firewall: rules.pl: Fix rules with other NAT port.
[people/teissler/ipfire-2.x.git] / config / firewall / firewall-lib.pl
CommitLineData
2a81ab0d
AM
1#!/usr/bin/perl
2###############################################################################
3# #
4# IPFire.org - A linux based firewall #
5bee9a9d 5# Copyright (C) 2013 Alexander Marx <amarx@ipfire.org> #
2a81ab0d
AM
6# #
7# This program is free software: you can redistribute it and/or modify #
8# it under the terms of the GNU General Public License as published by #
9# the Free Software Foundation, either version 3 of the License, or #
10# (at your option) any later version. #
11# #
12# This program is distributed in the hope that it will be useful, #
13# but WITHOUT ANY WARRANTY; without even the implied warranty of #
14# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
15# GNU General Public License for more details. #
16# #
17# You should have received a copy of the GNU General Public License #
18# along with this program. If not, see <http://www.gnu.org/licenses/>. #
19# #
20###############################################################################
2a81ab0d
AM
21
22use strict;
23no warnings 'uninitialized';
24
25package fwlib;
26
27my %customnetwork=();
28my %customhost=();
29my %customgrp=();
30my %customservice=();
31my %customservicegrp=();
32my %ccdnet=();
33my %ccdhost=();
34my %ipsecconf=();
35my %ipsecsettings=();
36my %netsettings=();
37my %ovpnsettings=();
38
39require '/var/ipfire/general-functions.pl';
40
41my $confignet = "${General::swroot}/fwhosts/customnetworks";
42my $confighost = "${General::swroot}/fwhosts/customhosts";
43my $configgrp = "${General::swroot}/fwhosts/customgroups";
44my $configsrv = "${General::swroot}/fwhosts/customservices";
45my $configsrvgrp = "${General::swroot}/fwhosts/customservicegrp";
46my $configccdnet = "${General::swroot}/ovpn/ccd.conf";
47my $configccdhost = "${General::swroot}/ovpn/ovpnconfig";
48my $configipsec = "${General::swroot}/vpn/config";
49my $configovpn = "${General::swroot}/ovpn/settings";
50my $val;
51my $field;
52
53&General::readhash("/var/ipfire/ethernet/settings", \%netsettings);
54&General::readhash("${General::swroot}/ovpn/settings", \%ovpnsettings);
55&General::readhash("${General::swroot}/vpn/settings", \%ipsecsettings);
56
57
58&General::readhasharray("$confignet", \%customnetwork);
59&General::readhasharray("$confighost", \%customhost);
60&General::readhasharray("$configgrp", \%customgrp);
61&General::readhasharray("$configccdnet", \%ccdnet);
62&General::readhasharray("$configccdhost", \%ccdhost);
63&General::readhasharray("$configipsec", \%ipsecconf);
64&General::readhasharray("$configsrv", \%customservice);
65&General::readhasharray("$configsrvgrp", \%customservicegrp);
66
67sub get_srv_prot
68{
69 my $val=shift;
992394d5 70 foreach my $key (sort {$a <=> $b} keys %customservice){
2a81ab0d
AM
71 if($customservice{$key}[0] eq $val){
72 if ($customservice{$key}[0] eq $val){
73 return $customservice{$key}[2];
74 }
75 }
76 }
77}
78sub get_srvgrp_prot
79{
80 my $val=shift;
81 my @ips=();
82 my $tcp;
83 my $udp;
84 my $icmp;
992394d5 85 foreach my $key (sort {$a <=> $b} keys %customservicegrp){
2a81ab0d
AM
86 if($customservicegrp{$key}[0] eq $val){
87 if (&get_srv_prot($customservicegrp{$key}[2]) eq 'TCP'){
88 $tcp=1;
89 }elsif(&get_srv_prot($customservicegrp{$key}[2]) eq 'UDP'){
90 $udp=1;
91 }elsif(&get_srv_prot($customservicegrp{$key}[2]) eq 'ICMP'){
92 $icmp=1;
82b837cf
AM
93 }else{
94 #Protocols used in servicegroups
95 push (@ips,$customservicegrp{$key}[2]);
96 }
2a81ab0d
AM
97 }
98 }
99 if ($tcp eq '1'){push (@ips,'TCP');}
100 if ($udp eq '1'){push (@ips,'UDP');}
101 if ($icmp eq '1'){push (@ips,'ICMP');}
102 my $back=join(",",@ips);
103 return $back;
104
105}
106
107
108sub get_srv_port
109{
110 my $val=shift;
111 my $field=shift;
112 my $prot=shift;
992394d5 113 foreach my $key (sort {$a <=> $b} keys %customservice){
14bcb9a2
AM
114 if($customservice{$key}[0] eq $val && $customservice{$key}[2] eq $prot){
115 return $customservice{$key}[$field];
2a81ab0d
AM
116 }
117 }
118}
119sub get_srvgrp_port
120{
121 my $val=shift;
122 my $prot=shift;
123 my $back;
124 my $value;
125 my @ips=();
992394d5 126 foreach my $key (sort {$a <=> $b} keys %customservicegrp){
2a81ab0d
AM
127 if($customservicegrp{$key}[0] eq $val){
128 if ($prot ne 'ICMP'){
129 $value=&get_srv_port($customservicegrp{$key}[2],1,$prot);
130 }elsif ($prot eq 'ICMP'){
131 $value=&get_srv_port($customservicegrp{$key}[2],3,$prot);
132 }
133 push (@ips,$value) if ($value ne '') ;
134 }
135 }
136 if($prot ne 'ICMP'){
137 if ($#ips gt 0){$back="-m multiport --dports ";}else{$back="--dport ";}
138 }elsif ($prot eq 'ICMP'){
139 $back="--icmp-type ";
140 }
141
142 $back.=join(",",@ips);
143 return $back;
144}
145sub get_ipsec_net_ip
146{
147 my $val=shift;
148 my $field=shift;
992394d5 149 foreach my $key (sort {$a <=> $b} keys %ipsecconf){
2a81ab0d
AM
150 if($ipsecconf{$key}[1] eq $val){
151 return $ipsecconf{$key}[$field];
152 }
153 }
154}
155sub get_ipsec_host_ip
156{
157 my $val=shift;
158 my $field=shift;
992394d5 159 foreach my $key (sort {$a <=> $b} keys %ipsecconf){
2a81ab0d
AM
160 if($ipsecconf{$key}[1] eq $val){
161 return $ipsecconf{$key}[$field];
162 }
163 }
164}
165sub get_ovpn_n2n_ip
166{
167 my $val=shift;
168 my $field=shift;
992394d5 169 foreach my $key (sort {$a <=> $b} keys %ccdhost){
2a81ab0d
AM
170 if($ccdhost{$key}[1] eq $val){
171 return $ccdhost{$key}[$field];
172 }
173 }
174}
175sub get_ovpn_host_ip
176{
177 my $val=shift;
178 my $field=shift;
992394d5 179 foreach my $key (sort {$a <=> $b} keys %ccdhost){
2a81ab0d
AM
180 if($ccdhost{$key}[1] eq $val){
181 return $ccdhost{$key}[$field];
182 }
183 }
184}
185sub get_ovpn_net_ip
186{
187
188 my $val=shift;
189 my $field=shift;
992394d5 190 foreach my $key (sort {$a <=> $b} keys %ccdnet){
2a81ab0d
AM
191 if($ccdnet{$key}[0] eq $val){
192 return $ccdnet{$key}[$field];
193 }
194 }
195}
196sub get_grp_ip
197{
198 my $val=shift;
199 my $src=shift;
992394d5 200 foreach my $key (sort {$a <=> $b} keys %customgrp){
2a81ab0d
AM
201 if ($customgrp{$key}[0] eq $val){
202 &get_address($customgrp{$key}[3],$src);
203 }
204 }
205
206}
207sub get_std_net_ip
208{
209 my $val=shift;
ddcec9d3 210 my $con=shift;
2a81ab0d
AM
211 if ($val eq 'ALL'){
212 return "0.0.0.0/0.0.0.0";
213 }elsif($val eq 'GREEN'){
214 return "$netsettings{'GREEN_NETADDRESS'}/$netsettings{'GREEN_NETMASK'}";
215 }elsif($val eq 'ORANGE'){
216 return "$netsettings{'ORANGE_NETADDRESS'}/$netsettings{'ORANGE_NETMASK'}";
217 }elsif($val eq 'BLUE'){
218 return "$netsettings{'BLUE_NETADDRESS'}/$netsettings{'BLUE_NETMASK'}";
62fc8511 219 }elsif($val eq 'RED'){
ddcec9d3 220 return "0.0.0.0/0 -o $con";
2a81ab0d
AM
221 }elsif($val =~ /OpenVPN/i){
222 return "$ovpnsettings{'DOVPN_SUBNET'}";
223 }elsif($val =~ /IPsec/i){
224 return "$ipsecsettings{'RW_NET'}";
5d7faa45
AM
225 }elsif($val eq 'IPFire'){
226 return ;
2a81ab0d
AM
227 }
228}
229sub get_net_ip
230{
231 my $val=shift;
992394d5 232 foreach my $key (sort {$a <=> $b} keys %customnetwork){
2a81ab0d
AM
233 if($customnetwork{$key}[0] eq $val){
234 return "$customnetwork{$key}[1]/$customnetwork{$key}[2]";
235 }
236 }
237}
238sub get_host_ip
239{
240 my $val=shift;
241 my $src=shift;
992394d5 242 foreach my $key (sort {$a <=> $b} keys %customhost){
2a81ab0d
AM
243 if($customhost{$key}[0] eq $val){
244 if ($customhost{$key}[1] eq 'mac' && $src eq 'src'){
245 return "-m mac --mac-source $customhost{$key}[2]";
246 }elsif($customhost{$key}[1] eq 'ip' && $src eq 'src'){
247 return "$customhost{$key}[2]";
248 }elsif($customhost{$key}[1] eq 'ip' && $src eq 'tgt'){
249 return "$customhost{$key}[2]";
250 }elsif($customhost{$key}[1] eq 'mac' && $src eq 'tgt'){
251 return "none";
252 }
253 }
254 }
255}
256
257return 1;