Forward Firewall: added GPL header to all files
[people/teissler/ipfire-2.x.git] / config / forwardfw / convert-dmz
CommitLineData
a60dbb4b
AM
1#!/usr/bin/perl
2
dc21519f
AM
3###############################################################################
4# #
5# IPFire.org - A linux based firewall #
6# Copyright (C) 2013 #
7# #
8# This program is free software: you can redistribute it and/or modify #
9# it under the terms of the GNU General Public License as published by #
10# the Free Software Foundation, either version 3 of the License, or #
11# (at your option) any later version. #
12# #
13# This program is distributed in the hope that it will be useful, #
14# but WITHOUT ANY WARRANTY; without even the implied warranty of #
15# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
16# GNU General Public License for more details. #
17# #
18# You should have received a copy of the GNU General Public License #
19# along with this program. If not, see <http://www.gnu.org/licenses/>. #
20# #
21###############################################################################
22# Author: Alexander Marx (amarx@ipfire.org) #
23###############################################################################
24# #
25# This script converts old dmz holes rules from old firewall #
26# to the new one. This is a 2-step process. #
27# STEP1: read old config and normalize settings #
28# STEP2: check valid ip and save valid rules to new firewall #
29# #
30###############################################################################
a60dbb4b
AM
31my @current=();
32my @alias=();
33my %configdmz=();
34my %ifaces=();
35my %configfwdfw=();
36require '/var/ipfire/general-functions.pl';
37my $dmzconfig = "${General::swroot}/dmzholes/config";
3f09f530 38my $fwdfwconfig = "${General::swroot}/forward/config";
a60dbb4b
AM
39my $ifacesettings = "${General::swroot}/ethernet/settings";
40my $field0 = 'ACCEPT';
41my $field1 = 'FORWARDFW';
42my $field2 = ''; #ON or emtpy
43my $field3 = ''; #std_net_src or src_addr
44my $field4 = ''; #ALL or IP-Address with /32
45my $field5 = ''; #std_net_tgt or tgt_addr
46my $field6 = ''; #IP or network name
47my $field11 = 'ON'; #use target port
48my $field12 = ''; #TCP or UDP
49my $field13 = 'All ICMP-Types';
50my $field14 = 'TGT_PORT';
51my $field15 = ''; #Port Number
52my $field16 = ''; #remark
53my $field26 = '00:00';
54my $field27 = '00:00';
ac9e77e3
AM
55my $field28 = '';
56my $field29 = 'ALL';
57my $field30 = '';
58my $field31 = 'dnat';
59
60
a60dbb4b
AM
61open(FILE, $dmzconfig) or die 'Unable to open config file.';
62my @current = <FILE>;
63close(FILE);
64#open LOGFILE
65open (LOG, ">/var/log/converters/dmz-convert.log") or die $!;
66&General::readhash($ifacesettings, \%ifaces);
67&General::readhasharray($fwdfwconfig,\%configfwdfw);
68&process_rules;
69sub process_rules{
70 foreach my $line (@current){
71 my $now=localtime;
72 #get values from old configfile
73 my ($a,$b,$c,$d,$e,$f,$g,$h) = split (",",$line);
f7e649dd
AM
74 $h =~ s/\s*\n//gi;
75 print LOG "$now Processing A: $a B: $b C: $c D: $d E: $e F: $f G: $g H: $h\n";
a60dbb4b
AM
76 #Now convert values and check ip addresses
77 $a=uc($a);
78 $e=uc($e);
79 $field2=$e if($e eq 'ON');
80 #SOURCE IP-check
81 $b=&check_ip($b);
82 if (&General::validipandmask($b)){
83 #When ip valid, check if we have a network
84 my ($ip,$subnet) = split ("/",$b);
85 if ($f eq 'orange' && $ip eq $ifaces{'ORANGE_NETADDRESS'}){
86 $field3='std_net_src';
87 $field4='ORANGE';
88 }elsif($f eq 'blue' && $ip eq $ifaces{'BLUE_NETADDRESS'}){
89 $field3='std_net_src';
90 $field4='BLUE';
91 }elsif($f eq 'orange' && &General::IpInSubnet($ip,$ifaces{'ORANGE_NETADDRESS'},$ifaces{'ORANGE_NETMASK'})){
92 $field3='src_addr';
93 $field4=$b;
94 }elsif($f eq 'blue' && &General::IpInSubnet($ip,$ifaces{'BLUE_NETADDRESS'},$ifaces{'BLUE_NETMASK'})){
95 $field3='src_addr';
96 $field4=$b;
97 }else{
98 print LOG "$now ->NOT Converted, source ip $b not part of source network $f \n\n";
99 next;
100 }
101 }else{
102 print LOG "$now -> SOURCE IP INVALID. \n\n";
103 next;
104 }
105 #TARGET IP-check
106 $c=&check_ip($c);
107 if (&General::validipandmask($c)){
108 my $now=localtime;
109 #When ip valid, check if we have a network
110 my ($ip,$subnet) = split ("/",$c);
111 if ($g eq 'green' && $ip eq $ifaces{'GREEN_NETADDRESS'}){
112 $field5='std_net_tgt';
113 $field6='GREEN';
114 }elsif($g eq 'blue' && $ip eq $ifaces{'BLUE_NETADDRESS'}){
115 $field5='std_net_tgt';
116 $field6='BLUE';
117 }elsif($g eq 'green' && &General::IpInSubnet($ip,$ifaces{'GREEN_NETADDRESS'},$ifaces{'GREEN_NETMASK'})){
118 $field5='tgt_addr';
119 $field6=$c;
120 }elsif($g eq 'blue' && &General::IpInSubnet($ip,$ifaces{'BLUE_NETADDRESS'},$ifaces{'BLUE_NETMASK'})){
121 $field5='tgt_addr';
122 $field6=$c;
123 }else{
f7e649dd 124 print LOG "$now ->NOT Converted, target ip $c not part of target network $g \n\n";
a60dbb4b
AM
125 next;
126 }
127 }else{
f7e649dd 128 print LOG "$now -> TARGET IP INVALID. \n\n";
a60dbb4b
AM
129 next;
130 }
131 $field12=$a;
132 #convert portrange
133 $d =~ tr/-/:/;
134 $field15=$d;
135 $field16=$h;
a60dbb4b
AM
136 my $key = &General::findhasharraykey (\%configfwdfw);
137 foreach my $i (0 .. 27) { $configfwdfw{$key}[$i] = "";}
138 $configfwdfw{$key}[0] = $field0;
139 $configfwdfw{$key}[1] = $field1;
140 $configfwdfw{$key}[2] = $field2;
141 $configfwdfw{$key}[3] = $field3;
142 $configfwdfw{$key}[4] = $field4;
143 $configfwdfw{$key}[5] = $field5;
144 $configfwdfw{$key}[6] = $field6;
145 $configfwdfw{$key}[7] = '';
146 $configfwdfw{$key}[8] = '';
147 $configfwdfw{$key}[9] = '';
148 $configfwdfw{$key}[10] = '';
149 $configfwdfw{$key}[11] = $field11;
150 $configfwdfw{$key}[12] = $field12;
151 $configfwdfw{$key}[13] = $field13;
152 $configfwdfw{$key}[14] = $field14;
153 $configfwdfw{$key}[15] = $field15;
154 $configfwdfw{$key}[16] = $field16;
155 $configfwdfw{$key}[17] = '';
156 $configfwdfw{$key}[18] = '';
157 $configfwdfw{$key}[19] = '';
158 $configfwdfw{$key}[20] = '';
159 $configfwdfw{$key}[21] = '';
160 $configfwdfw{$key}[22] = '';
161 $configfwdfw{$key}[23] = '';
162 $configfwdfw{$key}[24] = '';
163 $configfwdfw{$key}[25] = '';
164 $configfwdfw{$key}[26] = $field26;
165 $configfwdfw{$key}[27] = $field27;
ac9e77e3
AM
166 $configfwdfw{$key}[28] = $field28;
167 $configfwdfw{$key}[29] = $field29;
168 $configfwdfw{$key}[30] = $field30;
169 $configfwdfw{$key}[31] = $field31;
a60dbb4b
AM
170 print LOG "$Now -> Converted to $field0,$field1,$field2,$field3,$field4,$field5,$field6,,,,,$field11,$field12,$field13,$field14,$field15,$field16,,,,,,,,,,$field26,$field27\n";
171 }
172 &General::writehasharray($fwdfwconfig,\%configfwdfw);
173close (LOG);
174}
175
176sub check_ip
177{
178 my $adr=shift;
179 my $a;
180 #ip with subnet in decimal
181 if($adr =~ m/^(\d\d?\d?).(\d\d?\d?).(\d\d?\d?).(\d\d?\d?)\/(\d{1,2})$/){
182 $adr=int($1).".".int($2).".".int($3).".".int($4);
183 my $b = &General::iporsubtodec($5);
184 $a=$adr."/".$b;
185 }elsif($adr =~ /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/){
186 $adr=int($1).".".int($2).".".int($3).".".int($4);
187 if(&General::validip($adr)){
188 $a=$adr."/32";
189 }
190 }
191 if(&General::validipandmask($adr)){
192 $a=&General::iporsubtodec($adr);
193 }
194 return $a;
195}