{'fwdfw err ruleexists'};
 279                         }
 280                 }
 281         }
 282         #check if we just close a rule
 283         if( $fwdfwsettings{'oldgrp1a'} eq  $fwdfwsettings{'grp1'} && $fwdfwsettings{'oldgrp1b'} eq $fwdfwsettings{$fwdfwsettings{'grp1'}} && $fwdfwsettings{'oldgrp2a'} eq  $fwdfwsettings{'grp2'} && $fwdfwsettings{'oldgrp2b'} eq $fwdfwsettings{$fwdfwsettings{'grp2'}} &&  $fwdfwsettings{'oldgrp3a'} eq $fwdfwsettings{'grp3'} && $fwdfwsettings{'oldgrp3b'} eq  $fwdfwsettings{$fwdfwsettings{'grp3'}} && $fwdfwsettings{'oldusesrv'} eq $fwdfwsettings{'USESRV'} && $fwdfwsettings{'oldruleremark'} eq $fwdfwsettings{'ruleremark'} && $fwdfwsettings{'oldruletype'} eq $fwdfwsettings{'chain'}){
 284                 if($fwdfwsettings{'nosave'} eq 'on' && $fwdfwsettings{'updatefwrule'} eq 'on'){
 285                         $fwdfwsettings{'nosave2'} = 'on';
 286                         $errormessage='';
 287                 }
 288         }
 289         #check max concurrent connections per ip address
 290         if ($fwdfwsettings{'LIMIT_CON_CON'} eq 'ON'){
 291                 if (!($fwdfwsettings{'concon'} =~ /^(\d+)$/)) {
 292                         $errormessage.=$Lang::tr{'fwdfw err concon'};
 293                 }
 294         }else{
 295                 $fwdfwsettings{'concon'}='';
 296         }
 297         #check ratelimit value
 298         if ($fwdfwsettings{'RATE_LIMIT'} eq 'ON'){
 299                 if (!($fwdfwsettings{'ratecon'} =~ /^(\d+)$/)) {
 300                         $errormessage.=$Lang::tr{'fwdfw err ratecon'};
 301                 }
 302         }else{
 303                 $fwdfwsettings{'ratecon'}='';
 304         }
 305         #increase counters
 306         if (!$errormessage){
 307                 if ($fwdfwsettings{'nosave2'} ne 'on'){
 308                         &saverule(\%rulehash,$fwdfwsettings{'config'});
 309                 }
 310         }
 311         if ($errormessage){
 312                 &newrule;
 313         }else{
 314                 if($fwdfwsettings{'nosave2'} ne 'on'){
 315                         &General::firewall_config_changed();
 316                 }
 317                 &base;
 318         }
 319 }
 320 if ($fwdfwsettings{'ACTION'} eq $Lang::tr{'fwdfw newrule'})
 321 {
 322         &newrule;
 323 }
 324 if ($fwdfwsettings{'ACTION'} eq $Lang::tr{'fwdfw toggle'})
 325 {
 326         my %togglehash=();
 327         &General::readhasharray($fwdfwsettings{'config'}, \%togglehash);
 328         foreach my $key (sort keys %togglehash){
 329                 if ($key eq $fwdfwsettings{'key'}){
 330                         if ($togglehash{$key}[2] eq 'ON'){$togglehash{$key}[2]='';}else{$togglehash{$key}[2]='ON';}
 331                 }
 332         }
 333         &General::writehasharray($fwdfwsettings{'config'}, \%togglehash);
 334         &General::firewall_config_changed();
 335         &base;
 336 }
 337 if ($fwdfwsettings{'ACTION'} eq $Lang::tr{'fwdfw togglelog'})
 338 {
 339         my %togglehash=();
 340         &General::readhasharray($fwdfwsettings{'config'}, \%togglehash);
 341         foreach my $key (sort keys %togglehash){
 342                 if ($key eq $fwdfwsettings{'key'}){
 343                         if ($togglehash{$key}[17] eq 'ON'){$togglehash{$key}[17]='';}else{$togglehash{$key}[17]='ON';}
 344                 }
 345         }
 346         &General::writehasharray($fwdfwsettings{'config'}, \%togglehash);
 347         &General::firewall_config_changed();
 348         &base;
 349 }
 350 if ($fwdfwsettings{'ACTION'} eq $Lang::tr{'fwdfw reread'})
 351 {
 352         &General::firewall_reload();
 353         &base;
 354 }
 355 if ($fwdfwsettings{'ACTION'} eq 'editrule')
 356 {
 357         $fwdfwsettings{'updatefwrule'}='on';
 358         &newrule;
 359 }
 360 if ($fwdfwsettings{'ACTION'} eq 'deleterule')
 361 {
 362         &deleterule;
 363 }
 364 if ($fwdfwsettings{'ACTION'} eq 'moveup')
 365 {
 366         &pos_up;
 367         &base;
 368 }
 369 if ($fwdfwsettings{'ACTION'} eq 'movedown')
 370 {
 371         &pos_down;
 372         &base;
 373 }
 374 if ($fwdfwsettings{'ACTION'} eq 'copyrule')
 375 {
 376         $fwdfwsettings{'copyfwrule'}='on';
 377         &newrule;
 378 }
 379 if ($fwdfwsettings{'ACTION'} eq '' or $fwdfwsettings{'ACTION'} eq 'reset')
 380 {
 381         &base;
 382 }
 383 ###  Functions  ####
 384 sub addrule
 385 {
 386         &error;
 387
 388         &Header::openbox('100%', 'left', "");
 389         print <<END;
 390                 <form method="POST" action="">
 391                         <table border='0' width="100%">
 392                                 <tr>
 393                                         <td align='center'>
 394                                                 <input type='submit' name='ACTION' value='$Lang::tr{'fwdfw newrule'}'>
 395 END
 396
 397         if (&General::firewall_needs_reload()) {
 398                 print <<END;
 399                         <input type='submit' name='ACTION' value='$Lang::tr{'fwdfw reread'}' style='font-weight: bold; color: green;'>
 400 END
 401         }
 402
 403         print <<END;
 404                                         </td>
 405                                 </tr>
 406                         </table>
 407                 </form>
 408
 409                 <br>
 410 END
 411
 412         &Header::closebox();
 413         &viewtablerule;
 414 }
 415 sub base
 416 {
 417         &hint;
 418         &addrule;
 419 }
 420 sub changerule
 421 {
 422         my $oldchain=shift;
 423         $fwdfwsettings{'updatefwrule'}='';
 424         $fwdfwsettings{'config'}=$oldchain;
 425         $fwdfwsettings{'nobase'}='on';
 426         &deleterule;
 427 }
 428 sub checksource
 429 {
 430         my ($ip,$subnet);
 431         #check ip-address if manual
 432         if ($fwdfwsettings{'src_addr'} eq $fwdfwsettings{$fwdfwsettings{'grp1'}} && $fwdfwsettings{'src_addr'} ne ''){
 433                 #check if ip with subnet
 434                 if ($fwdfwsettings{'src_addr'} =~ /^(.*?)\/(.*?)$/) {
 435                         ($ip,$subnet)=split (/\//,$fwdfwsettings{'src_addr'});
 436                         $subnet = &General::iporsubtocidr($subnet);
 437                         $fwdfwsettings{'isip'}='on';
 438                 }
 439                 #check if only ip
 440                 if($fwdfwsettings{'src_addr'}=~/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/){
 441                         $ip=$fwdfwsettings{'src_addr'};
 442                         $subnet = '32';
 443                         $fwdfwsettings{'isip'}='on';
 444                 }
 445
 446                 if ($fwdfwsettings{'isip'} ne 'on'){
 447                         if (&General::validmac($fwdfwsettings{'src_addr'})){
 448                                 $fwdfwsettings{'ismac'}='on';
 449                         }
 450                 }
 451                 if ($fwdfwsettings{'isip'} eq 'on'){
 452                         ##check if ip is valid
 453                         if (! &General::validip($ip)){
 454                                 $errormessage.=$Lang::tr{'fwdfw err src_addr'}."<br>";
 455                                 return $errormessage;
 456                         }
 457                         #check and form valid IP
 458                         $ip=&General::ip2dec($ip);
 459                         $ip=&General::dec2ip($ip);
 460                         #check if net or broadcast
 461                         $fwdfwsettings{'src_addr'}="$ip/$subnet";
 462                         if(!&General::validipandmask($fwdfwsettings{'src_addr'})){
 463                                 $errormessage.=$Lang::tr{'fwdfw err src_addr'}."<br>";
 464                                 return $errormessage;
 465                         }
 466                 }
 467                 if ($fwdfwsettings{'isip'} ne 'on' && $fwdfwsettings{'ismac'} ne 'on'){
 468                         $errormessage.=$Lang::tr{'fwdfw err src_addr'}."<br>";
 469                         return $errormessage;
 470                 }
 471         }elsif($fwdfwsettings{'src_addr'} eq $fwdfwsettings{$fwdfwsettings{'grp1'}} && $fwdfwsettings{'src_addr'} eq ''){
 472                 $fwdfwsettings{'grp1'}='std_net_src';
 473                 $fwdfwsettings{$fwdfwsettings{'grp1'}} = 'ALL';
 474         }
 475
 476         #check empty fields
 477         if ($fwdfwsettings{$fwdfwsettings{'grp1'}} eq ''){ $errormessage.=$Lang::tr{'fwdfw err nosrc'}."<br>";}
 478         if($fwdfwsettings{'USE_SRC_PORT'} eq 'ON' && ($fwdfwsettings{'PROT'} eq 'TCP' || $fwdfwsettings{'PROT'} eq 'UDP') && $fwdfwsettings{'SRC_PORT'} ne ''){
 479                 my @parts=split(",",$fwdfwsettings{'SRC_PORT'});
 480                 my @values=();
 481                 foreach (@parts){
 482                         chomp($_);
 483                         if ($_ =~ /^(\d+)\-(\d+)$/ || $_ =~ /^(\d+)\:(\d+)$/) {
 484                                 my $check;
 485                                 #change dashes with :
 486                                 $_=~ tr/-/:/;
 487                                 if ($_ eq "*") {
 488                                         push(@values,"1:65535");
 489                                         $check='on';
 490                                 }
 491                                 if ($_ =~ /^(\D)\:(\d+)$/ || $_ =~ /^(\D)\-(\d+)$/) {
 492                                         push(@values,"1:$2");
 493                                         $check='on';
 494                                 }
 495                                 if ($_ =~ /^(\d+)\:(\D)$/ || $_ =~ /^(\d+)\-(\D)$/ ) {
 496                                         push(@values,"$1:65535");
 497                                         $check='on'
 498                                 }
 499                                 $errormessage .= &General::validportrange($_, 'destination');
 500                                 if(!$check){
 501                                         push (@values,$_);
 502                                 }
 503                         }else{
 504                                 if (&General::validport($_)){
 505                                         push (@values,$_);
 506                                 }else{
 507
 508                                 }
 509                         }
 510                 }
 511                 $fwdfwsettings{'SRC_PORT'}=join("|",@values);
 512         }
 513         return $errormessage;
 514 }
 515 sub checktarget
 516 {
 517         my ($ip,$subnet);
 518         &General::readhasharray("$configsrv", \%customservice);
 519         #check DNAT settings (has to be single Host and single Port or portrange)
 520         if ($fwdfwsettings{'USE_NAT'} eq 'ON' && $fwdfwsettings{'nat'} eq 'dnat'){
 521                 if($fwdfwsettings{'grp2'} eq 'tgt_addr' || $fwdfwsettings{'grp2'} eq 'cust_host_tgt' || $fwdfwsettings{'grp2'} eq 'ovpn_host_tgt'){
 522                         #check if manual ip is a single Host (if set)
 523                         if ($fwdfwsettings{'grp2'} eq 'tgt_addr'){
 524                                 my @tmp= split (/\./,$fwdfwsettings{$fwdfwsettings{'grp2'}});
 525                                 my @tmp1= split ("/",$tmp[3]);
 526                                 if (($tmp1[0] eq "0") || ($tmp1[0] eq "255"))
 527                                 {
 528                                         $errormessage=$Lang::tr{'fwdfw dnat error'}."<br>";
 529                                         return $errormessage;
 530                                 }
 531                         }
 532                         #check if Port is a single Port or portrange
 533                         if ($fwdfwsettings{'nat'} eq 'dnat' &&  $fwdfwsettings{'grp3'} eq 'TGT_PORT'){
 534                                 if(($fwdfwsettings{'PROT'} ne 'TCP'|| $fwdfwsettings{'PROT'} ne 'UDP') && $fwdfwsettings{'TGT_PORT'} eq ''){
 535                                         $errormessage=$Lang::tr{'fwdfw target'}.": ".$Lang::tr{'fwdfw dnat porterr'}."<br>";
 536                                         return $errormessage;
 537                                 }
 538                                 if (($fwdfwsettings{'PROT'} eq 'TCP'|| $fwdfwsettings{'PROT'} eq 'UDP') && $fwdfwsettings{'TGT_PORT'} ne '' && !&check_natport($fwdfwsettings{'TGT_PORT'})){
 539                                         $errormessage=$Lang::tr{'fwdfw target'}.": ".$Lang::tr{'fwdfw dnat porterr'}."<br>";
 540                                         return $errormessage;
 541                                 }
 542                         }
 543                 }else{
 544                         if ($fwdfwsettings{'grp2'} ne 'ipfire'){
 545                                 $errormessage=$Lang::tr{'fwdfw dnat error'}."<br>";
 546                                 return $errormessage;
 547                         }
 548                 }
 549         }
 550         if ($fwdfwsettings{'tgt_addr'} eq $fwdfwsettings{$fwdfwsettings{'grp2'}} && $fwdfwsettings{'tgt_addr'} ne ''){
 551                 #check if ip with subnet
 552                 if ($fwdfwsettings{'tgt_addr'} =~ /^(.*?)\/(.*?)$/) {
 553                         ($ip,$subnet)=split (/\//,$fwdfwsettings{'tgt_addr'});
 554                         $subnet = &General::iporsubtocidr($subnet);
 555                 }
 556                 #check if only ip
 557                 if($fwdfwsettings{'tgt_addr'}=~/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/){
 558                         $ip=$fwdfwsettings{'tgt_addr'};
 559                         $subnet='32';
 560                 }
 561                 #check if ip is valid
 562                 if (! &General::validip($ip)){
 563                         $errormessage.=$Lang::tr{'fwdfw err tgt_addr'}."<br>";
 564                         return $errormessage;
 565                 }
 566                 #check and form valid IP
 567                 $ip=&General::ip2dec($ip);
 568                 $ip=&General::dec2ip($ip);
 569                 $fwdfwsettings{'tgt_addr'}="$ip/$subnet";
 570                 if(!&General::validipandmask($fwdfwsettings{'tgt_addr'})){
 571                         $errormessage.=$Lang::tr{'fwdfw err tgt_addr'}."<br>";
 572                         return $errormessage;
 573                 }
 574         }elsif($fwdfwsettings{'tgt_addr'} eq $fwdfwsettings{$fwdfwsettings{'grp2'}} && $fwdfwsettings{'tgt_addr'} eq ''){
 575                 $fwdfwsettings{'grp2'}='std_net_tgt';
 576                 $fwdfwsettings{$fwdfwsettings{'grp2'}} = 'ALL';
 577         }
 578         #check for mac in targetgroup
 579         if ($fwdfwsettings{'grp2'} eq 'cust_grp_tgt'){
 580                 &General::readhasharray("$configgrp", \%customgrp);
 581                 &General::readhasharray("$confighost", \%customhost);
 582                 foreach my $grpkey (sort keys %customgrp){
 583                         foreach my $hostkey (sort keys %customhost){
 584                                 if ($customgrp{$grpkey}[2] eq $customhost{$hostkey}[0] && $customhost{$hostkey}[1] eq 'mac'){
 585                                         $hint=$Lang::tr{'fwdfw hint mac'};
 586                                         return $hint;
 587                                 }
 588                         }
 589                 }
 590         }
 591         #check empty fields
 592         if ($fwdfwsettings{$fwdfwsettings{'grp2'}} eq ''){ $errormessage.=$Lang::tr{'fwdfw err notgt'}."<br>";}
 593         #check tgt services
 594         if ($fwdfwsettings{'USESRV'} eq 'ON'){
 595                 if ($fwdfwsettings{'grp3'} eq 'cust_srv'){
 596                         $fwdfwsettings{'TGT_PROT'}='';
 597                         $fwdfwsettings{'ICMP_TGT'}='';
 598                         $fwdfwsettings{'TGT_PORT'}='';
 599                 }
 600                 if ($fwdfwsettings{'grp3'} eq 'cust_srvgrp'){
 601                         $fwdfwsettings{'TGT_PROT'}='';
 602                         $fwdfwsettings{'ICMP_TGT'}='';
 603                         $fwdfwsettings{'TGT_PORT'}='';
 604                         #check target service
 605                         if($fwdfwsettings{$fwdfwsettings{'grp3'}} eq ''){
 606                                 $errormessage.=$Lang::tr{'fwdfw err tgt_grp'};
 607                         }
 608                 }
 609                 if ($fwdfwsettings{'grp3'} eq 'TGT_PORT'){
 610                         if ($fwdfwsettings{'PROT'} eq 'TCP' || $fwdfwsettings{'PROT'} eq 'UDP'){
 611                                 if ($fwdfwsettings{'TGT_PORT'} ne ''){
 612                                         if ($fwdfwsettings{'TGT_PORT'} =~ "," && $fwdfwsettings{'USE_NAT'} && $fwdfwsettings{'nat'} eq 'dnat') {
 613                                                 $errormessage=$Lang::tr{'fwdfw dnat porterr'}."<br>";
 614                                                 return $errormessage;
 615                                         }
 616                                         my @parts=split(",",$fwdfwsettings{'TGT_PORT'});
 617                                         my @values=();
 618                                         foreach (@parts){
 619                                                 chomp($_);
 620                                                 if ($_ =~ /^(\d+)\-(\d+)$/ || $_ =~ /^(\d+)\:(\d+)$/) {
 621                                                         my $check;
 622                                                         #change dashes with :
 623                                                         $_=~ tr/-/:/;
 624                                                         if ($_ eq "*") {
 625                                                                 push(@values,"1:65535");
 626                                                                 $check='on';
 627                                                         }
 628                                                         if ($_ =~ /^(\D)\:(\d+)$/ || $_ =~ /^(\D)\-(\d+)$/) {
 629                                                                 push(@values,"1:$2");
 630                                                                 $check='on';
 631                                                         }
 632                                                         if ($_ =~ /^(\d+)\:(\D)$/ || $_ =~ /^(\d+)\-(\D)$/) {
 633                                                                 push(@values,"$1:65535");
 634                                                                 $check='on'
 635                                                         }
 636                                                         $errormessage .= &General::validportrange($_, 'destination');
 637                                                         if(!$check){
 638                                                                 push (@values,$_);
 639                                                         }
 640                                                 }else{
 641                                                         if (&General::validport($_)){
 642                                                                 push (@values,$_);
 643                                                         }else{
 644                                                                 $errormessage=$Lang::tr{'fwdfw err tgt_port'};
 645                                                                 return $errormessage;
 646                                                         }
 647                                                 }
 648                                         }
 649                                         $fwdfwsettings{'TGT_PORT'}=join("|",@values);
 650                                 }
 651                         }elsif ($fwdfwsettings{'PROT'} eq 'GRE'){
 652                                         $fwdfwsettings{$fwdfwsettings{'grp3'}} = '';
 653                                         $fwdfwsettings{'TGT_PORT'} = '';
 654                                         $fwdfwsettings{'ICMP_TGT'} = '';
 655                         }elsif ($fwdfwsettings{'PROT'} eq 'ESP'){
 656                                         $fwdfwsettings{$fwdfwsettings{'grp3'}} = '';
 657                                         $fwdfwsettings{'TGT_PORT'} = '';
 658                                         $fwdfwsettings{'ICMP_TGT'}='';
 659                         }elsif ($fwdfwsettings{'PROT'} eq 'AH'){
 660                                         $fwdfwsettings{$fwdfwsettings{'grp3'}} = '';
 661                                         $fwdfwsettings{'TGT_PORT'} = '';
 662                                         $fwdfwsettings{'ICMP_TGT'}='';
 663                         }elsif ($fwdfwsettings{'PROT'} eq 'ICMP'){
 664                                 $fwdfwsettings{$fwdfwsettings{'grp3'}} = '';
 665                                 $fwdfwsettings{'TGT_PORT'} = '';
 666                         }
 667                 }
 668         }
 669         #check targetport
 670         if ($fwdfwsettings{'USESRV'} ne 'ON'){
 671                 $fwdfwsettings{'grp3'}='';
 672                 $fwdfwsettings{$fwdfwsettings{'grp3'}}='';
 673                 $fwdfwsettings{'ICMP_TGT'}='';
 674         }
 675         #check timeframe
 676         if($fwdfwsettings{'TIME'} eq 'ON'){
 677                 if($fwdfwsettings{'TIME_MON'} eq '' && $fwdfwsettings{'TIME_TUE'} eq '' && $fwdfwsettings{'TIME_WED'} eq '' && $fwdfwsettings{'TIME_THU'} eq '' && $fwdfwsettings{'TIME_FRI'} eq '' && $fwdfwsettings{'TIME_SAT'} eq '' && $fwdfwsettings{'TIME_SUN'} eq ''){
 678                         $errormessage=$Lang::tr{'fwdfw err time'};
 679                         return $errormessage;
 680                 }
 681         }
 682         return $errormessage;
 683 }
 684 sub check_natport
 685 {
 686         my $val=shift;
 687         if($fwdfwsettings{'USE_NAT'} eq 'ON' && $fwdfwsettings{'nat'} eq 'dnat' && $fwdfwsettings{'dnatport'} ne ''){
 688                 if ($fwdfwsettings{'dnatport'} =~ /^(\d+)\-(\d+)$/) {
 689                         $fwdfwsettings{'dnatport'} =~ tr/-/:/;
 690                         if ($fwdfwsettings{'dnatport'} eq "*") {
 691                                 $fwdfwsettings{'dnatport'}="1:65535";
 692                         }
 693                         if ($fwdfwsettings{'dnatport'} =~ /^(\D)\:(\d+)$/) {
 694                                 $fwdfwsettings{'dnatport'} = "1:$2";
 695                         }
 696                         if ($fwdfwsettings{'dnatport'} =~ /^(\d+)\:(\D)$/) {
 697                                 $fwdfwsettings{'dnatport'} ="$1:65535";
 698                         }
 699                 }
 700                 return 1;
 701         }
 702         if ($val =~ "," || $val>65536 || $val<0){
 703                 return 0;
 704         }
 705         return 1;
 706 }
 707 sub checkrule
 708 {
 709         #check valid port for NAT
 710         if($fwdfwsettings{'USE_NAT'} eq 'ON'){
 711                 #RULE_ACTION must be ACCEPT if we use NAT
 712                 $fwdfwsettings{'RULE_ACTION'} = 'ACCEPT';
 713
 714                 #if no dnat or snat selected errormessage
 715                 if ($fwdfwsettings{'nat'} eq ''){
 716                         $errormessage=$Lang::tr{'fwdfw dnat nochoice'};
 717                         return;
 718                 }
 719
 720                 #if using snat, the external port has to be empty
 721                 if ($fwdfwsettings{'nat'} eq 'snat' && $fwdfwsettings{'dnatport'} ne ''){
 722                         $errormessage=$Lang::tr{'fwdfw dnat extport'};
 723                         return;
 724                 }
 725                 #if no dest port is given in nat area, take target host port
 726                 if($fwdfwsettings{'nat'} eq 'dnat' && $fwdfwsettings{'grp3'} eq 'TGT_PORT' && $fwdfwsettings{'dnatport'} eq ''){$fwdfwsettings{'dnatport'}=$fwdfwsettings{'TGT_PORT'};}
 727                 if($fwdfwsettings{'TGT_PORT'} eq '' && $fwdfwsettings{'dnatport'} ne '' && ($fwdfwsettings{'PROT'} eq 'TCP' || $fwdfwsettings{'PROT'} eq 'UDP')){
 728                         $errormessage=$Lang::tr{'fwdfw dnat porterr2'};
 729                         return;
 730                 }
 731                 #check if port given in nat area is a single valid port or portrange
 732                 if($fwdfwsettings{'nat'} eq 'dnat' && $fwdfwsettings{'TGT_PORT'} ne '' && !&check_natport($fwdfwsettings{'dnatport'})){
 733                         $errormessage=$Lang::tr{'fwdfw target'}.": ".$Lang::tr{'fwdfw dnat porterr'}."<br>";
 734                 }elsif($fwdfwsettings{'USESRV'} eq 'ON' && $fwdfwsettings{'grp3'} eq 'cust_srv'){
 735                         my $custsrvport;
 736                         #get service Protocol and Port
 737                         foreach my $key (sort keys %customservice){
 738                                 if($fwdfwsettings{$fwdfwsettings{'grp3'}} eq $customservice{$key}[0]){
 739                                         if ($customservice{$key}[2] ne 'TCP' && $customservice{$key}[2] ne 'UDP'){
 740                                                 $errormessage=$Lang::tr{'fwdfw target'}.": ".$Lang::tr{'fwdfw dnat porterr'}."<br>";
 741                                         }
 742                                         $custsrvport= $customservice{$key}[1];
 743                                 }
 744                         }
 745                         if($fwdfwsettings{'nat'} eq 'dnat' && $fwdfwsettings{'dnatport'} eq ''){$fwdfwsettings{'dnatport'}=$custsrvport;}
 746                 }
 747                 #check if DNAT port is multiple
 748                 if($fwdfwsettings{'nat'} eq 'dnat' && $fwdfwsettings{'dnatport'} ne ''){
 749                         my @parts=split(",",$fwdfwsettings{'dnatport'});
 750                                         my @values=();
 751                                         foreach (@parts){
 752                                                 chomp($_);
 753                                                 if ($_ =~ /^(\d+)\-(\d+)$/ || $_ =~ /^(\d+)\:(\d+)$/) {
 754                                                         my $check;
 755                                                         #change dashes with :
 756                                                         $_=~ tr/-/:/;
 757                                                         if ($_ eq "*") {
 758                                                                 push(@values,"1:65535");
 759                                                                 $check='on';
 760                                                         }
 761                                                         if ($_ =~ /^(\D)\:(\d+)$/ || $_ =~ /^(\D)\-(\d+)$/) {
 762                                                                 push(@values,"1:$2");
 763                                                                 $check='on';
 764                                                         }
 765                                                         if ($_ =~ /^(\d+)\:(\D)$/ || $_ =~ /^(\d+)\-(\D)$/) {
 766                                                                 push(@values,"$1:65535");
 767                                                                 $check='on'
 768                                                         }
 769                                                         $errormessage .= &General::validportrange($_, 'destination');
 770                                                         if(!$check){
 771                                                                 push (@values,$_);
 772                                                         }
 773                                                 }else{
 774                                                         if (&General::validport($_)){
 775                                                                 push (@values,$_);
 776                                                         }else{
 777
 778                                                         }
 779                                                 }
 780                                         }
 781                                         $fwdfwsettings{'dnatport'}=join("|",@values);
 782                 }
 783                 #check if a rule with prot tcp or udp and ports is edited and now prot is "all", then delete all ports
 784                 if($fwdfwsettings{'PROT'} eq ''){
 785                         $fwdfwsettings{'dnatport'}='';
 786                 }
 787         }
 788         #check valid remark
 789         if ($fwdfwsettings{'ruleremark'} ne '' && !&validremark($fwdfwsettings{'ruleremark'})){
 790                 $errormessage.=$Lang::tr{'fwdfw err remark'}."<br>";
 791         }
 792         #check if source and target identical
 793         if ($fwdfwsettings{$fwdfwsettings{'grp1'}} eq $fwdfwsettings{$fwdfwsettings{'grp2'}} && $fwdfwsettings{$fwdfwsettings{'grp1'}} ne 'ALL' && $fwdfwsettings{'grp2'} ne 'ipfire'){
 794                 $errormessage=$Lang::tr{'fwdfw err same'};
 795                 return $errormessage;
 796         }
 797         #get source and targetip address if possible
 798         my ($sip,$scidr,$tip,$tcidr);
 799         ($sip,$scidr)=&get_ip("src","grp1");
 800         ($tip,$tcidr)=&get_ip("tgt","grp2");
 801         #check same iprange in source and target
 802         if ($sip ne '' && $scidr ne '' && $tip ne '' && $tcidr ne ''){
 803                 my $networkip1=&General::getnetworkip($sip,$scidr);
 804                 my $networkip2=&General::getnetworkip($tip,$tcidr);
 805                 if ($scidr gt $tcidr){
 806                         if ( &General::IpInSubnet($networkip1,$tip,&General::iporsubtodec($tcidr))){
 807                                 $errormessage.=$Lang::tr{'fwdfw err samesub'};
 808                         }
 809                 }elsif($scidr eq $tcidr && $scidr eq '32'){
 810                         my ($sbyte1,$sbyte2,$sbyte3,$sbyte4)=split(/\./,$networkip1);
 811                         my ($tbyte1,$tbyte2,$tbyte3,$tbyte4)=split(/\./,$networkip2);
 812                                 if ($sbyte1 eq $tbyte1 && $sbyte2 eq $tbyte2 && $sbyte3 eq $tbyte3){
 813                                         $hint=$Lang::tr{'fwdfw hint ip1'}."<br>";
 814                                         $hint.=$Lang::tr{'fwdfw hint ip2'}." Source: $networkip1/$scidr Target: $networkip2/$tcidr<br>";
 815                                 }
 816                 }else{
 817                         if ( &General::IpInSubnet($networkip2,$sip,&General::iporsubtodec($scidr)) ){
 818                         $errormessage.=$Lang::tr{'fwdfw err samesub'};
 819                         }
 820                 }
 821         }
 822         #when icmp selected, no source and targetport allowed
 823         if (($fwdfwsettings{'PROT'} ne '' && $fwdfwsettings{'PROT'} ne 'TCP' && $fwdfwsettings{'PROT'} ne 'UDP' && $fwdfwsettings{'PROT'} ne 'template') && ($fwdfwsettings{'USESRV'} eq 'ON' || $fwdfwsettings{'USE_SRC_PORT'} eq 'ON')){
 824                 $errormessage.=$Lang::tr{'fwdfw err prot_port'};
 825                 return;
 826         }
 827         #change protocol if prot not equal dest single service
 828         if ($fwdfwsettings{'grp3'} eq 'cust_srv'){
 829                 foreach my $key (sort keys %customservice){
 830                         if($customservice{$key}[0] eq $fwdfwsettings{$fwdfwsettings{'grp3'}}){
 831                                 if ($customservice{$key}[2] ne $fwdfwsettings{'PROT'}){
 832                                         $fwdfwsettings{'PROT'} = $customservice{$key}[2];
 833                                         last;
 834                                 }
 835                         }
 836                 }
 837         }
 838         #check source and destination protocol if source manual and dest servicegroup
 839         if ($fwdfwsettings{'grp3'} eq 'cust_srvgrp'){
 840                 $fwdfwsettings{'PROT'} = '';
 841         }
 842         #ATTENTION: $fwdfwsetting{'TGT_PROT'} deprecated since 30.09.2013
 843         $fwdfwsettings{'TGT_PROT'}=''; #Set field empty (deprecated)
 844         #Check ICMP Types
 845         if ($fwdfwsettings{'PROT'} eq 'ICMP'){
 846                 $fwdfwsettings{'USE_SRC_PORT'}='';
 847                 $fwdfwsettings{'SRC_PORT'}='';
 848                 #$fwdfwsettings{'USESRV'}='';
 849                 $fwdfwsettings{'TGT_PORT'}='';
 850                 &General::readhasharray("${General::swroot}/fwhosts/icmp-types", \%icmptypes);
 851                 foreach my $key (keys %icmptypes){
 852                         if($fwdfwsettings{'ICMP_TYPES'} eq "$icmptypes{$key}[0] ($icmptypes{$key}[1])"){
 853                                 $fwdfwsettings{'ICMP_TYPES'}="$icmptypes{$key}[0]";
 854                         }
 855                 }
 856         }elsif($fwdfwsettings{'PROT'} eq 'GRE'){
 857                 $fwdfwsettings{'USE_SRC_PORT'}='';
 858                 $fwdfwsettings{'SRC_PORT'}='';
 859                 $fwdfwsettings{'ICMP_TYPES'}='';
 860                 $fwdfwsettings{'USESRV'}='';
 861                 $fwdfwsettings{'TGT_PORT'}='';
 862         }elsif($fwdfwsettings{'PROT'} eq 'ESP'){
 863                 $fwdfwsettings{'USE_SRC_PORT'}='';
 864                 $fwdfwsettings{'SRC_PORT'}='';
 865                 $fwdfwsettings{'ICMP_TYPES'}='';
 866                 $fwdfwsettings{'USESRV'}='';
 867                 $fwdfwsettings{'TGT_PORT'}='';
 868         }elsif($fwdfwsettings{'PROT'} eq 'AH'){
 869                 $fwdfwsettings{'USE_SRC_PORT'}='';
 870                 $fwdfwsettings{'SRC_PORT'}='';
 871                 $fwdfwsettings{'ICMP_TYPES'}='';
 872                 $fwdfwsettings{'USESRV'}='';
 873                 $fwdfwsettings{'TGT_PORT'}='';
 874         }elsif($fwdfwsettings{'PROT'} eq 'IGMP'){
 875                 $fwdfwsettings{'USE_SRC_PORT'}='';
 876                 $fwdfwsettings{'SRC_PORT'}='';
 877                 $fwdfwsettings{'ICMP_TYPES'}='';
 878                 $fwdfwsettings{'USESRV'}='';
 879                 $fwdfwsettings{'TGT_PORT'}='';
 880         }elsif($fwdfwsettings{'PROT'} eq 'IPv6'){
 881                 $fwdfwsettings{'USE_SRC_PORT'}='';
 882                 $fwdfwsettings{'SRC_PORT'}='';
 883                 $fwdfwsettings{'ICMP_TYPES'}='';
 884                 $fwdfwsettings{'USESRV'}='';
 885                 $fwdfwsettings{'TGT_PORT'}='';
 886         }elsif($fwdfwsettings{'PROT'} eq 'IPIP'){
 887                 $fwdfwsettings{'USE_SRC_PORT'}='';
 888                 $fwdfwsettings{'SRC_PORT'}='';
 889                 $fwdfwsettings{'ICMP_TYPES'}='';
 890                 $fwdfwsettings{'USESRV'}='';
 891                 $fwdfwsettings{'TGT_PORT'}='';
 892         }elsif($fwdfwsettings{'PROT'} ne 'TCP' && $fwdfwsettings{'PROT'} ne 'UDP'){
 893                 $fwdfwsettings{'ICMP_TYPES'}='';
 894                 $fwdfwsettings{'SRC_PORT'}='';
 895                 $fwdfwsettings{'TGT_PORT'}='';
 896         }elsif($fwdfwsettings{'PROT'} ne 'ICMP'){
 897                 $fwdfwsettings{'ICMP_TYPES'}='';
 898         }
 899 }
 900 sub checkvpn
 901 {
 902         my $ip=shift;
 903         #Test if manual IP is part of static OpenVPN networks
 904         &General::readhasharray("$configccdnet", \%ccdnet);
 905         foreach my $key (sort keys %ccdnet){
 906                 my ($vpnip,$vpnsubnet) = split ("/",$ccdnet{$key}[1]);
 907                 my $sub=&General::iporsubtodec($vpnsubnet);
 908                 if (&General::IpInSubnet($ip,$vpnip,$sub)){
 909                         return 0;
 910                 }
 911         }
 912         # A Test if manual ip is part of dynamic openvpn subnet is made in getcolor
 913         # because if one creates a custom host with the ip, we need to check the color there!
 914         # It does not make sense to check this here
 915
 916         # Test if manual IP is part of an OpenVPN N2N subnet does also not make sense here
 917         # Is also checked in getcolor
 918
 919         # Test if manual ip is part of an IPsec Network is also checked in getcolor
 920         return 1;
 921 }
 922 sub checkvpncolor
 923 {
 924
 925 }
 926 sub deleterule
 927 {
 928         my %delhash=();
 929         &General::readhasharray($fwdfwsettings{'config'}, \%delhash);
 930         foreach my $key (sort {$a <=> $b} keys %delhash){
 931                 if ($key >= $fwdfwsettings{'key'}) {
 932                         my $next = $key + 1;
 933                         if (exists $delhash{$next}) {
 934                                 foreach my $i (0 .. $#{$delhash{$next}}) {
 935                                         $delhash{$key}[$i] = $delhash{$next}[$i];
 936                                 }
 937                         }
 938                 }
 939         }
 940         # Remove the very last entry.
 941         my $last_key = (sort {$a <=> $b} keys %delhash)[-1];
 942         delete $delhash{$last_key};
 943
 944         &General::writehasharray($fwdfwsettings{'config'}, \%delhash);
 945         &General::firewall_config_changed();
 946
 947         if($fwdfwsettings{'nobase'} ne 'on'){
 948                 &base;
 949         }
 950 }
 951 sub del_double
 952 {
 953         my %all=();
 954         @all{@_}=1;
 955         return (keys %all);
 956 }
 957 sub disable_rule
 958 {
 959         my $key1=shift;
 960         &General::readhasharray("$configfwdfw", \%configfwdfw);
 961         foreach my $key (sort keys %configfwdfw){
 962                         if ($key eq $key1 ){
 963                         if ($configfwdfw{$key}[2] eq 'ON'){$configfwdfw{$key}[2]='';}
 964                 }
 965         }
 966         &General::writehasharray("$configfwdfw", \%configfwdfw);
 967         &General::firewall_config_changed();
 968 }
 969 sub error
 970 {
 971         if ($errormessage) {
 972                 &Header::openbox('100%', 'left', $Lang::tr{'error messages'});
 973                 print "<class name='base'>$errormessage\n";
 974                 print "&nbsp;</class>\n";
 975                 &Header::closebox();
 976         }
 977 }
 978 sub fillselect
 979 {
 980         my %hash=%{(shift)};
 981         my $val=shift;
 982         my $key;
 983         foreach my $key (sort { ncmp($hash{$a}[0],$hash{$b}[0]) }  keys %hash){
 984                 if($hash{$key}[0] eq $val){
 985                         print"<option value='$hash{$key}[0]' selected>$hash{$key}[0]</option>";
 986                 }else{
 987                         print"<option value='$hash{$key}[0]'>$hash{$key}[0]</option>";
 988                 }
 989         }
 990 }
 991 sub gen_dd_block
 992 {
 993         my $srctgt = shift;
 994         my $grp=shift;
 995         my $helper='';
 996         my $show='';
 997         $checked{'grp1'}{$fwdfwsettings{'grp1'}}                                = 'CHECKED';
 998         $checked{'grp2'}{$fwdfwsettings{'grp2'}}                                = 'CHECKED';
 999         $checked{'grp3'}{$fwdfwsettings{'grp3'}}                                = 'CHECKED';
1000         $checked{'USE_SRC_PORT'}{$fwdfwsettings{'USE_SRC_PORT'}} = 'CHECKED';
1001         $checked{'USESRV'}{$fwdfwsettings{'USESRV'}}                    = 'CHECKED';
1002         $checked{'ACTIVE'}{$fwdfwsettings{'ACTIVE'}}                    = 'CHECKED';
1003         $checked{'LOG'}{$fwdfwsettings{'LOG'}}                                  = 'CHECKED';
1004         $checked{'TIME'}{$fwdfwsettings{'TIME'}}                                = 'CHECKED';
1005         $checked{'TIME_MON'}{$fwdfwsettings{'TIME_MON'}}                = 'CHECKED';
1006         $checked{'TIME_TUE'}{$fwdfwsettings{'TIME_TUE'}}                = 'CHECKED';
1007         $checked{'TIME_WED'}{$fwdfwsettings{'TIME_WED'}}                = 'CHECKED';
1008         $checked{'TIME_THU'}{$fwdfwsettings{'TIME_THU'}}                = 'CHECKED';
1009         $checked{'TIME_FRI'}{$fwdfwsettings{'TIME_FRI'}}                = 'CHECKED';
1010         $checked{'TIME_SAT'}{$fwdfwsettings{'TIME_SAT'}}                = 'CHECKED';
1011         $checked{'TIME_SUN'}{$fwdfwsettings{'TIME_SUN'}}                = 'CHECKED';
1012         $selected{'TIME_FROM'}{$fwdfwsettings{'TIME_FROM'}}             = 'selected';
1013         $selected{'TIME_TO'}{$fwdfwsettings{'TIME_TO'}}                 = 'selected';
1014         $selected{'ipfire'}{$fwdfwsettings{$fwdfwsettings{'grp1'}}} ='selected';
1015         $selected{'ipfire'}{$fwdfwsettings{$fwdfwsettings{'grp2'}}} ='selected';
1016 print<<END;
1017                 <table width='100%' border='0'>
1018                 <tr><td width='50%' valign='top'>
1019                 <table width='95%' border='0'>
1020                 <tr><td width='1%'><input type='radio' name='$grp' id='std_net_$srctgt' value='std_net_$srctgt' $checked{$grp}{'std_net_'.$srctgt}></td><td>$Lang::tr{'fwhost stdnet'}</td><td align='right'><select name='std_net_$srctgt' style='width:200px;'>
1021 END
1022         foreach my $network (sort keys %defaultNetworks)
1023                 {
1024                         next if($defaultNetworks{$network}{'NAME'} eq "IPFire");
1025                         print "<option value='$defaultNetworks{$network}{'NAME'}'";
1026                         print " selected='selected'" if ($fwdfwsettings{$fwdfwsettings{$grp}} eq $defaultNetworks{$network}{'NAME'});
1027                         my $defnet="$defaultNetworks{$network}{'NAME'}_NETADDRESS";
1028                         my $defsub="$defaultNetworks{$network}{'NAME'}_NETMASK";
1029                         my $defsub1=&General::subtocidr($ifaces{$defsub});
1030                         $ifaces{$defnet}='' if ($defaultNetworks{$network}{'NAME'} eq 'RED');
1031                         if ($ifaces{$defnet}){
1032                                 print ">$network ($ifaces{$defnet}/$defsub1)</option>";
1033                         }else{
1034                                 print ">$network</option>";
1035                         }
1036                 }
1037         print"</select></td></tr>";
1038         #custom networks
1039         if (! -z $confignet || $optionsfw{'SHOWDROPDOWN'} eq 'on'){
1040                 print"<tr><td><input type='radio' name='$grp' id='cust_net_$srctgt' value='cust_net_$srctgt' $checked{$grp}{'cust_net_'.$srctgt}></td><td>$Lang::tr{'fwhost cust net'}</td><td align='right'><select name='cust_net_$srctgt' style='width:200px;'>";
1041                 &fillselect(\%customnetwork,$fwdfwsettings{$fwdfwsettings{$grp}});
1042                 print"</select></td>";
1043         }
1044         #custom hosts
1045         if (! -z $confighost || $optionsfw{'SHOWDROPDOWN'} eq 'on'){
1046                 print"<tr><td><input type='radio' name='$grp' id='cust_host_$srctgt' value='cust_host_$srctgt' $checked{$grp}{'cust_host_'.$srctgt}></td><td>$Lang::tr{'fwhost cust addr'}</td><td align='right'><select name='cust_host_$srctgt' style='width:200px;'>";
1047                 &fillselect(\%customhost,$fwdfwsettings{$fwdfwsettings{$grp}});
1048                 print"</select></td>";
1049         }
1050         #custom groups
1051         if (! -z $configgrp || $optionsfw{'SHOWDROPDOWN'} eq 'on'){
1052                 print"<tr><td valign='top'><input type='radio' name='$grp' id='cust_grp_$srctgt' value='cust_grp_$srctgt' $checked{$grp}{'cust_grp_'.$srctgt}></td><td >$Lang::tr{'fwhost cust grp'}</td><td align='right'><select name='cust_grp_$srctgt' style='width:200px;'>";
1053                 foreach my $key (sort { ncmp($customgrp{$a}[0],$customgrp{$b}[0]) } keys %customgrp) {
1054                         if($helper ne $customgrp{$key}[0] && $customgrp{$key}[2] ne 'none'){
1055                                 print"<option ";
1056                                 print "selected='selected' " if ($fwdfwsettings{$fwdfwsettings{$grp}} eq $customgrp{$key}[0]);
1057                                 print ">$customgrp{$key}[0]</option>";
1058                         }
1059                         $helper=$customgrp{$key}[0];
1060                 }
1061                 print"</select></td>";
1062         }
1063         #End left table. start right table (vpn)
1064         print"</tr></table></td><td valign='top'><table width='95%' border='0' align='right'><tr>";
1065         # CCD networks
1066         if( ! -z $configccdnet || $optionsfw{'SHOWDROPDOWN'} eq 'on'){
1067                 print"<td width='1%'><input type='radio' name='$grp' id='ovpn_net_$srctgt' value='ovpn_net_$srctgt'  $checked{$grp}{'ovpn_net_'.$srctgt}></td><td nowrap='nowrap' width='16%'>$Lang::tr{'fwhost ccdnet'}</td><td nowrap='nowrap' width='1%' align='right'><select name='ovpn_net_$srctgt' style='width:200px;'>";
1068                 &fillselect(\%ccdnet,$fwdfwsettings{$fwdfwsettings{$grp}});
1069                 print"</select></td></tr>";
1070         }
1071         #OVPN CCD Hosts
1072         foreach my $key (sort { ncmp($ccdhost{$a}[0],$ccdhost{$b}[0]) } keys %ccdhost){
1073                 if ($ccdhost{$key}[33] ne '' ){
1074                         print"<tr><td width='1%'><input type='radio' name='$grp' id='ovpn_host_$srctgt' value='ovpn_host_$srctgt' $checked{$grp}{'ovpn_host_'.$srctgt}></td><td nowrap='nowrap' width='16%'>$Lang::tr{'fwhost ccdhost'}</td><td nowrap='nowrap' width='1%' align='right'><select name='ovpn_host_$srctgt' style='width:200px;'>" if ($show eq '');
1075                         $show='1';
1076                         print "<option value='$ccdhost{$key}[1]'";
1077                         print "selected='selected'" if ($fwdfwsettings{$fwdfwsettings{$grp}} eq $ccdhost{$key}[1]);
1078                         print ">$ccdhost{$key}[1]</option>";
1079                 }
1080         }
1081         if($optionsfw{'SHOWDROPDOWN'} eq 'on' && $show eq ''){
1082                 print"<tr><td width='1%'><input type='radio' name='$grp' id='ovpn_host_$srctgt' value='ovpn_host_$srctgt' $checked{$grp}{'ovpn_host_'.$srctgt}></td><td nowrap='nowrap' width='16%'>$Lang::tr{'fwhost ccdhost'}</td><td nowrap='nowrap' width='1%' align='right'><select name='ovpn_host_$srctgt' style='width:200px;'></select></td></tr>" ;
1083         }
1084         if ($show eq '1'){$show='';print"</select></td></tr>";}
1085         #OVPN N2N
1086         foreach my $key (sort { ncmp($ccdhost{$a}[1],$ccdhost{$b}[1]) } keys %ccdhost){
1087                 if ($ccdhost{$key}[3] eq 'net'){
1088                         print"<tr><td width='1%'><input type='radio' name='$grp' id='ovpn_n2n_$srctgt' value='ovpn_n2n_$srctgt' $checked{$grp}{'ovpn_n2n_'.$srctgt}></td><td nowrap='nowrap' width='16%'>$Lang::tr{'fwhost ovpn_n2n'}:</td><td nowrap='nowrap' width='1%' align='right'><select name='ovpn_n2n_$srctgt' style='width:200px;'>" if ($show eq '');
1089                         $show='1';
1090                         print "<option value='$ccdhost{$key}[1]'";
1091                         print "selected='selected'" if ($fwdfwsettings{$fwdfwsettings{$grp}} eq $ccdhost{$key}[1]);
1092                         print ">$ccdhost{$key}[1]</option>";
1093                 }
1094         }
1095         if($optionsfw{'SHOWDROPDOWN'} eq 'on' && $show eq ''){
1096                 print"<tr><td width='1%'><input type='radio' name='$grp' id='ovpn_n2n_$srctgt' value='ovpn_n2n_$srctgt' $checked{$grp}{'ovpn_n2n_'.$srctgt}></td><td nowrap='nowrap' width='16%'>$Lang::tr{'fwhost ovpn_n2n'}</td><td nowrap='nowrap' width='1%' align='right'><select name='ovpn_n2n_$srctgt' style='width:200px;'></select></td></tr>" ;
1097         }
1098         if ($show eq '1'){$show='';print"</select></td></tr>";}
1099         #IPsec netze
1100         foreach my $key (sort { ncmp($ipsecconf{$a}[1],$ipsecconf{$b}[1]) } keys %ipsecconf) {
1101                 if ($ipsecconf{$key}[3] eq 'net' || ($optionsfw{'SHOWDROPDOWN'} eq 'on' && $ipsecconf{$key}[3] ne 'host')){
1102                         print"<tr><td valign='top'><input type='radio' name='$grp' value='ipsec_net_$srctgt' $checked{$grp}{'ipsec_net_'.$srctgt}></td><td >$Lang::tr{'fwhost ipsec net'}</td><td align='right'><select name='ipsec_net_$srctgt' style='width:200px;'>" if ($show eq '');
1103                         $show='1';
1104                         print "<option ";
1105                         print "selected='selected'" if ($fwdfwsettings{$fwdfwsettings{$grp}} eq $ipsecconf{$key}[1]);
1106                         print ">$ipsecconf{$key}[1]</option>";
1107                 }
1108         }
1109         if($optionsfw{'SHOWDROPDOWN'} eq 'on' && $show eq ''){
1110                 print"<tr><td valign='top'><input type='radio' name='$grp' id='ipsec_net_$srctgt' value='ipsec_net_$srctgt' $checked{$grp}{'ipsec_net_'.$srctgt}></td><td >$Lang::tr{'fwhost ipsec net'}</td><td align='right'><select name='ipsec_net_$srctgt' style='width:200px;'><select></td></tr>";
1111         }
1112         if ($show eq '1'){$show='';print"</select></td></tr>";}
1113
1114         print"</table>";
1115         print"</td></tr></table><br>";
1116 }
1117 sub get_ip
1118 {
1119         my $val=shift;
1120         my $grp =shift;
1121         my $a;
1122         my $b;
1123         &General::readhash("/var/ipfire/ethernet/settings", \%netsettings);
1124         if ($fwdfwsettings{$grp} ne $Lang::tr{'fwhost any'}){
1125                 if ($fwdfwsettings{$grp} eq $val.'_addr'){
1126                         ($a,$b)   = split (/\//, $fwdfwsettings{$fwdfwsettings{$grp}});
1127                 }elsif($fwdfwsettings{$grp} eq 'std_net_'.$val){
1128                         if ($fwdfwsettings{$fwdfwsettings{$grp}} =~ /Gr/i){
1129                                 $a=$netsettings{'GREEN_NETADDRESS'};
1130                                 $b=&General::iporsubtocidr($netsettings{'GREEN_NETMASK'});
1131                         }elsif($fwdfwsettings{$fwdfwsettings{$grp}} =~ /Ora/i){
1132                                 $a=$netsettings{'ORANGE_NETADDRESS'};
1133                                 $b=&General::iporsubtocidr($netsettings{'ORANGE_NETMASK'});
1134                         }elsif($fwdfwsettings{$fwdfwsettings{$grp}} =~ /Bl/i){
1135                                 $a=$netsettings{'BLUE_NETADDRESS'};
1136                                 $b=&General::iporsubtocidr($netsettings{'BLUE_NETMASK'});
1137                         }elsif($fwdfwsettings{$fwdfwsettings{$grp}} =~ /OpenVPN/i){
1138                                 &General::readhash("$configovpn",\%ovpnsettings);
1139                                 ($a,$b)   = split (/\//, $ovpnsettings{'DOVPN_SUBNET'});
1140                                 $b=&General::iporsubtocidr($b);
1141                         }
1142                 }elsif($fwdfwsettings{$grp} eq 'cust_net_'.$val){
1143                         &General::readhasharray("$confignet", \%customnetwork);
1144                         foreach my $key (keys %customnetwork){
1145                                 if($customnetwork{$key}[0] eq $fwdfwsettings{$fwdfwsettings{$grp}}){
1146                                         $a=$customnetwork{$key}[1];
1147                                         $b=&General::iporsubtocidr($customnetwork{$key}[2]);
1148                                 }
1149                         }
1150                 }elsif($fwdfwsettings{$grp} eq 'cust_host_'.$val){
1151                         &General::readhasharray("$confighost", \%customhost);
1152                         foreach my $key (keys %customhost){
1153                                 if($customhost{$key}[0] eq $fwdfwsettings{$fwdfwsettings{$grp}}){
1154                                         if ($customhost{$key}[1] eq 'ip'){
1155                                                 ($a,$b)=split (/\//,$customhost{$key}[2]);
1156                                                 $b=&General::iporsubtocidr($b);
1157                                         }else{
1158                                                 if ($grp eq 'grp2'){
1159                                                         $errormessage=$Lang::tr{'fwdfw err tgt_mac'};
1160                                                 }
1161                                         }
1162                                 }
1163                         }
1164                 }
1165         }
1166         return $a,$b;
1167 }
1168 sub get_name
1169 {
1170         my $val=shift;
1171         &General::setup_default_networks(\%defaultNetworks);
1172         foreach my $network (sort keys %defaultNetworks)
1173         {
1174                 return "$network" if ($val eq $defaultNetworks{$network}{'NAME'});
1175         }
1176 }
1177 sub getsrcport
1178 {
1179         my %hash=%{(shift)};
1180         my $key=shift;
1181         if($hash{$key}[7] eq 'ON' && $hash{$key}[10]){
1182                 $hash{$key}[10]=~ s/\|/,/g;
1183                 print": $hash{$key}[10]";
1184         }elsif($hash{$key}[7] eq 'ON' && $hash{$key}[8] eq 'ICMP'){
1185                 print": <br>$hash{$key}[9] ";
1186         }
1187 }
1188 sub gettgtport
1189 {
1190         my %hash=%{(shift)};
1191         my $key=shift;
1192         my $service;
1193         my $prot;
1194         if($hash{$key}[11] eq 'ON' && $hash{$key}[12] ne 'ICMP'){
1195                 if($hash{$key}[14] eq 'cust_srv'){
1196                         &General::readhasharray("$configsrv", \%customservice);
1197                         foreach my $i (sort keys %customservice){
1198                                 if($customservice{$i}[0] eq $hash{$key}[15]){
1199                                         $service = $customservice{$i}[0];
1200                                 }
1201                         }
1202                 }elsif($hash{$key}[14] eq 'cust_srvgrp'){
1203                         $service=$hash{$key}[15];
1204                 }elsif($hash{$key}[14] eq 'TGT_PORT'){
1205                         $hash{$key}[15]=~ s/\|/,/g;
1206                         $service=$hash{$key}[15];
1207                 }
1208                 if($service){
1209                         print": $service";
1210                 }
1211         }
1212 }
1213 sub get_serviceports
1214 {
1215         my $type=shift;
1216         my $name=shift;
1217         &General::readhasharray("$configsrv", \%customservice);
1218         &General::readhasharray("$configsrvgrp", \%customservicegrp);
1219         @protocols=();
1220         my @specprot=("IPIP","IPV6","IGMP","GRE","AH","ESP");
1221         if($type eq 'service'){
1222                 foreach my $key (sort { ncmp($customservice{$a}[0],$customservice{$b}[0]) } keys %customservice){
1223                         if ($customservice{$key}[0] eq $name){
1224                                 push (@protocols,$customservice{$key}[2]);
1225                         }
1226                 }
1227         }elsif($type eq 'group'){
1228                 foreach my $key (sort { ncmp($customservicegrp{$a}[0],$customservicegrp{$b}[0]) } keys %customservicegrp){
1229                         if ($customservicegrp{$key}[0] eq $name){
1230                                 if ($customservicegrp{$key}[2] ~~ @specprot){
1231                                         push (@protocols," ".$customservicegrp{$key}[2]);
1232                                 }else{
1233                                         foreach my $key1 (sort { ncmp($customservice{$a}[0],$customservice{$b}[0]) } keys %customservice){
1234                                                 if ($customservice{$key1}[0] eq $customservicegrp{$key}[2]){
1235                                                         if (!grep(/$customservice{$key1}[2]/, @protocols)){
1236                                                                 push (@protocols,$customservice{$key1}[2]);}
1237                                                 }
1238                                         }
1239                                 }
1240                         }
1241                 }
1242         }
1243
1244         # Sort protocols alphabetically.
1245         @protocols = sort(@protocols);
1246
1247         return @protocols;
1248 }
1249 sub getcolor
1250 {
1251         my $nettype=shift;
1252         my $val=shift;
1253         my $hash=shift;
1254         if($optionsfw{'SHOWCOLORS'} eq 'on'){
1255                 # Don't colourise MAC addresses
1256                 if (&General::validmac($val)) {
1257                         $tdcolor = "";
1258                         return;
1259                 }
1260
1261                 #custom Hosts
1262                 if ($nettype eq 'cust_host_src' || $nettype eq 'cust_host_tgt'){
1263                         foreach my $key (sort keys %$hash){
1264                                 if ($$hash{$key}[0] eq $val){
1265                                         $val=$$hash{$key}[2];
1266                                 }
1267                         }
1268                 }
1269                 #standard networks
1270                 if ($val eq 'GREEN'){
1271                         $tdcolor="style='background-color: $Header::colourgreen;color:white;'";
1272                         return;
1273                 }elsif ($val eq 'ORANGE'){
1274                         $tdcolor="style='background-color:  $Header::colourorange;color:white;'";
1275                         return;
1276                 }elsif ($val eq 'BLUE'){
1277                         $tdcolor="style='background-color: $Header::colourblue;color:white;'";
1278                         return;
1279                 }elsif ($val eq 'RED' ||$val eq 'RED1' ){
1280                         $tdcolor="style='background-color: $Header::colourred;color:white;'";
1281                         return;
1282                 }elsif ($val eq 'IPFire' ){
1283                         $tdcolor="style='background-color: $Header::colourred;color:white;'";
1284                         return;
1285                 }elsif ($val eq 'OpenVPN-Dyn' ){
1286                         $tdcolor="style='background-color: $Header::colourovpn;color:white;'";
1287                         return;
1288                 }elsif ($val eq 'IPsec RW' ){
1289                         $tdcolor="style='background-color: $Header::colourvpn;color:white;'";
1290                         return;
1291                 }elsif($val =~ /^(.*?)\/(.*?)$/){
1292                         my ($sip,$scidr) = split ("/",$val);
1293                         if ( &Header::orange_used() && &General::IpInSubnet($sip,$netsettings{'ORANGE_ADDRESS'},$netsettings{'ORANGE_NETMASK'})){
1294                                 $tdcolor="style='background-color: $Header::colourorange;color:white;'";
1295                                 return;
1296                         }
1297                         if ( &General::IpInSubnet($sip,$netsettings{'GREEN_ADDRESS'},$netsettings{'GREEN_NETMASK'})){
1298                                 $tdcolor="style='background-color: $Header::colourgreen;color:white;'";
1299                                 return;
1300                         }
1301                         if ( &Header::blue_used() && &General::IpInSubnet($sip,$netsettings{'BLUE_ADDRESS'},$netsettings{'BLUE_NETMASK'})){
1302                                 $tdcolor="style='background-color: $Header::colourblue;color:white;'";
1303                                 return;
1304                         }
1305                 }elsif ($val eq 'Default IP'){
1306                         $tdcolor="style='background-color: $Header::colourred;color:white;'";
1307                         return;
1308                 }
1309                 #Check if a manual IP or custom host is part of a VPN
1310                 if ($nettype eq 'src_addr' || $nettype eq 'tgt_addr' || $nettype eq 'cust_host_src' || $nettype eq 'cust_host_tgt'){
1311                         #Check if IP is part of OpenVPN dynamic subnet
1312                         my ($a,$b) = split("/",$ovpnsettings{'DOVPN_SUBNET'});
1313                         my ($c,$d) = split("/",$val);
1314                         if (&General::IpInSubnet($c,$a,$b)){
1315                                 $tdcolor="style='background-color: $Header::colourovpn;color:white;'";
1316                                 return;
1317                         }
1318                         #Check if IP is part of OpenVPN static subnet
1319                         foreach my $key (sort keys %ccdnet){
1320                                 my ($a,$b) = split("/",$ccdnet{$key}[1]);
1321                                 $b =&General::iporsubtodec($b);
1322                                 if (&General::IpInSubnet($c,$a,$b)){
1323                                         $tdcolor="style='background-color: $Header::colourovpn;color:white;'";
1324                                         return;
1325                                 }
1326                         }
1327                         #Check if IP is part of OpenVPN N2N subnet
1328                         foreach my $key (sort keys %ccdhost){
1329                                 if ($ccdhost{$key}[3] eq 'net'){
1330                                         my ($a,$b) = split("/",$ccdhost{$key}[11]);
1331                                         if (&General::IpInSubnet($c,$a,$b)){
1332                                                 $tdcolor="style='background-color: $Header::colourovpn;color:white;'";
1333                                                 return;
1334                                         }
1335                                 }
1336                         }
1337                         #Check if IP is part of IPsec RW network
1338                         if ($ipsecsettings{'RW_NET'} ne ''){
1339                                 my ($a,$b) = split("/",$ipsecsettings{'RW_NET'});
1340                                 $b=&General::iporsubtodec($b);
1341                                 if (&General::IpInSubnet($c,$a,$b)){
1342                                         $tdcolor="style='background-color: $Header::colourvpn;color:white;'";
1343                                         return;
1344                                 }
1345                         }
1346                         #Check if IP is part of a IPsec N2N network
1347                         foreach my $key (sort keys %ipsecconf){
1348                                 if ($ipsecconf{$key}[11]){
1349                                         my ($a,$b) = split("/",$ipsecconf{$key}[11]);
1350                                         $b=&General::iporsubtodec($b);
1351                                         if (&General::IpInSubnet($c,$a,$b)){
1352                                                 $tdcolor="style='background-color: $Header::colourvpn;color:white;'";
1353                                                 return;
1354                                         }
1355                                 }
1356                         }
1357                 }
1358                 #VPN networks
1359                 if ($nettype eq 'ovpn_n2n_src' || $nettype eq 'ovpn_n2n_tgt' || $nettype eq 'ovpn_net_src' || $nettype eq 'ovpn_net_tgt'|| $nettype eq 'ovpn_host_src' || $nettype eq 'ovpn_host_tgt'){
1360                         $tdcolor="style='background-color: $Header::colourovpn;color:white;'";
1361                         return;
1362                 }
1363                 if ($nettype eq 'ipsec_net_src' || $nettype eq 'ipsec_net_tgt'){
1364                         $tdcolor="style='background-color: $Header::colourvpn;color:white;'";
1365                         return;
1366                 }
1367                 #ALIASE
1368                 foreach my $alias (sort keys %aliases)
1369                 {
1370                         if ($val eq $alias){
1371                                 $tdcolor="style='background-color:$Header::colourred;color:white;'";
1372                                 return;
1373                         }
1374                 }
1375         }
1376         $tdcolor='';
1377         return;
1378 }
1379 sub hint
1380 {
1381         if ($hint) {
1382                 &Header::openbox('100%', 'left', $Lang::tr{'fwhost hint'});
1383                 print "<class name='base'>$hint\n";
1384                 print "&nbsp;</class>\n";
1385                 &Header::closebox();
1386         }
1387 }
1388 sub newrule
1389 {
1390         &error;
1391         &General::setup_default_networks(\%defaultNetworks);
1392         &General::readhash("/var/ipfire/ethernet/settings", \%netsettings);
1393         #read all configfiles
1394         &General::readhasharray("$configccdnet", \%ccdnet);
1395         &General::readhasharray("$confignet", \%customnetwork);
1396         &General::readhasharray("$configccdhost", \%ccdhost);
1397         &General::readhasharray("$confighost", \%customhost);
1398         &General::readhasharray("$configccdhost", \%ccdhost);
1399         &General::readhasharray("$configgrp", \%customgrp);
1400         &General::readhasharray("$configipsec", \%ipsecconf);
1401         &General::get_aliases(\%aliases);
1402         my %checked=();
1403         my $helper;
1404         my $sum=0;
1405         if($fwdfwsettings{'config'} eq ''){$fwdfwsettings{'config'}=$configfwdfw;}
1406         my $config=$fwdfwsettings{'config'};
1407         my %hash=();
1408         #Get Red IP-ADDRESS
1409         open (CONN1,"/var/ipfire/red/local-ipaddress");
1410         my $redip = <CONN1>;
1411         close(CONN1);
1412         if (! $fwdfwsettings{'RULE_ACTION'} && $fwdfwsettings{'POLICY'} eq 'MODE2'){
1413                 $fwdfwsettings{'RULE_ACTION'}='DROP';
1414         }elsif(! $fwdfwsettings{'RULE_ACTION'} && $fwdfwsettings{'POLICY'} eq 'MODE1'){
1415                 $fwdfwsettings{'RULE_ACTION'}='ACCEPT';
1416         }
1417         $checked{'grp1'}{$fwdfwsettings{'grp1'}}                                = 'CHECKED';
1418         $checked{'grp2'}{$fwdfwsettings{'grp2'}}                                = 'CHECKED';
1419         $checked{'grp3'}{$fwdfwsettings{'grp3'}}                                = 'CHECKED';
1420         $checked{'USE_SRC_PORT'}{$fwdfwsettings{'USE_SRC_PORT'}} = 'CHECKED';
1421         $checked{'USESRV'}{$fwdfwsettings{'USESRV'}}                    = 'CHECKED';
1422         $checked{'ACTIVE'}{$fwdfwsettings{'ACTIVE'}}                    = 'CHECKED';
1423         $checked{'LOG'}{$fwdfwsettings{'LOG'}}                                  = 'CHECKED';
1424         $checked{'TIME'}{$fwdfwsettings{'TIME'}}                                = 'CHECKED';
1425         $checked{'TIME_MON'}{$fwdfwsettings{'TIME_MON'}}                = 'CHECKED';
1426         $checked{'TIME_TUE'}{$fwdfwsettings{'TIME_TUE'}}                = 'CHECKED';
1427         $checked{'TIME_WED'}{$fwdfwsettings{'TIME_WED'}}                = 'CHECKED';
1428         $checked{'TIME_THU'}{$fwdfwsettings{'TIME_THU'}}                = 'CHECKED';
1429         $checked{'TIME_FRI'}{$fwdfwsettings{'TIME_FRI'}}                = 'CHECKED';
1430         $checked{'TIME_SAT'}{$fwdfwsettings{'TIME_SAT'}}                = 'CHECKED';
1431         $checked{'TIME_SUN'}{$fwdfwsettings{'TIME_SUN'}}                = 'CHECKED';
1432         $checked{'USE_NAT'}{$fwdfwsettings{'USE_NAT'}}                  = 'CHECKED';
1433         $selected{'TIME_FROM'}{$fwdfwsettings{'TIME_FROM'}}             = 'selected';
1434         $selected{'TIME_TO'}{$fwdfwsettings{'TIME_TO'}}                 = 'selected';
1435         $selected{'ipfire'}{$fwdfwsettings{$fwdfwsettings{'grp2'}}} ='selected';
1436         $selected{'ipfire_src'}{$fwdfwsettings{$fwdfwsettings{'grp1'}}} ='selected';
1437         #check if update and get values
1438         if($fwdfwsettings{'updatefwrule'} eq 'on' || $fwdfwsettings{'copyfwrule'} eq 'on' && !$errormessage){
1439                 &General::readhasharray("$config", \%hash);
1440                 foreach my $key (sort keys %hash){
1441                         $sum++;
1442                         if ($key eq $fwdfwsettings{'key'}){
1443                                 $fwdfwsettings{'oldrulenumber'}                 = $fwdfwsettings{'key'};
1444                                 $fwdfwsettings{'RULE_ACTION'}                   = $hash{$key}[0];
1445                                 $fwdfwsettings{'chain'}                                 = $hash{$key}[1];
1446                                 $fwdfwsettings{'ACTIVE'}                                = $hash{$key}[2];
1447                                 $fwdfwsettings{'grp1'}                                  = $hash{$key}[3];
1448                                 $fwdfwsettings{$fwdfwsettings{'grp1'}}  = $hash{$key}[4];
1449                                 $fwdfwsettings{'grp2'}                                  = $hash{$key}[5];
1450                                 $fwdfwsettings{$fwdfwsettings{'grp2'}}  = $hash{$key}[6];
1451                                 $fwdfwsettings{'USE_SRC_PORT'}                  = $hash{$key}[7];
1452                                 $fwdfwsettings{'PROT'}                                  = $hash{$key}[8];
1453                             $fwdfwsettings{'ICMP_TYPES'}                        = $hash{$key}[9];
1454                             $fwdfwsettings{'SRC_PORT'}                          = $hash{$key}[10];
1455                             $fwdfwsettings{'USESRV'}                            = $hash{$key}[11];
1456                             $fwdfwsettings{'TGT_PROT'}                          = $hash{$key}[12];
1457                             $fwdfwsettings{'ICMP_TGT'}                          = $hash{$key}[13];
1458                             $fwdfwsettings{'grp3'}                                      = $hash{$key}[14];
1459                             $fwdfwsettings{$fwdfwsettings{'grp3'}}      = $hash{$key}[15];
1460                             $fwdfwsettings{'ruleremark'}                        = $hash{$key}[16];
1461                             $fwdfwsettings{'LOG'}                                       = $hash{$key}[17];
1462                             $fwdfwsettings{'TIME'}                                      = $hash{$key}[18];
1463                                 $fwdfwsettings{'TIME_MON'}                              = $hash{$key}[19];
1464                                 $fwdfwsettings{'TIME_TUE'}                              = $hash{$key}[20];
1465                                 $fwdfwsettings{'TIME_WED'}                              = $hash{$key}[21];
1466                                 $fwdfwsettings{'TIME_THU'}                              = $hash{$key}[22];
1467                                 $fwdfwsettings{'TIME_FRI'}                              = $hash{$key}[23];
1468                                 $fwdfwsettings{'TIME_SAT'}                              = $hash{$key}[24];
1469                                 $fwdfwsettings{'TIME_SUN'}                              = $hash{$key}[25];
1470                                 $fwdfwsettings{'TIME_FROM'}                             = $hash{$key}[26];
1471                                 $fwdfwsettings{'TIME_TO'}                               = $hash{$key}[27];
1472                                 $fwdfwsettings{'USE_NAT'}                               = $hash{$key}[28];
1473                                 $fwdfwsettings{'nat'}                                   = $hash{$key}[31]; #changed order
1474                                 $fwdfwsettings{$fwdfwsettings{'nat'}}   = $hash{$key}[29];
1475                                 $fwdfwsettings{'dnatport'}                              = $hash{$key}[30];
1476                                 $fwdfwsettings{'LIMIT_CON_CON'}                 = $hash{$key}[32];
1477                                 $fwdfwsettings{'concon'}                                = $hash{$key}[33];
1478                                 $fwdfwsettings{'RATE_LIMIT'}                    = $hash{$key}[34];
1479                                 $fwdfwsettings{'ratecon'}                               = $hash{$key}[35];
1480                                 $fwdfwsettings{'RATETIME'}                              = $hash{$key}[36];
1481                                 $checked{'grp1'}{$fwdfwsettings{'grp1'}}                                = 'CHECKED';
1482                                 $checked{'grp2'}{$fwdfwsettings{'grp2'}}                                = 'CHECKED';
1483                                 $checked{'grp3'}{$fwdfwsettings{'grp3'}}                                = 'CHECKED';
1484                                 $checked{'USE_SRC_PORT'}{$fwdfwsettings{'USE_SRC_PORT'}} = 'CHECKED';
1485                                 $checked{'USESRV'}{$fwdfwsettings{'USESRV'}}                    = 'CHECKED';
1486                                 $checked{'ACTIVE'}{$fwdfwsettings{'ACTIVE'}}                    = 'CHECKED';
1487                                 $checked{'LOG'}{$fwdfwsettings{'LOG'}}                                  = 'CHECKED';
1488                                 $checked{'TIME'}{$fwdfwsettings{'TIME'}}                                = 'CHECKED';
1489                                 $checked{'TIME_MON'}{$fwdfwsettings{'TIME_MON'}}                = 'CHECKED';
1490                                 $checked{'TIME_TUE'}{$fwdfwsettings{'TIME_TUE'}}                = 'CHECKED';
1491                                 $checked{'TIME_WED'}{$fwdfwsettings{'TIME_WED'}}                = 'CHECKED';
1492                                 $checked{'TIME_THU'}{$fwdfwsettings{'TIME_THU'}}                = 'CHECKED';
1493                                 $checked{'TIME_FRI'}{$fwdfwsettings{'TIME_FRI'}}                = 'CHECKED';
1494                                 $checked{'TIME_SAT'}{$fwdfwsettings{'TIME_SAT'}}                = 'CHECKED';
1495                                 $checked{'TIME_SUN'}{$fwdfwsettings{'TIME_SUN'}}                = 'CHECKED';
1496                                 $checked{'USE_NAT'}{$fwdfwsettings{'USE_NAT'}}                  = 'CHECKED';
1497                                 $checked{'nat'}{$fwdfwsettings{'nat'}}                                  = 'CHECKED';
1498                                 $checked{'LIMIT_CON_CON'}{$fwdfwsettings{'LIMIT_CON_CON'}}      = 'CHECKED';
1499                                 $checked{'RATE_LIMIT'}{$fwdfwsettings{'RATE_LIMIT'}}    = 'CHECKED';
1500                                 $selected{'TIME_FROM'}{$fwdfwsettings{'TIME_FROM'}}             = 'selected';
1501                                 $selected{'TIME_TO'}{$fwdfwsettings{'TIME_TO'}}                 = 'selected';
1502                                 $selected{'ipfire'}{$fwdfwsettings{$fwdfwsettings{'grp2'}}} ='selected';
1503                                 $selected{'ipfire_src'}{$fwdfwsettings{$fwdfwsettings{'grp1'}}} ='selected';
1504                                 $selected{'dnat'}{$fwdfwsettings{'dnat'}}                               ='selected';
1505                                 $selected{'snat'}{$fwdfwsettings{'snat'}}                               ='selected';
1506                                 $selected{'RATETIME'}{$fwdfwsettings{'RATETIME'}}               ='selected';
1507                         }
1508                 }
1509                 $fwdfwsettings{'oldgrp1a'}=$fwdfwsettings{'grp1'};
1510                 $fwdfwsettings{'oldgrp1b'}=$fwdfwsettings{$fwdfwsettings{'grp1'}};
1511                 $fwdfwsettings{'oldgrp2a'}=$fwdfwsettings{'grp2'};
1512                 $fwdfwsettings{'oldgrp2b'}=$fwdfwsettings{$fwdfwsettings{'grp2'}};
1513                 $fwdfwsettings{'oldgrp3a'}=$fwdfwsettings{'grp3'};
1514                 $fwdfwsettings{'oldgrp3b'}=$fwdfwsettings{$fwdfwsettings{'grp3'}};
1515                 $fwdfwsettings{'oldusesrv'}=$fwdfwsettings{'USESRV'};
1516                 $fwdfwsettings{'oldruleremark'}=$fwdfwsettings{'ruleremark'};
1517                 $fwdfwsettings{'oldnat'}=$fwdfwsettings{'USE_NAT'};
1518                 $fwdfwsettings{'oldruletype'}=$fwdfwsettings{'chain'};
1519                 $fwdfwsettings{'oldconcon'}=$fwdfwsettings{'LIMIT_CON_CON'};
1520                 $fwdfwsettings{'olduseratelimit'}=$fwdfwsettings{'RATE_LIMIT'};
1521                 $fwdfwsettings{'olduseratelimitamount'}=$fwdfwsettings{'ratecon'};
1522                 $fwdfwsettings{'oldratelimittime'}=$fwdfwsettings{'RATETIME'};
1523
1524                 #check if manual ip (source) is orange network
1525                 if ($fwdfwsettings{'grp1'} eq 'src_addr'){
1526                         my ($sip,$scidr) = split("/",$fwdfwsettings{$fwdfwsettings{'grp1'}});
1527                         if ( &General::IpInSubnet($sip,$netsettings{'ORANGE_ADDRESS'},$netsettings{'ORANGE_NETMASK'})){
1528                                 $fwdfwsettings{'oldorange'} ='on';
1529                         }
1530                 }
1531         }else{
1532                 $fwdfwsettings{'ACTIVE'}='ON';
1533                 $fwdfwsettings{'nat'} = 'dnat';
1534                 $checked{'ACTIVE'}{$fwdfwsettings{'ACTIVE'}} = 'CHECKED';
1535                 $checked{'nat'}{$fwdfwsettings{'nat'}} = 'CHECKED';
1536                 $fwdfwsettings{'oldgrp1a'}=$fwdfwsettings{'grp1'};
1537                 $fwdfwsettings{'oldgrp1b'}=$fwdfwsettings{$fwdfwsettings{'grp1'}};
1538                 $fwdfwsettings{'oldgrp2a'}=$fwdfwsettings{'grp2'};
1539                 $fwdfwsettings{'oldgrp2b'}=$fwdfwsettings{$fwdfwsettings{'grp2'}};
1540                 $fwdfwsettings{'oldgrp3a'}=$fwdfwsettings{'grp3'};
1541                 $fwdfwsettings{'oldgrp3b'}=$fwdfwsettings{$fwdfwsettings{'grp3'}};
1542                 $fwdfwsettings{'oldusesrv'}=$fwdfwsettings{'USESRV'};
1543                 $fwdfwsettings{'oldruleremark'}=$fwdfwsettings{'ruleremark'};
1544                 $fwdfwsettings{'oldnat'}=$fwdfwsettings{'USE_NAT'};
1545                 $fwdfwsettings{'oldconcon'}=$fwdfwsettings{'LIMIT_CON_CON'};
1546                 #check if manual ip (source) is orange network
1547                 if ($fwdfwsettings{'grp1'} eq 'src_addr'){
1548                         my ($sip,$scidr) = split("/",$fwdfwsettings{$fwdfwsettings{'grp1'}});
1549                         if ( &General::IpInSubnet($sip,$netsettings{'ORANGE_ADDRESS'},$netsettings{'ORANGE_NETMASK'})){
1550                                 $fwdfwsettings{'oldorange'} ='on';
1551                         }
1552                 }
1553         }
1554         # Split manual source and target address and delete the subnet
1555         my ($sip,$scidr) = split("/",$fwdfwsettings{$fwdfwsettings{'grp1'}});
1556         if ($scidr eq '32'){$fwdfwsettings{$fwdfwsettings{'grp1'}}=$sip;}
1557         my ($dip,$dcidr) = split("/",$fwdfwsettings{$fwdfwsettings{'grp2'}});
1558         if ($dcidr eq '32'){$fwdfwsettings{$fwdfwsettings{'grp2'}}=$dip;}
1559         &Header::openbox('100%', 'left', $Lang::tr{'fwdfw source'});
1560         #------SOURCE-------------------------------------------------------
1561         print "<form method='post'>";
1562         print<<END;
1563                 <table width='100%' border='0'>
1564                 <tr><td width='1%'><input type='radio' name='grp1' value='src_addr'  checked></td><td width='60%'>$Lang::tr{'fwdfw sourceip'}<input type='TEXT' name='src_addr' value='$fwdfwsettings{'src_addr'}' size='16' maxlength='18' ></td><td width='1%'><input type='radio' name='grp1' id='ipfire_src' value='ipfire_src'  $checked{'grp1'}{'ipfire_src'}></td><td><b>Firewall</b></td>
1565 END
1566                 print"<td align='right'><select name='ipfire_src' style='width:200px;'>";
1567                 print "<option value='ALL' $selected{'ipfire_src'}{'ALL'}>$Lang::tr{'all'}</option>";
1568                 print "<option value='GREEN' $selected{'ipfire_src'}{'GREEN'}>$Lang::tr{'green'} ($ifaces{'GREEN_ADDRESS'})</option>" if $ifaces{'GREEN_ADDRESS'};
1569                 print "<option value='ORANGE' $selected{'ipfire_src'}{'ORANGE'}>$Lang::tr{'orange'} ($ifaces{'ORANGE_ADDRESS'})</option>" if (&Header::orange_used());
1570                 print "<option value='BLUE' $selected{'ipfire_src'}{'BLUE'}>$Lang::tr{'blue'} ($ifaces{'BLUE_ADDRESS'})</option>" if (&Header::blue_used());
1571                 print "<option value='RED1' $selected{'ipfire_src'}{'RED1'}>$Lang::tr{'red1'} ($redip)" if ($redip);
1572                 if (! -z "${General::swroot}/ethernet/aliases"){
1573                         foreach my $alias (sort keys %aliases)
1574                         {
1575                                 print "<option value='$alias' $selected{'ipfire_src'}{$alias}>$alias ($aliases{$alias}{'IPT'})</option>";
1576                         }
1577                 }
1578                 print<<END;
1579                 </select></td></tr>
1580                 <tr><td><br></td></tr>
1581                 </table>
1582 END
1583                 &gen_dd_block('src','grp1');
1584                 &Header::closebox();
1585
1586                 #---SNAT / DNAT ------------------------------------------------
1587                 &Header::openbox('100%', 'left', 'NAT');
1588                 print<<END;
1589                         <label>
1590                                 <input type='checkbox' name='USE_NAT' id='USE_NAT' value="ON" $checked{'USE_NAT'}{'ON'}>
1591                                 $Lang::tr{'fwdfw use nat'}
1592                         </label>
1593                         <div class="NAT">
1594                                 <table width='100%' border='0'>
1595                                         <tr>
1596                                                 <td width='5%'></td>
1597                                                 <td width='40%'>
1598                                                         <label>
1599                                                                 <input type='radio' name='nat'  value='dnat' $checked{'nat'}{'dnat'}>
1600                                                                 $Lang::tr{'fwdfw dnat'}
1601                                                         </label>
1602                                                 </td>
1603 END
1604
1605         print <<END;
1606                                                 <td width='25%' align='right'>$Lang::tr{'dnat address'}:</td>
1607                                                 <td width='30%'>
1608                                                         <select name='dnat' style='width: 100%;'>
1609                                                                 <option value='AUTO' $selected{'dnat'}{'AUTO'}>- $Lang::tr{'automatic'} -</option>
1610                                                                 <option value='Default IP' $selected{'dnat'}{'Default IP'}>$Lang::tr{'red1'} ($redip)</option>
1611 END
1612                 if (%aliases) {
1613                         foreach my $alias (sort keys %aliases) {
1614                                 print "<option value='$alias' $selected{'dnat'}{$alias}>$alias ($aliases{$alias}{'IPT'})</option>";
1615                         }
1616                 }
1617                 #DNAT Dropdown
1618                 foreach my $network (sort keys %defaultNetworks)
1619                 {
1620                         if ($defaultNetworks{$network}{'NAME'} eq 'BLUE'||$defaultNetworks{$network}{'NAME'} eq 'GREEN' ||$defaultNetworks{$network}{'NAME'} eq 'ORANGE'){
1621                                 print "<option value='$defaultNetworks{$network}{'NAME'}'";
1622                                 print " selected='selected'" if ($fwdfwsettings{'dnat'} eq $defaultNetworks{$network}{'NAME'});
1623                                 print ">$network ($defaultNetworks{$network}{'NET'})</option>";
1624                         }
1625                 }
1626                 print "</select>";
1627                 print "</tr>";
1628
1629                 #SNAT
1630                 print <<END;
1631                                         <tr>
1632                                                 <td width='5%'></td>
1633                                                 <td width='40%'>
1634                                                         <label>
1635                                                                 <input type='radio' name='nat'  value='snat' $checked{'nat'}{'snat'}>
1636                                                                 $Lang::tr{'fwdfw snat'}
1637                                                         </label>
1638                                                 </td>
1639                                                 <td width='25%' align='right'>$Lang::tr{'snat new source ip address'}:</td>
1640                                                 <td width='30%'>
1641                                                         <select name='snat' style='width: 100%;'>
1642 END
1643
1644                 foreach my $alias (sort keys %aliases) {
1645                         print "<option value='$alias' $selected{'snat'}{$alias}>$alias ($aliases{$alias}{'IPT'})</option>";
1646                 }
1647                 # SNAT Dropdown
1648                 foreach my $network (sort keys %defaultNetworks) {
1649                         if ($defaultNetworks{$network}{'NAME'} eq 'BLUE'||$defaultNetworks{$network}{'NAME'} eq 'GREEN' ||$defaultNetworks{$network}{'NAME'} eq 'ORANGE'){
1650                                 print "<option value='$defaultNetworks{$network}{'NAME'}'";
1651                                 print " selected='selected'" if ($fwdfwsettings{'snat'} eq $defaultNetworks{$network}{'NAME'});
1652                                 print ">$network ($defaultNetworks{$network}{'NET'})</option>";
1653                         }
1654                 }
1655                 print <<END;
1656                                                         </select>
1657                                                 </td>
1658                                         </tr>
1659                                 </table>
1660                         </div>
1661 END
1662                 &Header::closebox();
1663
1664                 #---TARGET------------------------------------------------------
1665                 &Header::openbox('100%', 'left', $Lang::tr{'fwdfw target'});
1666                 print<<END;
1667                 <table width='100%' border='0'>
1668                 <tr><td width='1%'><input type='radio' name='grp2' value='tgt_addr'  checked></td><td width='60%' nowrap='nowrap'>$Lang::tr{'fwdfw targetip'}<input type='TEXT' name='tgt_addr' value='$fwdfwsettings{'tgt_addr'}' size='16' maxlength='18'><td width='1%'><input type='radio' name='grp2' id='ipfire' value='ipfire'  $checked{'grp2'}{'ipfire'}></td><td><b>Firewall</b></td>
1669 END
1670                 print"<td align='right'><select name='ipfire' style='width:200px;'>";
1671                 print "<option value='ALL' $selected{'ipfire'}{'ALL'}>$Lang::tr{'all'}</option>";
1672                 print "<option value='GREEN' $selected{'ipfire'}{'GREEN'}>$Lang::tr{'green'} ($ifaces{'GREEN_ADDRESS'})</option>" if $ifaces{'GREEN_ADDRESS'};
1673                 print "<option value='ORANGE' $selected{'ipfire'}{'ORANGE'}>$Lang::tr{'orange'} ($ifaces{'ORANGE_ADDRESS'})</option>" if (&Header::orange_used());
1674                 print "<option value='BLUE' $selected{'ipfire'}{'BLUE'}>$Lang::tr{'blue'} ($ifaces{'BLUE_ADDRESS'})</option>"if (&Header::blue_used());
1675                 print "<option value='RED1' $selected{'ipfire'}{'RED1'}>$Lang::tr{'red1'} ($redip)" if ($redip);
1676                 if (! -z "${General::swroot}/ethernet/aliases"){
1677                         foreach my $alias (sort keys %aliases)
1678                         {
1679                                 print "<option value='$alias' $selected{'ipfire'}{$alias}>$alias ($aliases{$alias}{'IPT'})</option>";
1680                         }
1681                 }
1682                 print<<END;
1683                 </select></td></tr>
1684                 <tr><td><br></td></tr></table>
1685 END
1686                 &gen_dd_block('tgt','grp2');
1687                 &Header::closebox;
1688                 #---PROTOCOL------------------------------------------------------
1689                 $fwdfwsettings{'SRC_PORT'} =~ s/\|/,/g;
1690                 $fwdfwsettings{'TGT_PORT'} =~ s/\|/,/g;
1691                 $fwdfwsettings{'dnatport'} =~ tr/|/,/;
1692
1693                 # The dnatport may be empty, if it matches TGT_PORT
1694                 if ($fwdfwsettings{'dnatport'} eq $fwdfwsettings{'TGT_PORT'}) {
1695                         $fwdfwsettings{'dnatport'} = "";
1696                 }
1697
1698                 &Header::openbox('100%', 'left', $Lang::tr{'fwhost prot'});
1699                 #Fix Protocol for JQuery
1700                 if ($fwdfwsettings{'grp3'} eq 'cust_srv' || $fwdfwsettings{'grp3'} eq 'cust_srvgrp'){
1701                         $fwdfwsettings{'PROT'} = 'template';
1702                 }
1703                 print<<END;
1704                         <table width='100%' border='0'>
1705                                 <tr>
1706                                         <td width="25%">
1707                                                 <select name='PROT' id='protocol' style="width: 95px;">
1708 END
1709                 print "<option value=\"\"";
1710                 if ($fwdfwsettings{'PROT'} eq '') {
1711                         print " selected=\"selected\"";
1712                 }
1713                 print ">$Lang::tr{'all'}</option>";
1714
1715                 print "<option value=\"template\"";
1716                 print " selected=\"selected\"" if ($fwdfwsettings{'grp3'} eq 'cust_srv' || $fwdfwsettings{'grp3'} eq 'cust_srvgrp');
1717                 print ">- $Lang::tr{'template'} -</option>";
1718
1719                 foreach (@PROTOCOLS) {
1720                         print"<option value=\"$_\"";
1721                         if ($_ eq $fwdfwsettings{'PROT'}) {
1722                                 print " selected=\"selected\"";
1723                         }
1724                         if($_ eq "IPv6"){
1725                                 print ">$Lang::tr{'fwdfw prot41'}</option>";
1726                         }else{
1727                                 print ">$_</option>";
1728                         }
1729                 }
1730
1731                 print<<END;
1732                                                 </select>
1733                                         </td>
1734                                         <td width="75%">
1735                                                 <table width='100%' border='0' id="PROTOCOL_ICMP_TYPES">
1736                                                         <tr>
1737                                                                 <td width='20%'>$Lang::tr{'fwhost icmptype'}</td>
1738                                                                 <td colspan='2'>
1739                                                                         <select name='ICMP_TYPES' style='min-width:230px;'>
1740 END
1741                 &General::readhasharray("${General::swroot}/fwhosts/icmp-types", \%icmptypes);
1742                 print"<option value='All ICMP-Types'>$Lang::tr{'fwdfw all icmp'}</option>";
1743                 foreach my $key (sort { ncmp($icmptypes{$a}[0],$icmptypes{$b}[0]) }keys %icmptypes){
1744                         if($fwdfwsettings{'ICMP_TYPES'} eq "$icmptypes{$key}[0]"){
1745                                 print"<option selected>$icmptypes{$key}[0] ($icmptypes{$key}[1])</option>";
1746                         }else{
1747                                 print"<option>$icmptypes{$key}[0] ($icmptypes{$key}[1])</option>";
1748                         }
1749                 }
1750
1751                 print <<END;
1752                                                                         </select>
1753                                                                 </td>
1754                                                         </tr>
1755                                                 </table>
1756
1757                                                 <table width="100%" border="0" id="PROTOCOL_PORTS">
1758                                                         <tr>
1759                                                                 <!-- #SOURCEPORT -->
1760                                                                 <td>
1761                                                                         $Lang::tr{'fwdfw use srcport'}
1762                                                                 </td>
1763                                                                 <td>
1764                                                                         <input type='text' name='SRC_PORT' value='$fwdfwsettings{'SRC_PORT'}' maxlength='20' size='18'>
1765                                                                 </td>
1766                                                                 <td width='10%'>
1767                                                                 </td>
1768
1769                                                                 <!-- #TARGETPORT -->
1770                                                                 <td>
1771                                                                         $Lang::tr{'fwdfw use srv'}
1772                                                                 </td>
1773
1774                                                                 <td>
1775                                                                         <input type='text' name='TGT_PORT' value='$fwdfwsettings{'TGT_PORT'}' maxlength='20' size='18'>
1776                                                                 </td>
1777                                                         </tr>
1778                                                         <tr class="NAT">
1779                                                                 <td colspan='3'></td>
1780                                                                 <td>$Lang::tr{'fwdfw external port nat'}:</td>
1781                                                                 <td>
1782                                                                         <input type='text' name='dnatport' value=\"$fwdfwsettings{'dnatport'}\" maxlength='20' size='18'>
1783                                                                 </td>
1784                                                         </tr>
1785                                                 </table>
1786
1787                                                 <table width="100%" border="0" id="PROTOCOL_TEMPLATE">
1788                                                         <tr>
1789                                                                 <td>
1790                                                                         <input type='radio' name='grp3' id='cust_srv' value='cust_srv' checked>
1791                                                                         $Lang::tr{'fwhost cust service'}
1792                                                                 </td>
1793                                                                 <td>
1794                                                                         <select name='cust_srv' style='min-width: 230px;'>
1795 END
1796
1797                 &General::readhasharray("$configsrv", \%customservice);
1798                 foreach my $key (sort { ncmp($customservice{$a}[0],$customservice{$b}[0]) } keys %customservice){
1799                         print"<option ";
1800                         print"selected='selected'" if ($fwdfwsettings{$fwdfwsettings{'grp3'}} eq $customservice{$key}[0]);
1801                         print"value='$customservice{$key}[0]'>$customservice{$key}[0]</option>";
1802                 }
1803
1804                 print <<END;
1805                                                                         </select>
1806                                                                 </td>
1807                                                         </tr>
1808                                                         <tr>
1809                                                                 <td>
1810                                                                         <input type='radio' name='grp3' id='cust_srvgrp' value='cust_srvgrp' $checked{'grp3'}{'cust_srvgrp'}>
1811                                                                         $Lang::tr{'fwhost cust srvgrp'}
1812                                                                 </td>
1813                                                                 <td>
1814                                                                         <select name='cust_srvgrp' style='min-width:230px;'>
1815 END
1816
1817                 &General::readhasharray("$configsrvgrp", \%customservicegrp);
1818                 my $helper;
1819                 foreach my $key (sort { ncmp($customservicegrp{$a}[0],$customservicegrp{$b}[0]) } keys %customservicegrp){
1820                         if ($helper ne $customservicegrp{$key}[0] && $customservicegrp{$key}[2] ne 'none'){
1821                                 print"<option ";
1822                                 print"selected='selected'" if ($fwdfwsettings{$fwdfwsettings{'grp3'}} eq $customservicegrp{$key}[0]);
1823                                 print">$customservicegrp{$key}[0]</option>";
1824                         }
1825                         $helper=$customservicegrp{$key}[0];
1826                 }
1827
1828                 print<<END;
1829                                                                         </select>
1830                                                                 </td>
1831                                                         </tr>
1832                                                 </table>
1833                                         </td>
1834                                 </tr>
1835                         </table>
1836 END
1837
1838                 &Header::closebox;
1839                 $checked{"RULE_ACTION"}{$fwdfwsettings{'RULE_ACTION'}}  = 'CHECKED';
1840                 print <<END;
1841                         <center>
1842                                 <table width="80%" class='tbl' id='actions'>
1843                                         <tr>
1844                                                 <td width="33%" align="center" bgcolor="$color{'color17'}">
1845                                                         &nbsp;<br>&nbsp;
1846                                                 </td>
1847                                                 <td width="33%" align="center" bgcolor="$color{'color25'}">
1848                                                         &nbsp;<br>&nbsp;
1849                                                 </td>
1850                                                 <td width="33%" align="center" bgcolor="$color{'color16'}">
1851                                                         &nbsp;<br>&nbsp;
1852                                                 </td>
1853                                         </tr>
1854                                         <tr>
1855                                                 <td width="33%" align="center">
1856                                                         <label>
1857                                                                 <input type="radio" name="RULE_ACTION" value="ACCEPT" $checked{"RULE_ACTION"}{"ACCEPT"}>
1858                                                                 <strong>$Lang::tr{'fwdfw ACCEPT'}</strong>
1859                                                         </label>
1860                                                 </td>
1861                                                 <td width="33%" align="center">
1862                                                         <label>
1863                                                                 <input type="radio" name="RULE_ACTION" value="DROP" $checked{"RULE_ACTION"}{"DROP"}>
1864                                                                 <strong>$Lang::tr{'fwdfw DROP'}</strong>
1865                                                         </label>
1866                                                 </td>
1867                                                 <td width="33%" align="center">
1868                                                         <label>
1869                                                                 <input type="radio" name="RULE_ACTION" value="REJECT" $checked{"RULE_ACTION"}{"REJECT"}>
1870                                                                 <strong>$Lang::tr{'fwdfw REJECT'}</strong>
1871                                                         </label>
1872                                                 </td>
1873                                         </tr>
1874                                 </table>
1875                         </center>
1876
1877                         <br>
1878 END
1879                 #---Activate/logging/remark-------------------------------------
1880                 &Header::openbox('100%', 'left', $Lang::tr{'fwdfw additional'});
1881                 print<<END;
1882                 <table width='100%' border='0'>
1883 END
1884                 print"<tr><td width='12%'>$Lang::tr{'remark'}:</td><td width='88%' align='left'><input type='text' name='ruleremark' maxlength='255' value='$fwdfwsettings{'ruleremark'}' style='width:99%;'></td></tr>";
1885                 if($fwdfwsettings{'updatefwrule'} eq 'on' || $fwdfwsettings{'copyfwrule'} eq 'on'){
1886                         print "<tr><td width='12%'>$Lang::tr{'fwdfw rulepos'}:</td><td><select name='rulepos' >";
1887                         for (my $count =1; $count <= $sum; $count++){
1888                                 print"<option value='$count' ";
1889                                 print"selected='selected'" if($fwdfwsettings{'oldrulenumber'} eq $count);
1890                                 print">$count</option>";
1891                         }
1892                         print"</select></td></tr>";
1893                 }else{
1894                         print "<tr><td width='12%'>$Lang::tr{'fwdfw rulepos'}:</td><td><input type='text' name='rulepos' size='2'></td></tr>";
1895                 }
1896
1897                 print<<END;
1898                 </table>
1899                 <table width='100%'>
1900                         <tr>
1901 END
1902
1903                 if ($fwdfwsettings{'updatefwrule'} eq 'on') {
1904                         print <<END;
1905                                 <td>
1906                                         <input type='checkbox' name='ACTIVE' value="ON" $checked{'ACTIVE'}{'ON'}>
1907                                 </td>
1908                                 <td>$Lang::tr{'fwdfw rule activate'}</td>
1909 END
1910                 } else {
1911                         print <<END;
1912                                 <td colspan="2">
1913                                         <input type="hidden" name="ACTIVE" value="ON">
1914                                 </td>
1915 END
1916                 }
1917
1918                 print <<END;
1919                         </tr>
1920                         <tr>
1921                                 <td>
1922                                         <input type='checkbox' name='LOG' value='ON' $checked{'LOG'}{'ON'}>
1923                                 </td>
1924                                 <td>$Lang::tr{'fwdfw log rule'}</td>
1925                         </tr>
1926                         <tr>
1927                                 <td width='1%'>
1928                                         <input type='checkbox' name='TIME' id="USE_TIME_CONSTRAINTS" value='ON' $checked{'TIME'}{'ON'}>
1929                                 </td>
1930                                 <td>$Lang::tr{'fwdfw timeframe'}</td>
1931                         </tr>
1932                         <tr id="TIME_CONSTRAINTS">
1933                                 <td colspan="2">
1934                                         <table width="66%" border="0">
1935                                                 <tr>
1936                                                         <td width="8em">&nbsp;</td>
1937                                                         <td align="center">$Lang::tr{'advproxy monday'}</td>
1938                                                         <td align="center">$Lang::tr{'advproxy tuesday'}</td>
1939                                                         <td align="center">$Lang::tr{'advproxy wednesday'}</td>
1940                                                         <td align="center">$Lang::tr{'advproxy thursday'}</td>
1941                                                         <td align="center">$Lang::tr{'advproxy friday'}</td>
1942                                                         <td align="center">$Lang::tr{'advproxy saturday'}</td>
1943                                                         <td align="center">$Lang::tr{'advproxy sunday'}</td>
1944                                                         <td>&nbsp;</td>
1945                                                 </tr>
1946                                                 <tr>
1947                                                         <td width="8em">&nbsp;</td>
1948                                                         <td align="center"><input type='checkbox' name='TIME_MON' value='on' $checked{'TIME_MON'}{'on'} ></td>
1949                                                         <td align="center"><input type='checkbox' name='TIME_TUE' value='on' $checked{'TIME_TUE'}{'on'} ></td>
1950                                                         <td align="center"><input type='checkbox' name='TIME_WED' value='on' $checked{'TIME_WED'}{'on'} ></td>
1951                                                         <td align="center"><input type='checkbox' name='TIME_THU' value='on' $checked{'TIME_THU'}{'on'} ></td>
1952                                                         <td align="center"><input type='checkbox' name='TIME_FRI' value='on' $checked{'TIME_FRI'}{'on'} ></td>
1953                                                         <td align="center"><input type='checkbox' name='TIME_SAT' value='on' $checked{'TIME_SAT'}{'on'} ></td>
1954                                                         <td align="center"><input type='checkbox' name='TIME_SUN' value='on' $checked{'TIME_SUN'}{'on'} ></td>
1955                                                         <td>
1956                                                                 <select name='TIME_FROM'>
1957 END
1958                 for (my $i=0;$i<=23;$i++) {
1959                         $i = sprintf("%02s",$i);
1960                         for (my $j=0;$j<=45;$j+=15) {
1961                                 $j = sprintf("%02s",$j);
1962                                 my $time = $i.":".$j;
1963                                 print "<option $selected{'TIME_FROM'}{$time}>$i:$j</option>\n";
1964                         }
1965                 }
1966                 print<<END;
1967                                                                 </select> &dash;
1968                                                                 <select name='TIME_TO'>
1969 END
1970                 for (my $i=0;$i<=23;$i++) {
1971                         $i = sprintf("%02s",$i);
1972                         for (my $j=0;$j<=45;$j+=15) {
1973                                 $j = sprintf("%02s",$j);
1974                                 my $time = $i.":".$j;
1975                                 print "<option $selected{'TIME_TO'}{$time}>$i:$j</option>\n";
1976                         }
1977                 }
1978                 print<<END;
1979                                                                 </select>
1980                                                         </td>
1981                                                 </tr>
1982                                         </table>
1983                                 </td>
1984                         </tr>
1985                         <tr>
1986                                 <td width='1%'>
1987                                         <input type='checkbox' name='LIMIT_CON_CON' id="USE_LIMIT_CONCURRENT_CONNECTIONS_PER_IP" value='ON' $checked{'LIMIT_CON_CON'}{'ON'}>
1988                                 </td>
1989                                 <td>$Lang::tr{'fwdfw limitconcon'}</td>
1990                         </tr>
1991                         <tr id="LIMIT_CON">
1992                                 <td colspan='2'>
1993                                         <table width='66%' border='0'>
1994                                                 <tr>
1995                                                         <td width="20em">&nbsp;</td>
1996                                                         <td>$Lang::tr{'fwdfw maxconcon'}: <input type='text' name='concon' size='2' value="$fwdfwsettings{'concon'}"></td>
1997                                                 </tr>
1998                                         </table>
1999                                 </td>
2000                         </tr>
2001                         <tr>
2002                                 <td width='1%'>
2003                                         <input type='checkbox' name='RATE_LIMIT' id="USE_RATELIMIT" value='ON' $checked{'RATE_LIMIT'}{'ON'}>
2004                                 </td>
2005                                 <td>$Lang::tr{'fwdfw ratelimit'}</td>
2006                         </tr>
2007                         <tr id="RATELIMIT">
2008                                 <td colspan='2'>
2009                                         <table width='66%' border='0'>
2010                                                 <tr>
2011                                                         <td width="20em">&nbsp;</td>
2012                                                         <td>$Lang::tr{'fwdfw numcon'}: <input type='text' name='ratecon' size='2' value="$fwdfwsettings{'ratecon'}"> /
2013                                                                 <select name='RATETIME' style='width:100px;'>
2014                                                                         <option value='second' $selected{'RATETIME'}{'second'}>$Lang::tr{'age second'}</option>
2015                                                                         <option value='minute' $selected{'RATETIME'}{'minute'}>$Lang::tr{'minute'}</option>
2016                                                                         <option value='hour' $selected{'RATETIME'}{'hour'}>$Lang::tr{'hour'}</option>
2017                                                                 </select>
2018                                                         </td>
2019                                                 </tr>
2020                                         </table>
2021                                 </td>
2022                         </tr>
2023                 </table>
2024                 <br>
2025 END
2026
2027                 #---ACTION------------------------------------------------------
2028                 if($fwdfwsettings{'updatefwrule'} ne 'on'){
2029                         print<<END;
2030                         <table border='0' width='100%'>
2031                         <tr><td align='right'><input type='submit' value='$Lang::tr{'add'}' style='min-width:100px;' />
2032                         <input type='hidden' name='config' value='$config' >
2033                         <input type='hidden' name='ACTION' value='saverule' ></form>
2034                         <form method='post' style='display:inline;'><input type='submit' value='$Lang::tr{'fwhost back'}' style='min-width:100px;'><input type='hidden' name='ACTION' value='reset'></form></td></tr>
2035                         </table>
2036                         <br>
2037 END
2038                 }else{
2039                         print<<END;
2040                         <table border='0' width='100%'>
2041                         <tr><td align='right'><input type='submit' value='$Lang::tr{'fwdfw change'}' style='min-width:100px;' /><input type='hidden' name='updatefwrule' value='$fwdfwsettings{'updatefwrule'}'><input type='hidden' name='key' value='$fwdfwsettings{'key'}'>
2042                         <input type='hidden' name='oldgrp1a' value='$fwdfwsettings{'oldgrp1a'}' />
2043                         <input type='hidden' name='oldgrp1b' value='$fwdfwsettings{'oldgrp1b'}' />
2044                         <input type='hidden' name='oldgrp2a' value='$fwdfwsettings{'oldgrp2a'}' />
2045                         <input type='hidden' name='oldgrp2b' value='$fwdfwsettings{'oldgrp2b'}' />
2046                         <input type='hidden' name='oldgrp3a' value='$fwdfwsettings{'oldgrp3a'}' />
2047                         <input type='hidden' name='oldgrp3b' value='$fwdfwsettings{'oldgrp3b'}' />
2048                         <input type='hidden' name='oldusesrv' value='$fwdfwsettings{'oldusesrv'}' />
2049                         <input type='hidden' name='oldrulenumber' value='$fwdfwsettings{'oldrulenumber'}' />
2050                         <input type='hidden' name='rulenumber' value='$fwdfwsettings{'rulepos'}' />
2051                         <input type='hidden' name='oldruleremark' value='$fwdfwsettings{'oldruleremark'}' />
2052                         <input type='hidden' name='oldorange' value='$fwdfwsettings{'oldorange'}' />
2053                         <input type='hidden' name='oldnat' value='$fwdfwsettings{'oldnat'}' />
2054                         <input type='hidden' name='oldruletype' value='$fwdfwsettings{'oldruletype'}' />
2055                         <input type='hidden' name='oldconcon' value='$fwdfwsettings{'oldconcon'}' />
2056                         <input type='hidden' name='ACTION' value='saverule' ></form><form method='post' style='display:inline'><input type='submit' value='$Lang::tr{'fwhost back'}' style='min-width:100px;'><input type='hidden' name='ACTION' value'reset'></td></td>
2057                         </table></form>
2058 END
2059                 }
2060                 &Header::closebox();
2061 }
2062 sub pos_up
2063 {
2064         my %uphash=();
2065         my %tmp=();
2066         &General::readhasharray($fwdfwsettings{'config'}, \%uphash);
2067         foreach my $key (sort keys %uphash){
2068                 if ($key eq $fwdfwsettings{'key'}) {
2069                         my $last = $key -1;
2070                         if (exists $uphash{$last}){
2071                                 #save rule last
2072                                 foreach my $y (0 .. $#{$uphash{$last}}) {
2073                                                 $tmp{0}[$y] = $uphash{$last}[$y];
2074                                 }
2075                                 #copy active rule to last
2076                                 foreach my $i (0 .. $#{$uphash{$last}}) {
2077                                         $uphash{$last}[$i] = $uphash{$key}[$i];
2078                                 }
2079                                 #copy saved rule to actual position
2080                                 foreach my $x (0 .. $#{$tmp{0}}) {
2081                                                 $uphash{$key}[$x] = $tmp{0}[$x];
2082                                 }
2083                         }
2084                 }
2085         }
2086         &General::writehasharray($fwdfwsettings{'config'}, \%uphash);
2087         &General::firewall_config_changed();
2088 }
2089 sub pos_down
2090 {
2091         my %downhash=();
2092         my %tmp=();
2093         &General::readhasharray($fwdfwsettings{'config'}, \%downhash);
2094         foreach my $key (sort keys %downhash){
2095                 if ($key eq $fwdfwsettings{'key'}) {
2096                         my $next = $key + 1;
2097                         if (exists $downhash{$next}){
2098                                 #save rule next
2099                                 foreach my $y (0 .. $#{$downhash{$next}}) {
2100                                                 $tmp{0}[$y] = $downhash{$next}[$y];
2101                                 }
2102                                 #copy active rule to next
2103                                 foreach my $i (0 .. $#{$downhash{$next}}) {
2104                                         $downhash{$next}[$i] = $downhash{$key}[$i];
2105                                 }
2106                                 #copy saved rule to actual position
2107                                 foreach my $x (0 .. $#{$tmp{0}}) {
2108                                                 $downhash{$key}[$x] = $tmp{0}[$x];
2109                                 }
2110                         }
2111                 }
2112         }
2113         &General::writehasharray($fwdfwsettings{'config'}, \%downhash);
2114         &General::firewall_config_changed();
2115 }
2116 sub saverule
2117 {
2118         my $hash=shift;
2119         my $config=shift;
2120         &General::readhasharray("$config", $hash);
2121         if (!$errormessage){
2122                 ################################################################
2123                 #check if we change an INPUT rule to a OUTGOING
2124                 if($fwdfwsettings{'oldruletype'} eq 'INPUTFW'  && $fwdfwsettings{'chain'} eq 'OUTGOINGFW'  ){
2125                         &changerule($configinput);
2126                         #print"1";
2127                 }
2128                 #check if we change an INPUT rule to a FORWARD
2129                 elsif($fwdfwsettings{'oldruletype'} eq 'INPUTFW'  && $fwdfwsettings{'chain'} eq 'FORWARDFW'  ){
2130                         &changerule($configinput);
2131                         #print"2";
2132                 }
2133                 ################################################################
2134                 #check if we change an OUTGOING rule to an INPUT
2135                 elsif($fwdfwsettings{'oldruletype'} eq 'OUTGOINGFW'  && $fwdfwsettings{'chain'} eq 'INPUTFW'  ){
2136                         &changerule($configoutgoing);
2137                         #print"3";
2138                 }
2139                 #check if we change an OUTGOING rule to a FORWARD
2140                 elsif($fwdfwsettings{'oldruletype'} eq 'OUTGOINGFW'  && $fwdfwsettings{'chain'} eq 'FORWARDFW'  ){
2141                         &changerule($configoutgoing);
2142                         #print"4";
2143                 }
2144                 ################################################################
2145                 #check if we change a FORWARD rule to an INPUT
2146                 elsif($fwdfwsettings{'oldruletype'} eq 'FORWARDFW'  && $fwdfwsettings{'chain'} eq 'INPUTFW'){
2147                         &changerule($configfwdfw);
2148                         #print"5";
2149                 }
2150                 #check if we change a FORWARD rule to an OUTGOING
2151                 elsif($fwdfwsettings{'oldruletype'} eq 'FORWARDFW'  && $fwdfwsettings{'chain'} eq 'OUTGOINGFW'){
2152                         &changerule($configfwdfw);
2153                         #print"6";
2154                 }
2155                 $fwdfwsettings{'ruleremark'}=~ s/,/;/g;
2156                 utf8::decode($fwdfwsettings{'ruleremark'});
2157                 $fwdfwsettings{'ruleremark'}=&Header::escape($fwdfwsettings{'ruleremark'});
2158                 if ($fwdfwsettings{'updatefwrule'} ne 'on'){
2159                         my $key = &General::findhasharraykey ($hash);
2160                         $$hash{$key}[0]  = $fwdfwsettings{'RULE_ACTION'};
2161                         $$hash{$key}[1]  = $fwdfwsettings{'chain'};
2162                         $$hash{$key}[2]  = $fwdfwsettings{'ACTIVE'};
2163                         $$hash{$key}[3]  = $fwdfwsettings{'grp1'};
2164                         $$hash{$key}[4]  = $fwdfwsettings{$fwdfwsettings{'grp1'}};
2165                         $$hash{$key}[5]  = $fwdfwsettings{'grp2'};
2166                         $$hash{$key}[6]  = $fwdfwsettings{$fwdfwsettings{'grp2'}};
2167                         $$hash{$key}[7]  = $fwdfwsettings{'USE_SRC_PORT'};
2168                         $$hash{$key}[8]  = $fwdfwsettings{'PROT'};
2169                         $$hash{$key}[9]  = $fwdfwsettings{'ICMP_TYPES'};
2170                         $$hash{$key}[10] = $fwdfwsettings{'SRC_PORT'};
2171                         $$hash{$key}[11] = $fwdfwsettings{'USESRV'};
2172                         $$hash{$key}[12] = $fwdfwsettings{'TGT_PROT'};
2173                         $$hash{$key}[13] = $fwdfwsettings{'ICMP_TGT'};
2174                         $$hash{$key}[14] = $fwdfwsettings{'grp3'};
2175                         $$hash{$key}[15] = $fwdfwsettings{$fwdfwsettings{'grp3'}};
2176                         $$hash{$key}[16] = $fwdfwsettings{'ruleremark'};
2177                         $$hash{$key}[17] = $fwdfwsettings{'LOG'};
2178                         $$hash{$key}[18] = $fwdfwsettings{'TIME'};
2179                         $$hash{$key}[19] = $fwdfwsettings{'TIME_MON'};
2180                         $$hash{$key}[20] = $fwdfwsettings{'TIME_TUE'};
2181                         $$hash{$key}[21] = $fwdfwsettings{'TIME_WED'};
2182                         $$hash{$key}[22] = $fwdfwsettings{'TIME_THU'};
2183                         $$hash{$key}[23] = $fwdfwsettings{'TIME_FRI'};
2184                         $$hash{$key}[24] = $fwdfwsettings{'TIME_SAT'};
2185                         $$hash{$key}[25] = $fwdfwsettings{'TIME_SUN'};
2186                         $$hash{$key}[26] = $fwdfwsettings{'TIME_FROM'};
2187                         $$hash{$key}[27] = $fwdfwsettings{'TIME_TO'};
2188                         $$hash{$key}[28] = $fwdfwsettings{'USE_NAT'};
2189                         $$hash{$key}[29] = $fwdfwsettings{$fwdfwsettings{'nat'}};
2190                         $$hash{$key}[30] = $fwdfwsettings{'dnatport'};
2191                         $$hash{$key}[31] = $fwdfwsettings{'nat'};
2192                         $$hash{$key}[32] = $fwdfwsettings{'LIMIT_CON_CON'};
2193                         $$hash{$key}[33] = $fwdfwsettings{'concon'};
2194                         $$hash{$key}[34] = $fwdfwsettings{'RATE_LIMIT'};
2195                         $$hash{$key}[35] = $fwdfwsettings{'ratecon'};
2196                         $$hash{$key}[36] = $fwdfwsettings{'RATETIME'};
2197                         &General::writehasharray("$config", $hash);
2198                 }else{
2199                         foreach my $key (sort {$a <=> $b} keys %$hash){
2200                                 if($key eq $fwdfwsettings{'key'}){
2201                                         $$hash{$key}[0]  = $fwdfwsettings{'RULE_ACTION'};
2202                                         $$hash{$key}[1]  = $fwdfwsettings{'chain'};
2203                                         $$hash{$key}[2]  = $fwdfwsettings{'ACTIVE'};
2204                                         $$hash{$key}[3]  = $fwdfwsettings{'grp1'};
2205                                         $$hash{$key}[4]  = $fwdfwsettings{$fwdfwsettings{'grp1'}};
2206                                         $$hash{$key}[5]  = $fwdfwsettings{'grp2'};
2207                                         $$hash{$key}[6]  = $fwdfwsettings{$fwdfwsettings{'grp2'}};
2208                                         $$hash{$key}[7]  = $fwdfwsettings{'USE_SRC_PORT'};
2209                                         $$hash{$key}[8]  = $fwdfwsettings{'PROT'};
2210                                         $$hash{$key}[9]  = $fwdfwsettings{'ICMP_TYPES'};
2211                                         $$hash{$key}[10] = $fwdfwsettings{'SRC_PORT'};
2212                                         $$hash{$key}[11] = $fwdfwsettings{'USESRV'};
2213                                         $$hash{$key}[12] = $fwdfwsettings{'TGT_PROT'};
2214                                         $$hash{$key}[13] = $fwdfwsettings{'ICMP_TGT'};
2215                                         $$hash{$key}[14] = $fwdfwsettings{'grp3'};
2216                                         $$hash{$key}[15] = $fwdfwsettings{$fwdfwsettings{'grp3'}};
2217                                         $$hash{$key}[16] = $fwdfwsettings{'ruleremark'};
2218                                         $$hash{$key}[17] = $fwdfwsettings{'LOG'};
2219                                         $$hash{$key}[18] = $fwdfwsettings{'TIME'};
2220                                         $$hash{$key}[19] = $fwdfwsettings{'TIME_MON'};
2221                                         $$hash{$key}[20] = $fwdfwsettings{'TIME_TUE'};
2222                                         $$hash{$key}[21] = $fwdfwsettings{'TIME_WED'};
2223                                         $$hash{$key}[22] = $fwdfwsettings{'TIME_THU'};
2224                                         $$hash{$key}[23] = $fwdfwsettings{'TIME_FRI'};
2225                                         $$hash{$key}[24] = $fwdfwsettings{'TIME_SAT'};
2226                                         $$hash{$key}[25] = $fwdfwsettings{'TIME_SUN'};
2227                                         $$hash{$key}[26] = $fwdfwsettings{'TIME_FROM'};
2228                                         $$hash{$key}[27] = $fwdfwsettings{'TIME_TO'};
2229                                         $$hash{$key}[28] = $fwdfwsettings{'USE_NAT'};
2230                                         $$hash{$key}[29] = $fwdfwsettings{$fwdfwsettings{'nat'}};
2231                                         $$hash{$key}[30] = $fwdfwsettings{'dnatport'};
2232                                         $$hash{$key}[31] = $fwdfwsettings{'nat'};
2233                                         $$hash{$key}[32] = $fwdfwsettings{'LIMIT_CON_CON'};
2234                                         $$hash{$key}[33] = $fwdfwsettings{'concon'};
2235                                         $$hash{$key}[34] = $fwdfwsettings{'RATE_LIMIT'};
2236                                         $$hash{$key}[35] = $fwdfwsettings{'ratecon'};
2237                                         $$hash{$key}[36] = $fwdfwsettings{'RATETIME'};
2238                                         last;
2239                                 }
2240                         }
2241                 }
2242                 &General::writehasharray("$config", $hash);
2243                 if($fwdfwsettings{'oldrulenumber'} > $fwdfwsettings{'rulepos'}){
2244                         my %tmp=();
2245                         my $val=$fwdfwsettings{'oldrulenumber'}-$fwdfwsettings{'rulepos'};
2246                         for (my $z=0;$z<$val;$z++){
2247                                 foreach my $key (sort {$a <=> $b} keys %$hash){
2248                                         if ($key eq $fwdfwsettings{'oldrulenumber'}) {
2249                                                 my $last = $key -1;
2250                                                 if (exists $$hash{$last}){
2251                                                         #save rule last
2252                                                         foreach my $y (0 .. $#{$$hash{$last}}) {
2253                                                                 $tmp{0}[$y] = $$hash{$last}[$y];
2254                                                         }
2255                                                         #copy active rule to last
2256                                                         foreach my $i (0 .. $#{$$hash{$last}}) {
2257                                                                 $$hash{$last}[$i] = $$hash{$key}[$i];
2258                                                         }
2259                                                         #copy saved rule to actual position
2260                                                         foreach my $x (0 .. $#{$tmp{0}}) {
2261                                                                 $$hash{$key}[$x] = $tmp{0}[$x];
2262                                                         }
2263                                                 }
2264                                         }
2265                                 }
2266                                 $fwdfwsettings{'oldrulenumber'}--;
2267                         }
2268                         &General::writehasharray("$config", $hash);
2269                         &General::firewall_config_changed();
2270                 }elsif($fwdfwsettings{'rulepos'} > $fwdfwsettings{'oldrulenumber'}){
2271                         my %tmp=();
2272                         my $val=$fwdfwsettings{'rulepos'}-$fwdfwsettings{'oldrulenumber'};
2273                                 for (my $z=0;$z<$val;$z++){
2274                                         foreach my $key (sort {$a <=> $b} keys %$hash){
2275                                         if ($key eq $fwdfwsettings{'oldrulenumber'}) {
2276                                                 my $next = $key + 1;
2277                                                 if (exists $$hash{$next}){
2278                                                         #save rule next
2279                                                         foreach my $y (0 .. $#{$$hash{$next}}) {
2280                                                                 $tmp{0}[$y] = $$hash{$next}[$y];
2281                                                         }
2282                                                         #copy active rule to next
2283                                                         foreach my $i (0 .. $#{$$hash{$next}}) {
2284                                                                 $$hash{$next}[$i] = $$hash{$key}[$i];
2285                                                         }
2286                                                         #copy saved rule to actual position
2287                                                         foreach my $x (0 .. $#{$tmp{0}}) {
2288                                                                 $$hash{$key}[$x] = $tmp{0}[$x];
2289                                                         }
2290                                                 }
2291                                         }
2292                                 }
2293                                 $fwdfwsettings{'oldrulenumber'}++;
2294                         }
2295                         &General::writehasharray("$config", $hash);
2296                         &General::firewall_config_changed();
2297                 }
2298         }
2299 }
2300 sub validremark
2301 {
2302         # Checks a hostname against RFC1035
2303         my $remark = $_[0];
2304
2305         # Try to decode $remark into UTF-8. If this doesn't work,
2306         # we assume that the string it not sane.
2307         if (!utf8::decode($remark)) {
2308                 return 0;
2309         }
2310
2311         # Check if the string only contains of printable characters.
2312         if ($remark =~ /^[[:print:]]*$/) {
2313                 return 1;
2314         }
2315         return 0;
2316 }
2317 sub viewtablerule
2318 {
2319         &General::readhash("/var/ipfire/ethernet/settings", \%netsettings);
2320
2321         &viewtablenew(\%configfwdfw, $configfwdfw, $Lang::tr{'firewall rules'});
2322         &viewtablenew(\%configinputfw, $configinput, $Lang::tr{'incoming firewall access'});
2323         &viewtablenew(\%configoutgoingfw, $configoutgoing, $Lang::tr{'outgoing firewall access'});
2324 }
2325 sub viewtablenew
2326 {
2327         my $hash=shift;
2328         my $config=shift;
2329         my $title=shift;
2330         my $go='';
2331
2332         my $show_box = (! -z $config) || ($optionsfw{'SHOWTABLES'} eq 'on');
2333         return if (!$show_box);
2334
2335         &General::get_aliases(\%aliases);
2336         &General::readhasharray("$confighost", \%customhost);
2337         &General::readhasharray("$config", $hash);
2338         &General::readhasharray("$configccdnet", \%ccdnet);
2339         &General::readhasharray("$configccdhost", \%ccdhost);
2340         &General::readhasharray("$configgrp", \%customgrp);
2341         &General::readhasharray("$configsrvgrp", \%customservicegrp);
2342
2343         &Header::openbox('100%', 'left', $title);
2344         print "<table width='100%' cellspacing='0' class='tbl'>";
2345
2346         if (! -z $config) {
2347                 my $count=0;
2348                 my ($gif,$log);
2349                 my $ruletype;
2350                 my $rulecolor;
2351                 my $tooltip;
2352                 my @tmpsrc=();
2353                 my @tmptgt=();
2354                 my $coloryellow='';
2355
2356                 print <<END;
2357                                 <tr>
2358                                         <th align='right' width='3%'>
2359                                                 #
2360                                         </th>
2361                                         <th width='2%'></th>
2362                                         <th align='center'>
2363                                                 <b>$Lang::tr{'protocol'}</b>
2364                                         </th>
2365                                         <th align='center' width='30%'>
2366                                                 <b>$Lang::tr{'fwdfw source'}</b>
2367                                         </th>
2368                                         <th align='center'>
2369                                                 <b>$Lang::tr{'fwdfw log'}</b>
2370                                         </th>
2371                                         <th align='center' width='30%'>
2372                                                 <b>$Lang::tr{'fwdfw target'}</b>
2373                                         </th>
2374                                         <th align='center' colspan='6' width='18%'>
2375                                                 <b>$Lang::tr{'fwdfw action'}</b>
2376                                         </th>
2377                                 </tr>
2378 END
2379
2380                 foreach my $key (sort  {$a <=> $b} keys %$hash){
2381                         $tdcolor='';
2382                         @tmpsrc=();
2383                         @tmptgt=();
2384                         #check if vpn hosts/nets have been deleted
2385                         if($$hash{$key}[3] =~ /ipsec/i || $$hash{$key}[3] =~ /ovpn/i){
2386                                 push (@tmpsrc,$$hash{$key}[4]);
2387                         }
2388                         if($$hash{$key}[5] =~ /ipsec/i || $$hash{$key}[5] =~ /ovpn/i){
2389                                 push (@tmptgt,$$hash{$key}[6]);
2390                         }
2391                         foreach my $host (@tmpsrc){
2392                                 if($$hash{$key}[3] eq  'ipsec_net_src'){
2393                                         if(&fwlib::get_ipsec_net_ip($host,11) eq ''){
2394                                                 $coloryellow='on';
2395                                         }
2396                                 }elsif($$hash{$key}[3] eq  'ovpn_net_src'){
2397                                         if(&fwlib::get_ovpn_net_ip($host,1) eq ''){
2398                                                 $coloryellow='on';
2399                                         }
2400                                 }elsif($$hash{$key}[3] eq  'ovpn_n2n_src'){
2401                                         if(&fwlib::get_ovpn_n2n_ip($host,27) eq ''){
2402                                                 $coloryellow='on';
2403                                         }
2404                                 }elsif($$hash{$key}[3] eq  'ovpn_host_src'){
2405                                         if(&fwlib::get_ovpn_host_ip($host,33) eq ''){
2406                                                 $coloryellow='on';
2407                                         }
2408                                 }
2409                         }
2410                         foreach my $host (@tmptgt){
2411                                 if($$hash{$key}[5] eq 'ipsec_net_tgt'){
2412                                         if(&fwlib::get_ipsec_net_ip($host,11) eq ''){
2413                                                 $coloryellow='on';
2414                                         }
2415                                 }elsif($$hash{$key}[5] eq 'ovpn_net_tgt'){
2416                                         if(&fwlib::get_ovpn_net_ip($host,1) eq ''){
2417                                                 $coloryellow='on';
2418                                         }
2419                                 }elsif($$hash{$key}[5] eq 'ovpn_n2n_tgt'){
2420                                         if(&fwlib::get_ovpn_n2n_ip($host,27) eq ''){
2421                                                 $coloryellow='on';
2422                                         }
2423                                 }elsif($$hash{$key}[5] eq 'ovpn_host_tgt'){
2424                                         if(&fwlib::get_ovpn_host_ip($host,33) eq ''){
2425                                                 $coloryellow='on';
2426                                         }
2427                                 }
2428                         }
2429                         #check if networkgroups or servicegroups are empty
2430                         foreach my $netgroup (sort keys %customgrp){
2431                                 if(($$hash{$key}[4] eq $customgrp{$netgroup}[0] || $$hash{$key}[6] eq $customgrp{$netgroup}[0]) && $customgrp{$netgroup}[2] eq 'none'){
2432                                         $coloryellow='on';
2433                                 }
2434                         }
2435                         foreach my $srvgroup (sort keys %customservicegrp){
2436                                 if($$hash{$key}[15] eq $customservicegrp{$srvgroup}[0] && $customservicegrp{$srvgroup}[2] eq 'none'){
2437                                         $coloryellow='on';
2438                                 }
2439                         }
2440                         $$hash{'ACTIVE'}=$$hash{$key}[2];
2441                         $count++;
2442                         if($coloryellow eq 'on'){
2443                                 $color="$color{'color14'}";
2444                                 $coloryellow='';
2445                         }elsif($coloryellow eq ''){
2446                                 if ($count % 2){
2447                                         $color="$color{'color22'}";
2448                                 }
2449                                 else{
2450                                         $color="$color{'color20'}";
2451                                 }
2452                         }
2453                         print<<END;
2454                                 <tr bgcolor='$color'>
2455                                         <td align='right' width='3%'>
2456                                                 <b>$key&nbsp;</b>
2457                                         </td>
2458 END
2459
2460                         #RULETYPE (A,R,D)
2461                         if ($$hash{$key}[0] eq 'ACCEPT'){
2462                                 $ruletype='A';
2463                                 $tooltip='ACCEPT';
2464                                 $rulecolor=$color{'color17'};
2465                         }elsif($$hash{$key}[0] eq 'DROP'){
2466                                 $ruletype='D';
2467                                 $tooltip='DROP';
2468                                 $rulecolor=$color{'color25'};
2469                         }elsif($$hash{$key}[0] eq 'REJECT'){
2470                                 $ruletype='R';
2471                                 $tooltip='REJECT';
2472                                 $rulecolor=$color{'color16'};
2473                         }
2474
2475                         print <<END;
2476                                         <td bgcolor='$rulecolor' align='center' width='2%'>
2477                                                 <span title='$tooltip'>&nbsp;&nbsp;</span>
2478                                         </td>
2479 END
2480
2481                         #Get Protocol
2482                         my $prot;
2483                         if ($$hash{$key}[8]){
2484                                 if ($$hash{$key}[8] eq "IPv6"){
2485                                         push (@protocols,$Lang::tr{'fwdfw prot41 short'})
2486                                 }else{
2487                                         push (@protocols,$$hash{$key}[8]);
2488                                 }
2489                         }elsif($$hash{$key}[14] eq 'cust_srv'){
2490                                 &get_serviceports("service",$$hash{$key}[15]);
2491                         }elsif($$hash{$key}[14] eq 'cust_srvgrp'){
2492                                 &get_serviceports("group",$$hash{$key}[15]);
2493                         }else{
2494                                 push (@protocols,$Lang::tr{'all'});
2495                         }
2496
2497                         my $protz=join(", ",@protocols);
2498                         if($protz eq 'ICMP' && $$hash{$key}[9] ne 'All ICMP-Types' && $$hash{$key}[14] ne 'cust_srvgrp'){
2499                                 &General::readhasharray("${General::swroot}/fwhosts/icmp-types", \%icmptypes);
2500                                 foreach my $keyicmp (sort { ncmp($icmptypes{$a}[0],$icmptypes{$b}[0]) }keys %icmptypes){
2501                                         if($$hash{$key}[9] eq "$icmptypes{$keyicmp}[0]"){
2502                                                 print "<td align='center'><span title='$icmptypes{$keyicmp}[0]'><b>$protz ($icmptypes{$keyicmp}[1])</b></span></td>";
2503                                                 last;
2504                                         }
2505                                 }
2506                         }elsif($#protocols gt '3'){
2507                                 print"<td align='center'><span title='$protz'>$Lang::tr{'fwdfw many'}</span></td>";
2508                         }else{
2509                                 print"<td align='center'>$protz</td>";
2510                         }
2511                         @protocols=();
2512                         #SOURCE
2513                         my $ipfireiface;
2514                         &getcolor($$hash{$key}[3],$$hash{$key}[4],\%customhost);
2515                         print"<td align='center' width='30%' $tdcolor>";
2516                         if ($$hash{$key}[3] eq 'ipfire_src'){
2517                                 $ipfireiface=$Lang::tr{'fwdfw iface'};
2518                         }
2519                         if ($$hash{$key}[3] eq 'std_net_src'){
2520                                 print &get_name($$hash{$key}[4]);
2521                         }elsif ($$hash{$key}[3] eq 'src_addr'){
2522                                 my ($split1,$split2) = split("/",$$hash{$key}[4]);
2523                                 if ($split2 eq '32'){
2524                                         print $split1;
2525                                 }else{
2526                                         print $$hash{$key}[4];
2527                                 }
2528                         }elsif ($$hash{$key}[4] eq 'RED1'){
2529                                 print "$ipfireiface $Lang::tr{'fwdfw red'}";
2530                         }elsif ($$hash{$key}[4] eq 'ALL'){
2531                                 print "$ipfireiface $Lang::tr{'all'}";
2532                         }else{
2533                                 if ($$hash{$key}[4] eq 'GREEN' || $$hash{$key}[4] eq 'ORANGE' || $$hash{$key}[4] eq 'BLUE' || $$hash{$key}[4] eq 'RED'){
2534                                         print "$ipfireiface $Lang::tr{lc($$hash{$key}[4])}";
2535                                 }else{
2536                                         print "$ipfireiface $$hash{$key}[4]";
2537                                 }
2538                         }
2539                         $tdcolor='';
2540                         #SOURCEPORT
2541                         &getsrcport(\%$hash,$key);
2542                         #Is this a SNAT rule?
2543                         if ($$hash{$key}[31] eq 'snat' && $$hash{$key}[28] eq 'ON'){
2544                                 my $net=&get_name($$hash{$key}[29]);
2545                                 if ( ! $net){ $net=$$hash{$key}[29];}
2546                                         print"<br>->$net";
2547                                 if ($$hash{$key}[30] ne ''){
2548                                         print": $$hash{$key}[30]";
2549                                 }
2550                         }
2551                         if ($$hash{$key}[17] eq 'ON'){
2552                                 $log="/images/on.gif";
2553                         }else{
2554                                 $log="/images/off.gif";
2555                         }
2556                         #LOGGING
2557                         print<<END;
2558                                         </td>
2559                                         <td align='center'>
2560                                                 <form method='POST' action=''>
2561                                                         <input type='image' img src='$log' alt='$Lang::tr{'click to disable'}' title='$Lang::tr{'fwdfw togglelog'}' style='padding-top: 0px; padding-left: 0px; padding-bottom: 0px ;padding-right: 0px ;'/>
2562                                                         <input type='hidden' name='key' value='$key' />
2563                                                         <input type='hidden' name='config' value='$config' />
2564                                                         <input type='hidden' name='ACTION' value='$Lang::tr{'fwdfw togglelog'}' />
2565                                                 </form>
2566                                         </td>
2567 END
2568                         #TARGET
2569                         &getcolor($$hash{$key}[5],$$hash{$key}[6],\%customhost);
2570                         print<<END;
2571                                         <td align='center' $tdcolor>
2572 END
2573                         #Is this a DNAT rule?
2574                         my $natstring;
2575                         if ($$hash{$key}[31] eq 'dnat' && $$hash{$key}[28] eq 'ON'){
2576                                 if ($$hash{$key}[29] eq 'Default IP'){$$hash{$key}[29]=$Lang::tr{'red1'};}
2577                                 if ($$hash{$key}[29] eq 'AUTO'){
2578                                         my @src_addresses=&fwlib::get_addresses(\%$hash,$key,'src');
2579                                         my @nat_ifaces;
2580                                         foreach my $val (@src_addresses){
2581                                                 push (@nat_ifaces,&fwlib::get_nat_address($$hash{$key}[29],$val));
2582                                         }
2583                                         @nat_ifaces=&del_double(@nat_ifaces);
2584                                         $natstring = "";
2585                                 }else{
2586                                         $natstring = "($$hash{$key}[29])";
2587                                 }
2588                                 print "$Lang::tr{'firewall'} $natstring";
2589                                 if($$hash{$key}[30] ne ''){
2590                                         $$hash{$key}[30]=~ tr/|/,/;
2591                                         print": $$hash{$key}[30]";
2592                                 }
2593                                 print"<br>-&gt;";
2594                         }
2595                         if ($$hash{$key}[5] eq 'std_net_tgt' || $$hash{$key}[5] eq 'ipfire'){
2596                                 if ($$hash{$key}[6] eq 'RED1'){
2597                                         print "$Lang::tr{'red1'}";
2598                                 }elsif ($$hash{$key}[6] eq 'GREEN' || $$hash{$key}[6] eq 'ORANGE' || $$hash{$key}[6] eq 'BLUE'|| $$hash{$key}[6] eq 'ALL' || $$hash{$key}[6] eq 'RED')
2599                                 {
2600                                         print &get_name($$hash{$key}[6]);
2601                                 }else{
2602                                         print $$hash{$key}[6];
2603                                 }
2604                         }elsif ($$hash{$key}[5] eq 'tgt_addr'){
2605                                 my ($split1,$split2) = split("/",$$hash{$key}[6]);
2606                                 if ($split2 eq '32'){
2607                                         print $split1;
2608                                 }else{
2609                                         print $$hash{$key}[6];
2610                                 }
2611                         }else{
2612                                 print "$$hash{$key}[6]";
2613                         }
2614                         $tdcolor='';
2615                         #TARGETPORT
2616                         &gettgtport(\%$hash,$key);
2617                         print"</td>";
2618                         #RULE ACTIVE
2619                         if($$hash{$key}[2] eq 'ON'){
2620                                 $gif="/images/on.gif"
2621
2622                         }else{
2623                                 $gif="/images/off.gif"
2624                         }
2625                         print<<END;
2626                                 <td width='3%' align='center'>
2627                                         <form method='POST' action=''>
2628                                                 <input type='image' img src='$gif' alt='$Lang::tr{'click to disable'}' title='$Lang::tr{'fwdfw toggle'}' style='padding-top: 0px; padding-left: 0px; padding-bottom: 0px ;padding-right: 0px ;display: block;' />
2629                                                 <input type='hidden' name='key' value='$key' />
2630                                                 <input type='hidden' name='config' value='$config' />
2631                                                 <input type='hidden' name='ACTION' value='$Lang::tr{'fwdfw toggle'}' />
2632                                         </form>
2633                                 </td>
2634                                 <td width='3%' align='center'>
2635                                         <form method='POST' action=''>
2636                                                 <input type='image' img src='/images/edit.gif' alt='$Lang::tr{'edit'}' title='$Lang::tr{'fwdfw edit'}' style='padding-top: 0px; padding-left: 0px; padding-bottom: 0px ;padding-right: 0px ;display: block;'  />
2637                                                 <input type='hidden' name='key' value='$key' />
2638                                                 <input type='hidden' name='config' value='$config' />
2639                                                 <input type='hidden' name='ACTION' value='editrule' />
2640                                         </form>
2641                                 </td>
2642                                 <td width='3%' align='center'>
2643                                         <form method='POST' action=''>
2644                                                 <input type='image' img src='/images/addblue.gif' alt='$Lang::tr{'fwdfw copy'}' title='$Lang::tr{'fwdfw copy'}' style='padding-top: 0px; padding-left: 0px; padding-bottom: 0px ;padding-right: 0px ;display: block;' />
2645                                                 <input type='hidden' name='key' value='$key' />
2646                                                 <input type='hidden' name='config' value='$config' />
2647                                                 <input type='hidden' name='ACTION' value='copyrule' />
2648                                         </form>
2649                                 </td>
2650                                 <td width='3%' align='center'>
2651                                         <form method='POST' action=''>
2652                                                 <input type='image' img src='/images/delete.gif' alt='$Lang::tr{'delete'}' title='$Lang::tr{'fwdfw delete'}' style='padding-top: 0px; padding-left: 0px; padding-bottom: 0px ;padding-right: 0px ;display: block;'   />
2653                                                 <input type='hidden' name='key' value='$key' />
2654                                                 <input type='hidden' name='config' value='$config' />
2655                                                 <input type='hidden' name='ACTION' value='deleterule' />
2656                                         </form>
2657                                 </td>
2658 END
2659                         if (exists $$hash{$key-1}){
2660                                 print<<END;
2661                                         <td width='3%' align='center'>
2662                                                 <form method='POST' action=''>
2663                                                         <input type='image' img src='/images/up.gif' alt='$Lang::tr{'fwdfw moveup'}' title='$Lang::tr{'fwdfw moveup'}'  style='padding-top: 0px; padding-left: 0px; padding-bottom: 0px ;padding-right: 0px ;display: block;'  />
2664                                                         <input type='hidden' name='key' value='$key' />
2665                                                         <input type='hidden' name='config' value='$config' />
2666                                                         <input type='hidden' name='ACTION' value='moveup' />
2667                                                 </form>
2668                                         </td>
2669 END
2670                         }else{
2671                                 print"<td width='3%'></td>";
2672                         }
2673
2674                         if (exists $$hash{$key+1}){
2675                                 print<<END;
2676                                         <td width='3%' align='center'>
2677                                                 <form method='POST' action=''>
2678                                                         <input type='image' img src='/images/down.gif' alt='$Lang::tr{'fwdfw movedown'}' title='$Lang::tr{'fwdfw movedown'}' style='padding-top: 0px; padding-left: 0px; padding-bottom: 0px ;padding-right: 0px ;display: block;'  />
2679                                                         <input type='hidden' name='key' value='$key' />
2680                                                         <input type='hidden' name='config' value='$config' />
2681                                                         <input type='hidden' name='ACTION' value='movedown' />
2682                                                 </form>
2683                                         </td>
2684                                 </tr>
2685 END
2686                         }else{
2687                                 print"<td width='3%'></td></tr>";
2688                         }
2689                         #REMARK
2690                         if ($optionsfw{'SHOWREMARK'} eq 'on' && $$hash{$key}[16] ne ''){
2691                                 print <<END;
2692                                         <tr bgcolor='$color'>
2693                                                 <td>&nbsp;</td>
2694                                                 <td bgcolor='$rulecolor'></td>
2695                                                 <td colspan='10'>
2696                                                         &nbsp; <em>$$hash{$key}[16]</em>
2697                                                 </td>
2698                                         </tr>
2699 END
2700                         }
2701
2702                         if ($$hash{$key}[18] eq 'ON'){
2703                                 #TIMEFRAME
2704                                 if ($$hash{$key}[18] eq 'ON'){
2705                                         my @days=();
2706                                         if($$hash{$key}[19] ne ''){push (@days,$Lang::tr{'fwdfw wd_mon'});}
2707                                         if($$hash{$key}[20] ne ''){push (@days,$Lang::tr{'fwdfw wd_tue'});}
2708                                         if($$hash{$key}[21] ne ''){push (@days,$Lang::tr{'fwdfw wd_wed'});}
2709                                         if($$hash{$key}[22] ne ''){push (@days,$Lang::tr{'fwdfw wd_thu'});}
2710                                         if($$hash{$key}[23] ne ''){push (@days,$Lang::tr{'fwdfw wd_fri'});}
2711                                         if($$hash{$key}[24] ne ''){push (@days,$Lang::tr{'fwdfw wd_sat'});}
2712                                         if($$hash{$key}[25] ne ''){push (@days,$Lang::tr{'fwdfw wd_sun'});}
2713                                         my $weekdays=join(",",@days);
2714                                         if (@days){
2715                                                 print"<tr bgcolor='$color'>";
2716                                                 print"<td>&nbsp;</td><td bgcolor='$rulecolor'></td><td align='left' colspan='10'>&nbsp; $weekdays &nbsp; $$hash{$key}[26] - $$hash{$key}[27]</td></tr>";
2717                                         }
2718                                 }
2719                         }
2720                         print"<tr bgcolor='FFFFFF'><td colspan='13' height='1'></td></tr>";
2721                 }
2722         } elsif ($optionsfw{'SHOWTABLES'} eq 'on') {
2723                 print <<END;
2724                         <tr>
2725                                 <td colspan='7' height='30' bgcolor=$color{'color22'} align='center'>$Lang::tr{'fwhost empty'}</td>
2726                         </tr>
2727 END
2728         }
2729
2730         #SHOW FINAL RULE
2731         my $policy = 'fwdfw ' . $fwdfwsettings{'POLICY'};
2732         my $colour = "bgcolor='green'";
2733         if ($fwdfwsettings{'POLICY'} eq 'MODE1') {
2734                 $colour = "bgcolor='darkred'";
2735         }
2736
2737         my $message;
2738         if (($config eq '/var/ipfire/firewall/config') && ($fwdfwsettings{'POLICY'} ne 'MODE1')) {
2739                 print <<END;
2740                         <tr>
2741                                 <td colspan='13'>&nbsp;</td>
2742                         </tr>
2743                         <tr>
2744                                 <td colspan='13' style="padding-left:0px;padding-right:0px">
2745                                         <table width="100%" border='1' rules="cols" cellspacing='0'>
2746 END
2747
2748                 # GREEN
2749                 print <<END;
2750                         <tr>
2751                                 <td align='center'>
2752                                         <font color="$Header::colourgreen">$Lang::tr{'green'}</font>
2753                                 </td>
2754                                 <td align='center'>
2755                                         <font color="$Header::colourred">$Lang::tr{'red'}</font>
2756                                         ($Lang::tr{'fwdfw pol allow'})
2757                                 </td>
2758 END
2759
2760                 if (&Header::orange_used()) {
2761                         print <<END;
2762                                 <td align='center'>
2763                                         <font color="$Header::colourorange">$Lang::tr{'orange'}</font>
2764                                         ($Lang::tr{'fwdfw pol allow'})
2765                                 </td>
2766 END
2767                 }
2768
2769                 if (&Header::blue_used()) {
2770                         print <<END;
2771                                 <td align='center'>
2772                                         <font color="$Header::colourblue">$Lang::tr{'blue'}</font>
2773                                         ($Lang::tr{'fwdfw pol allow'})
2774                                 </td>
2775 END
2776                 }
2777
2778                 print"</tr>";
2779
2780                 # ORANGE
2781                 if (&Header::orange_used()) {
2782                         print <<END;
2783                                 <tr>
2784                                         <td align='center' width='20%'>
2785                                                 <font color="$Header::colourorange">$Lang::tr{'orange'}</font>
2786                                         </td>
2787                                         <td align='center'>
2788                                                 <font color="$Header::colourred">$Lang::tr{'red'}</font>
2789                                                 ($Lang::tr{'fwdfw pol allow'})
2790                                         </td>
2791                                         <td align='center'>
2792                                                 <font color="$Header::colourgreen">$Lang::tr{'green'}</font>
2793                                                 ($Lang::tr{'fwdfw pol block'})
2794                                         </td>
2795 END
2796
2797                         if (&Header::blue_used()) {
2798                                 print <<END;
2799                                         <td align='center'>
2800                                                 <font color="$Header::colourblue">$Lang::tr{'blue'}</font>
2801                                                 ($Lang::tr{'fwdfw pol block'})
2802                                         </td>
2803 END
2804                         }
2805
2806                         print"</tr>";
2807                 }
2808
2809                 if (&Header::blue_used()) {
2810                         print <<END;
2811                                 <tr>
2812                                         <td align='center'>
2813                                                 <font color="$Header::colourblue">$Lang::tr{'blue'}</font>
2814                                         </td>
2815                                         <td align='center'>
2816                                                 <font color="$Header::colourred">$Lang::tr{'red'}</font>
2817                                                 ($Lang::tr{'fwdfw pol allow'})
2818                                         </td>
2819 END
2820
2821                         if (&Header::orange_used()) {
2822                                 print <<END;
2823                                         <td align='center'>
2824                                                 <font color="$Header::colourorange">$Lang::tr{'orange'}</font>
2825                                                 ($Lang::tr{'fwdfw pol block'})
2826                                         </td>
2827 END
2828                         }
2829
2830                         print <<END;
2831                                         <td align='center'>
2832                                                 <font color="$Header::colourgreen">$Lang::tr{'green'}</font>
2833                                                 ($Lang::tr{'fwdfw pol block'})
2834                                         </td>
2835                                 </tr>
2836 END
2837                 }
2838
2839                 print <<END;
2840                                         </table>
2841                                 </td>
2842                         </tr>
2843 END
2844
2845                 $message = $Lang::tr{'fwdfw pol allow'};
2846
2847         } elsif ($config eq '/var/ipfire/firewall/outgoing' && ($fwdfwsettings{'POLICY1'} ne 'MODE1')) {
2848                 $message = $Lang::tr{'fwdfw pol allow'};
2849                 $colour = "bgcolor='green'";
2850         } else {
2851                 $message = $Lang::tr{'fwdfw pol block'};
2852                 $colour = "bgcolor='darkred'";
2853         }
2854
2855         if ($message) {
2856                 print <<END;
2857                         <tr>
2858                                 <td $colour align='center' colspan='13'>
2859                                         <font color='#FFFFFF'>$Lang::tr{'policy'}: $message</font>
2860                                 </td>
2861                         </tr>
2862 END
2863         }
2864
2865         print "</table>";
2866         print "<br>";
2867
2868         &Header::closebox();
2869 }
2870
2871 &Header::closebigbox();
2872 &Header::closepage();