Fixed OutgoingFW Parser, all option removed

[people/pmueller/ipfire-2.x.git] / config / outgoingfw / outgoingfw.pl

diff --git a/config/outgoingfw/outgoingfw.pl b/config/outgoingfw/outgoingfw.pl
index 522f281d960d98a867f118f1a7859c804d659034..ac27a58fe57b3681a0cb0238bbcec4c7fd32d33d 100644 (file)
--- a/config/outgoingfw/outgoingfw.pl
+++ b/config/outgoingfw/outgoingfw.pl
@@ -1,14 +1,24 @@
 #!/usr/bin/perl
-#
-# IPFire Scripts
-#
-# This code is distributed under the terms of the GPL
-#
-# (c) The IPFire Team
-#
-# Michael Tremer - mitch@ipfire.org
-# Christian Schmidt - maniacikarus@ipfire.org
-#
+###############################################################################
+#                                                                             #
+# IPFire.org - A linux based firewall                                         #
+# Copyright (C) 2009  Michael Tremer & Christian Schmidt                      #
+#                                                                             #
+# This program is free software: you can redistribute it and/or modify        #
+# it under the terms of the GNU General Public License as published by        #
+# the Free Software Foundation, either version 3 of the License, or           #
+# (at your option) any later version.                                         #
+#                                                                             #
+# This program is distributed in the hope that it will be useful,             #
+# but WITHOUT ANY WARRANTY; without even the implied warranty of              #
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
+# GNU General Public License for more details.                                #
+#                                                                             #
+# You should have received a copy of the GNU General Public License           #
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
+#                                                                             #
+###############################################################################
+
 
 use strict;
 # enable only the following on debugging purpose
@@ -36,8 +46,6 @@ my $DEBUG = 0;
 my $configfile = "/var/ipfire/outgoing/rules";
 my $p2pfile = "/var/ipfire/outgoing/p2protocols";
 
-&General::readhash("${General::swroot}/ethernet/settings", \%netsettings);
-
 ### Values that have to be initialized
 $outfwsettings{'ACTION'} = '';
 $outfwsettings{'VALID'} = 'yes';
@@ -56,6 +64,7 @@ $outfwsettings{'DISPLAY_DPORT'} = '';
 $outfwsettings{'DISPLAY_SMAC'} = '';
 $outfwsettings{'DISPLAY_SIP'} = '';
 $outfwsettings{'POLICY'} = 'MODE0';
+
 my $SOURCE = "";
 my $DESTINATION = "";
 my $PROTO = "";
@@ -64,11 +73,15 @@ my $DEV = "";
 my $MAC = "";
 my $POLICY = "";
 my $DO = "";
+my $DAY = "";
 
 # read files
 &General::readhash("${General::swroot}/outgoing/settings", \%outfwsettings);
 &General::readhash("${General::swroot}/ethernet/settings", \%netsettings);
 
+$netsettings{'RED_DEV'}=`cat /var/ipfire/red/iface`;
+$netsettings{'RED_IP'}=`cat /var/ipfire/red/local-ipaddress`;
+
 open( FILE, "< $configfile" ) or die "Unable to read $configfile";
 @configs = <FILE>;
 close FILE;
@@ -80,7 +93,7 @@ if ( $outfwsettings{'POLICY'} eq 'MODE1' ) {
 } elsif ( $outfwsettings{'POLICY'} eq 'MODE2' ) {
        $outfwsettings{'STATE'} = "DENY";
        $POLICY = "ACCEPT";
-       $DO = "DROP";
+       $DO = "DROP -m comment --comment 'DROP_OUTGOINGFW'";
 }
 
 ### Initialize IPTables
@@ -112,6 +125,9 @@ foreach $configentry (sort @configs)
                if ($configline[2] eq 'green') {
                        $SOURCE = "$netsettings{'GREEN_NETADDRESS'}/$netsettings{'GREEN_NETMASK'}";
                        $DEV = $netsettings{'GREEN_DEV'};
+               } elsif ($configline[2] eq 'red') {
+                       $SOURCE = "$netsettings{'RED_IP'}";
+                       $DEV = "";
                } elsif ($configline[2] eq 'blue') {
                        $SOURCE = "$netsettings{'BLUE_NETADDRESS'}/$netsettings{'BLUE_NETMASK'}";
                        $DEV = $netsettings{'BLUE_DEV'};
@@ -132,17 +148,22 @@ foreach $configentry (sort @configs)
                        @proto = ("tcp");
                } elsif ($configline[3] eq 'udp') {
                        @proto = ("udp");
+               } elsif ($configline[3] eq 'esp') {
+                       @proto = ("esp");
+               } elsif ($configline[3] eq 'gre') {
+                       @proto = ("gre");
                } else {
-                       @proto = ("tcp", "udp");
+                       @proto = ("tcp","udp");
                }
+                 
                
                foreach $PROTO (@proto) {
                        $CMD = "/sbin/iptables -A OUTGOINGFW -s $SOURCE -d $DESTINATION -p $PROTO";
        
-                       if ($configline[8]) {
+                        if ($configline[8] && $configline[3] ne 'esp' && $configline[3] ne 'gre') {
                                $DPORT = "$configline[8]";
                                $CMD = "$CMD --dport $DPORT";
-                       }
+                        }
                        
                        if ($DEV) {
                                $CMD = "$CMD -i $DEV";
@@ -153,13 +174,24 @@ foreach $configentry (sort @configs)
                                $CMD = "$CMD -m mac --mac-source $MAC";
                        }
                        
+                       if ($configline[17] && $configline[18]) {
+                               if ($configline[10]){$DAY = "Mon,"}
+                               if ($configline[11]){$DAY .= "Tue,"}
+                               if ($configline[12]){$DAY .= "Wed,"}
+                               if ($configline[13]){$DAY .= "Thu,"}
+                               if ($configline[14]){$DAY .= "Fri,"}
+                               if ($configline[15]){$DAY .= "Sat,"}
+                               if ($configline[16]){$DAY .= "Sun"}
+                               $CMD = "$CMD -m time --timestart $configline[17] --timestop $configline[18] --weekdays $DAY";
+                       }
+                       
                        $CMD = "$CMD -o $netsettings{'RED_DEV'}";
 
                        if ($configline[9] eq "aktiv") {
                                if ($DEBUG) {
-                                       print "$CMD -m state --state NEW -m limit --limit 10/minute -j LOG --log-prefix 'OUTGOINGFW '\n";
+                                       print "$CMD -m limit --limit 10/minute -j LOG --log-prefix 'DROP_OUTGOINGFW'\n";
                                } else {
-                                       system("$CMD -m state --state NEW -m limit --limit 10/minute -j LOG --log-prefix 'OUTGOINGFW '");
+                                       system("$CMD -m limit --limit 10/minute -j LOG --log-prefix 'DROP_OUTGOINGFW'");
                                }
                        }
                        
@@ -203,10 +235,19 @@ if ($P2PSTRING) {
 }
 
 if ( $outfwsettings{'POLICY'} eq 'MODE1' ) {
-       $CMD = "/sbin/iptables -A OUTGOINGFW -o $netsettings{'RED_DEV'} -j DROP";
+        if ( $outfwsettings{'MODE1LOG'} eq 'on' ) {
+                       $CMD = "/sbin/iptables -A OUTGOINGFW -o $netsettings{'RED_DEV'} -m limit --limit 10/minute -j LOG --log-prefix 'DROP_OUTGOINGFW'";
+               if ($DEBUG) {
+                       print "$CMD\n";
+               } else {
+                       system("$CMD");
+               }
+        }
+
+       $CMD = "/sbin/iptables -A OUTGOINGFW -o $netsettings{'RED_DEV'} -j DROP -m comment --comment 'DROP_OUTGOINGFW'";
        if ($DEBUG) {
                print "$CMD\n";
        } else {
                system("$CMD");
        }
-}
+}
\ No newline at end of file