VPN Checksubnets: Now the remote subnets (OpenVPN/IPSec) are checked. If they are...
[people/teissler/ipfire-2.x.git] / config / cfgroot / general-functions.pl
1 # SmoothWall CGIs
2 #
3 # This code is distributed under the terms of the GPL
4 #
5 # (c) The SmoothWall Team
6 # Copyright (C) 2002 Alex Hudson - getcgihash() rewrite
7 # Copyright (C) 2002 Bob Grant <bob@cache.ucr.edu> - validmac()
8 # Copyright (c) 2002/04/13 Steve Bootes - add alias section, helper functions
9 # Copyright (c) 2002/08/23 Mark Wormgoor <mark@wormgoor.com> validfqdn()
10 # Copyright (c) 2003/09/11 Darren Critchley <darrenc@telus.net> srtarray()
11 #
12 # $Id: general-functions.pl,v 1.1.2.26 2006/01/04 16:33:55 franck78 Exp $
13 #
14
15 package General;
16
17 use strict;
18 use Socket;
19 use IO::Socket;
20 use Net::SSLeay;
21 use Net::IPv4Addr qw(:all);
22 $|=1; # line buffering
23
24 $General::version = 'VERSION';
25 $General::swroot = 'CONFIG_ROOT';
26 $General::noipprefix = 'noipg-';
27 $General::adminmanualurl = 'http://wiki.ipfire.org';
28
29 #
30 # log ("message") use default 'ipcop' tag
31 # log ("tag","message") use your tag
32 #
33 sub log
34 {
35 my $tag='ipfire';
36 $tag = shift if (@_>1);
37 my $logmessage = $_[0];
38 $logmessage =~ /([\w\W]*)/;
39 $logmessage = $1;
40 system('logger', '-t', $tag, $logmessage);
41 }
42 sub setup_default_networks
43 {
44 my %netsettings=();
45 my $defaultNetworks = shift;
46
47 &readhash("/var/ipfire/ethernet/settings", \%netsettings);
48
49 # Get current defined networks (Red, Green, Blue, Orange)
50 $defaultNetworks->{$Lang::tr{'fwhost any'}}{'IPT'} = "0.0.0.0/0.0.0.0";
51 $defaultNetworks->{$Lang::tr{'fwhost any'}}{'NAME'} = "ALL";
52
53 $defaultNetworks->{$Lang::tr{'green'}}{'IPT'} = "$netsettings{'GREEN_NETADDRESS'}/$netsettings{'GREEN_NETMASK'}";
54 $defaultNetworks->{$Lang::tr{'green'}}{'NET'} = "$netsettings{'GREEN_ADDRESS'}";
55 $defaultNetworks->{$Lang::tr{'green'}}{'NAME'} = "GREEN";
56
57 if ($netsettings{'RED_DEV'} ne ''){
58 $defaultNetworks->{$Lang::tr{'fwdfw red'}}{'IPT'} = "$netsettings{'RED_NETADDRESS'}/$netsettings{'RED_NETMASK'}";
59 $defaultNetworks->{$Lang::tr{'fwdfw red'}}{'NET'} = "$netsettings{'RED_ADDRESS'}";
60 $defaultNetworks->{$Lang::tr{'fwdfw red'}}{'NAME'} = "RED";
61 }
62 if ($netsettings{'ORANGE_DEV'} ne ''){
63 $defaultNetworks->{$Lang::tr{'orange'}}{'IPT'} = "$netsettings{'ORANGE_NETADDRESS'}/$netsettings{'ORANGE_NETMASK'}";
64 $defaultNetworks->{$Lang::tr{'orange'}}{'NET'} = "$netsettings{'ORANGE_ADDRESS'}";
65 $defaultNetworks->{$Lang::tr{'orange'}}{'NAME'} = "ORANGE";
66 }
67
68 if ($netsettings{'BLUE_DEV'} ne ''){
69 $defaultNetworks->{$Lang::tr{'blue'}}{'IPT'} = "$netsettings{'BLUE_NETADDRESS'}/$netsettings{'BLUE_NETMASK'}";
70 $defaultNetworks->{$Lang::tr{'blue'}}{'NET'} = "$netsettings{'BLUE_ADDRESS'}";
71 $defaultNetworks->{$Lang::tr{'blue'}}{'NAME'} = "BLUE";
72 }
73
74 #IPFire himself
75 $defaultNetworks->{'IPFire'}{'NAME'} = "IPFire";
76
77 # OpenVPN
78 if(-e "${General::swroot}/ovpn/settings")
79 {
80 my %ovpnSettings = ();
81 &readhash("${General::swroot}/ovpn/settings", \%ovpnSettings);
82
83 # OpenVPN on Red?
84 if(defined($ovpnSettings{'DOVPN_SUBNET'}))
85 {
86 my ($ip,$sub) = split(/\//,$ovpnSettings{'DOVPN_SUBNET'});
87 $sub=&General::iporsubtocidr($sub);
88 my @tempovpnsubnet = split("\/", $ovpnSettings{'DOVPN_SUBNET'});
89 $defaultNetworks->{'OpenVPN ' ."($ip/$sub)"}{'ADR'} = $tempovpnsubnet[0];
90 $defaultNetworks->{'OpenVPN ' ."($ip/$sub)"}{'NAME'} = "OpenVPN-Dyn";
91 }
92 } # end OpenVPN
93 # IPsec RW NET
94 if(-e "${General::swroot}/vpn/settings")
95 {
96 my %ipsecsettings = ();
97 &readhash("${General::swroot}/vpn/settings", \%ipsecsettings);
98 if($ipsecsettings{'RW_NET'} ne '')
99 {
100 my ($ip,$sub) = split(/\//,$ipsecsettings{'RW_NET'});
101 $sub=&General::iporsubtocidr($sub);
102 my @tempipsecsubnet = split("\/", $ipsecsettings{'RW_NET'});
103 $defaultNetworks->{'IPsec RW (' .$ip."/".$sub.")"}{'ADR'} = $tempipsecsubnet[0];
104 $defaultNetworks->{'IPsec RW (' .$ip."/".$sub.")"}{'NAME'} = "IPsec RW";
105 $defaultNetworks->{'IPsec RW (' .$ip."/".$sub.")"}{'NET'} = &getnextip($ip);
106 }
107 }
108 }
109 sub get_aliases
110 {
111
112 my $defaultNetworks = shift;
113 open(FILE, "${General::swroot}/ethernet/aliases") or die 'Unable to open aliases file.';
114 my @current = <FILE>;
115 close(FILE);
116 my $ctr = 0;
117 foreach my $line (@current)
118 {
119 if ($line ne ''){
120 chomp($line);
121 my @temp = split(/\,/,$line);
122 if ($temp[2] eq '') {
123 $temp[2] = "Alias $ctr : $temp[0]";
124 }
125 $defaultNetworks->{$temp[2]}{'IPT'} = "$temp[0]";
126 $defaultNetworks->{$temp[2]}{'NET'} = "$temp[0]";
127
128 $ctr++;
129 }
130 }
131 }
132
133 sub readhash
134 {
135 my $filename = $_[0];
136 my $hash = $_[1];
137 my ($var, $val);
138
139
140 # Some ipcop code expects that readhash 'complete' the hash if new entries
141 # are presents. Not clear it !!!
142 #%$hash = ();
143
144 open(FILE, $filename) or die "Unable to read file $filename";
145
146 while (<FILE>)
147 {
148 chop;
149 ($var, $val) = split /=/, $_, 2;
150 if ($var)
151 {
152 $val =~ s/^\'//g;
153 $val =~ s/\'$//g;
154
155 # Untaint variables read from hash
156 # trim space from begin and end
157 $var =~ s/^\s+//;
158 $var =~ s/\s+$//;
159 $var =~ /([A-Za-z0-9_-]*)/;
160 $var = $1;
161 $val =~ /([\w\W]*)/;
162 $val = $1;
163 $hash->{$var} = $val;
164 }
165 }
166 close FILE;
167 }
168
169
170 sub writehash
171 {
172 my $filename = $_[0];
173 my $hash = $_[1];
174 my ($var, $val);
175
176 # write cgi vars to the file.
177 open(FILE, ">${filename}") or die "Unable to write file $filename";
178 flock FILE, 2;
179 foreach $var (keys %$hash)
180 {
181 if ( $var eq "__CGI__"){next;}
182 $val = $hash->{$var};
183 # Darren Critchley Jan 17, 2003 added the following because when submitting with a graphic, the x and y
184 # location of the mouse are submitted as well, this was being written to the settings file causing
185 # some serious grief! This skips the variable.x and variable.y
186 if (!($var =~ /(.x|.y)$/)) {
187 if ($val =~ / /) {
188 $val = "\'$val\'"; }
189 if (!($var =~ /^ACTION/)) {
190 print FILE "${var}=${val}\n"; }
191 }
192 }
193 close FILE;
194 }
195
196 sub writehashpart
197 {
198 # This function replaces the given hash in the original hash by keeping the old
199 # content and just replacing the new content
200
201 my $filename = $_[0];
202 my $newhash = $_[1];
203 my %oldhash;
204 my ($var, $val);
205
206 readhash("${filename}", \%oldhash);
207
208 foreach $var (keys %$newhash){
209 $oldhash{$var}=$newhash->{$var};
210 }
211
212 # write cgi vars to the file.
213 open(FILE, ">${filename}") or die "Unable to write file $filename";
214 flock FILE, 2;
215 foreach $var (keys %oldhash)
216 {
217 if ( $var eq "__CGI__"){next;}
218 $val = $oldhash{$var};
219 # Darren Critchley Jan 17, 2003 added the following because when submitting with a graphic, the x and y
220 # location of the mouse are submitted as well, this was being written to the settings file causing
221 # some serious grief! This skips the variable.x and variable.y
222 if (!($var =~ /(.x|.y)$/)) {
223 if ($val =~ / /) {
224 $val = "\'$val\'"; }
225 if (!($var =~ /^ACTION/)) {
226 print FILE "${var}=${val}\n"; }
227 }
228 }
229 close FILE;
230 }
231
232 sub age {
233 my ($dev, $ino, $mode, $nlink, $uid, $gid, $rdev, $size,
234 $atime, $mtime, $ctime, $blksize, $blocks) = stat $_[0];
235 my $totalsecs = time() - $mtime;
236 my @s = ();
237
238 my $secs = $totalsecs % 60;
239 $totalsecs /= 60;
240 if ($secs > 0) {
241 push(@s, "${secs}s");
242 }
243
244 my $min = $totalsecs % 60;
245 $totalsecs /= 60;
246 if ($min > 0) {
247 push(@s, "${min}m");
248 }
249
250 my $hrs = $totalsecs % 24;
251 $totalsecs /= 24;
252 if ($hrs > 0) {
253 push(@s, "${hrs}h");
254 }
255
256 my $days = int($totalsecs);
257 if ($days > 0) {
258 push(@s, "${days}d");
259 }
260
261 return join(" ", reverse(@s));
262 }
263
264 sub validip
265 {
266 my $ip = $_[0];
267
268 if (!($ip =~ /^(\d+)\.(\d+)\.(\d+)\.(\d+)$/)) {
269 return 0; }
270 else
271 {
272 my @octets = ($1, $2, $3, $4);
273 foreach $_ (@octets)
274 {
275 if (/^0./) {
276 return 0; }
277 if ($_ < 0 || $_ > 255) {
278 return 0; }
279 }
280 return 1;
281 }
282 }
283
284 sub validmask
285 {
286 my $mask = $_[0];
287
288 # secord part an ip?
289 if (&validip($mask)) {
290 return 1; }
291 # second part a number?
292 if (/^0/) {
293 return 0; }
294 if (!($mask =~ /^\d+$/)) {
295 return 0; }
296 if ($mask >= 0 && $mask <= 32) {
297 return 1; }
298 return 0;
299 }
300
301 sub validipormask
302 {
303 my $ipormask = $_[0];
304
305 # see if it is a IP only.
306 if (&validip($ipormask)) {
307 return 1; }
308 # split it into number and mask.
309 if (!($ipormask =~ /^(.*?)\/(.*?)$/)) {
310 return 0; }
311 my $ip = $1;
312 my $mask = $2;
313 # first part not a ip?
314 if (!(&validip($ip))) {
315 return 0; }
316 return &validmask($mask);
317 }
318
319 sub subtocidr
320 {
321 #gets: Subnet in decimal (255.255.255.0)
322 #Gives: 24 (The cidr of network)
323 my ($byte1, $byte2, $byte3, $byte4) = split(/\./, $_[0].".0.0.0.0");
324 my $num = ($byte1 * 16777216) + ($byte2 * 65536) + ($byte3 * 256) + $byte4;
325 my $bin = unpack("B*", pack("N", $num));
326 my $count = ($bin =~ tr/1/1/);
327 return $count;
328 }
329
330 sub cidrtosub
331 {
332 #gets: Cidr of network (20-30 for ccd)
333 #Konverts 30 to 255.255.255.252 e.g
334 my $cidr=$_[0];
335 my $netmask = &Net::IPv4Addr::ipv4_cidr2msk($cidr);
336 return "$netmask";
337 }
338
339 sub iporsubtodec
340 {
341 #Gets: Ip address or subnetmask in decimal oder CIDR
342 #Gives: What it gets only in CIDR format
343 my $subnet=$_[0];
344 my $net;
345 my $mask;
346 my $full=0;
347 if ($subnet =~ /^(.*?)\/(.*?)$/) {
348 ($net,$mask) = split (/\//,$subnet);
349 $full=1;
350 return "$subnet";
351 }else{
352 $mask=$subnet;
353 }
354 #Subnet already in decimal and valid?
355 if ($mask=~/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/ &&(($1<=255 && $2<=$1 && $3<=$2 && $4<=$3 ))) {
356 for (my $i=8;$i<=32;$i++){
357 if (&General::cidrtosub($i) eq $mask){
358 if ($full == 0){return $mask;}else{
359 return $net."/".$mask;
360 }
361 }
362 }
363 }
364 #Subnet in binary format?
365 if ($mask=~/^(\d{1,2})$/ && (($1<=32 && $1>=8))){
366 if($full == 0){ return &General::cidrtosub($mask);}else{
367 return $net."/".&General::cidrtosub($mask);
368 }
369 }else{
370 return 3;
371 }
372 return 3;
373 }
374
375
376 sub iporsubtocidr
377 {
378 #gets: Ip Address or subnetmask in decimal oder CIDR
379 #Gives: What it gets only in CIDR format
380 my $subnet=$_[0];
381 my $net;
382 my $mask;
383 my $full=0;
384 if ($subnet =~ /^(.*?)\/(.*?)$/) {
385 ($net,$mask) = split (/\//,$subnet);
386 $full=1;
387 }else{
388 $mask=$subnet;
389 }
390 #Subnet in decimal and valid?
391 if ($mask=~/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/ &&(($1<=255 && $2<=$1 && $3<=$2 && $4<=$3 ))) {
392 for (my $i=8;$i<=32;$i++){
393 if (&General::cidrtosub($i) eq $mask){
394 if ($full == 0){return &General::subtocidr($mask);}else{
395 return $net."/".&General::subtocidr($mask);
396 }
397 }
398 }
399 }
400 #Subnet already in binary format?
401 if ($mask=~/^(\d{1,2})$/ && (($1<=32 && $1>=8))){
402 if($full == 0){ return $mask;}else{
403 return $net."/".$mask;
404 }
405 }else{
406 return 3;
407 }
408 return 3;
409 }
410
411 sub getnetworkip
412 {
413 #Gets: IP, CIDR (10.10.10.0-255, 24)
414 #Gives: 10.10.10.0
415 my ($ccdip,$ccdsubnet) = @_;
416 my $ip_address_binary = inet_aton( $ccdip );
417 my $netmask_binary = ~pack("N", (2**(32-$ccdsubnet))-1);
418 my $network_address = inet_ntoa( $ip_address_binary & $netmask_binary );
419 return $network_address;
420 }
421
422 sub getccdbc
423 {
424 #Gets: IP in Form ("192.168.0.0/24")
425 #Gives: Broadcastaddress of network
426 my $ccdnet=$_;
427 my ($ccdip,$ccdsubnet) = split "/",$ccdnet;
428 my $ip_address_binary = inet_aton( $ccdip );
429 my $netmask_binary = ~pack("N", (2**(32-$ccdsubnet))-1);
430 my $broadcast_address = inet_ntoa( $ip_address_binary | ~$netmask_binary );
431 return $broadcast_address;
432 }
433
434 sub ip2dec
435 {
436 my $ip_num;
437 my $ip=$_[0];
438 if ( $ip =~ /(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})/ ) {
439 $ip_num = (($1*256**3) + ($2*256**2) + ($3*256) + $4);
440 } else {
441 $ip_num = -1;
442 }
443 $ip_num = (($1*256**3) + ($2*256**2) + ($3*256) + $4);
444 return($ip_num);
445 }
446
447 sub dec2ip
448 {
449 my $ip;
450 my $ip_num=$_[0];
451 my $o1=$ip_num%256;
452 $ip_num=int($ip_num/256);
453 my $o2=$ip_num%256;
454 $ip_num=int($ip_num/256);
455 my $o3=$ip_num%256;
456 $ip_num=int($ip_num/256);
457 my $o4=$ip_num%256;
458 $ip="$o4.$o3.$o2.$o1";
459 return ($ip);
460 }
461
462 sub getnextip
463 {
464 my $decip=&ip2dec($_[0]);
465 $decip=$decip+4;
466 return &dec2ip($decip);
467 }
468
469 sub getlastip
470 {
471 my $decip=&ip2dec($_[0]);
472 $decip--;
473 return &dec2ip($decip);
474 }
475
476 sub validipandmask
477 {
478 #Gets: Ip address in 192.168.0.0/24 or 192.168.0.0/255.255.255.0 and checks if subnet valid
479 #Gives: True bzw 0 if success or false
480 my $ccdnet=$_[0];
481 my $subcidr;
482
483 if (!($ccdnet =~ /^(.*?)\/(.*?)$/)) {
484 return 0;
485 }
486 my ($ccdip,$ccdsubnet)=split (/\//, $ccdnet);
487 #IP valid?
488 if ($ccdip=~/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/ &&(($1>0 && $1<=255 && $2>=0 && $2<=255 && $3>=0 && $3<=255 && $4<=255 ))) {
489 #Subnet in decimal and valid?
490 if ($ccdsubnet=~/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/ &&(($1<=255 && $2<=$1 && $3<=$2 && $4<=$3 ))) {
491 for (my $i=8;$i<=32;$i++){
492 if (&General::cidrtosub($i) eq $ccdsubnet){
493 return 1;
494 }
495 }
496 #Subnet already in binary format?
497 }elsif ($ccdsubnet=~/^(\d{1,2})$/ && (($1<=32 && $1>=8))){
498 return 1;
499 }else{
500 return 0;
501 }
502
503 }
504 return 0;
505 }
506
507 sub checksubnets
508 {
509 my %ccdconfhash=();
510 my %ovpnconfhash=();
511 my %vpnconf=();
512 my %ipsecconf=();
513 my %ownnet=();
514 my %ovpnconf=();
515 my @ccdconf=();
516 my $ccdname=$_[0];
517 my $ccdnet=$_[1];
518 my $ownnet=$_[2];
519 my $errormessage;
520 my ($ip,$cidr)=split(/\//,$ccdnet);
521 $cidr=&iporsubtocidr($cidr);
522
523 #get OVPN-Subnet (dynamic range)
524 &readhash("${General::swroot}/ovpn/settings", \%ovpnconf);
525 my ($ovpnip,$ovpncidr)= split (/\//,$ovpnconf{'DOVPN_SUBNET'});
526 $ovpncidr=&iporsubtocidr($ovpncidr);
527
528 #check if we try to use same network as ovpn server
529 if ("$ip/$cidr" eq "$ovpnip/$ovpncidr") {
530 $errormessage=$errormessage.$Lang::tr{'ccd err isovpnnet'}."<br>";
531 return $errormessage;
532 }
533
534 #check if we try to use same network as another ovpn N2N
535 if($ownnet ne 'ovpn'){
536 &readhasharray("${General::swroot}/ovpn/ovpnconfig", \%ovpnconfhash);
537 foreach my $key (keys %ovpnconfhash) {
538 if ($ovpnconfhash{$key}[3] eq 'net'){
539 my @ovpnnet=split (/\//,$ovpnconfhash{$key}[11]);
540 if (&IpInSubnet($ip,$ovpnnet[0],&iporsubtodec($ovpnnet[1]))){
541 $errormessage=$errormessage.$Lang::tr{'ccd err isovpnn2n'}." $ovpnconfhash{$key}[1] <br>";
542 return $errormessage;
543 }
544 }
545 }
546 }
547
548 #check if we use a network-name/subnet (static-ovpn) that already exists
549 &readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
550 foreach my $key (keys %ccdconfhash) {
551 @ccdconf=split(/\//,$ccdconfhash{$key}[1]);
552 if ($ccdname eq $ccdconfhash{$key}[0])
553 {
554 $errormessage=$errormessage.$Lang::tr{'ccd err nameexist'}."<br>";
555 return $errormessage;
556 }
557 my ($newip,$newsub) = split(/\//,$ccdnet);
558 if (&IpInSubnet($newip,$ccdconf[0],&iporsubtodec($ccdconf[1])))
559 {
560 $errormessage=$errormessage.$Lang::tr{'ccd err issubnet'}." $ccdconfhash{$key}[0]<br>";
561 return $errormessage;
562 }
563 }
564
565 #check if we use a ipsec right network which is already defined
566 if($ownnet ne 'ipsec'){
567 &General::readhasharray("${General::swroot}/vpn/config", \%ipsecconf);
568 foreach my $key (keys %ipsecconf){
569 if ($ipsecconf{$key}[11] ne ''){
570 my ($ipsecip,$ipsecsub) = split (/\//, $ipsecconf{$key}[11]);
571 $ipsecsub=&iporsubtodec($ipsecsub);
572 if($ipsecconf{$key}[1] ne $ccdname){
573 if ( &IpInSubnet ($ip,$ipsecip,$ipsecsub) ){
574 $errormessage=$Lang::tr{'ccd err isipsecnet'}." Name: $ipsecconf{$key}[1]";
575 return $errormessage;
576 }
577 }
578 }
579 }
580 }
581
582 #check if we use the ipsec RW Network (if defined)
583 &readhash("${General::swroot}/vpn/settings", \%vpnconf);
584 if ($vpnconf{'RW_NET'} ne ''){
585 my ($ipsecrwnet,$ipsecrwsub)=split (/\//, $vpnconf{'RW_NET'});
586 if (&IpInSubnet($ip,$ipsecrwnet,&iporsubtodec($ipsecrwsub)))
587 {
588 $errormessage=$errormessage.$Lang::tr{'ccd err isipsecrw'}."<br>";
589 return $errormessage;
590 }
591 }
592
593 #check if we use one of ipfire's networks (green,orange,blue)
594 &readhash("${General::swroot}/ethernet/settings", \%ownnet);
595 if (($ownnet{'GREEN_NETADDRESS'} ne '' && $ownnet{'GREEN_NETADDRESS'} ne '0.0.0.0') && &IpInSubnet($ip,$ownnet{'GREEN_NETADDRESS'},&iporsubtodec($ownnet{'GREEN_NETMASK'}))){ $errormessage=$Lang::tr{'ccd err green'};return $errormessage;}
596 if (($ownnet{'ORANGE_NETADDRESS'} ne '' && $ownnet{'ORANGE_NETADDRESS'} ne '0.0.0.0') && &IpInSubnet($ip,$ownnet{'ORANGE_NETADDRESS'},&iporsubtodec($ownnet{'ORANGE_NETMASK'}))){ $errormessage=$Lang::tr{'ccd err orange'};return $errormessage;}
597 if (($ownnet{'BLUE_NETADDRESS'} ne '' && $ownnet{'BLUE_NETADDRESS'} ne '0.0.0.0') && &IpInSubnet($ip,$ownnet{'BLUE_NETADDRESS'},&iporsubtodec($ownnet{'BLUE_NETMASK'}))){ $errormessage=$Lang::tr{'ccd err blue'};return $errormessage;}
598 if (($ownnet{'RED_NETADDRESS'} ne '' && $ownnet{'RED_NETADDRESS'} ne '0.0.0.0') && &IpInSubnet($ip,$ownnet{'RED_NETADDRESS'},&iporsubtodec($ownnet{'RED_NETMASK'}))){ $errormessage=$Lang::tr{'ccd err red'};return $errormessage;}
599 }
600
601
602 sub validport
603 {
604 $_ = $_[0];
605
606 if (!/^\d+$/) {
607 return 0; }
608 if (/^0./) {
609 return 0; }
610 if ($_ >= 1 && $_ <= 65535) {
611 return 1; }
612 return 0;
613 }
614
615 sub validproxyport
616 {
617 $_ = $_[0];
618
619 if (!/^\d+$/) {
620 return 0; }
621 if (/^0./) {
622 return 0; }
623 if ($_ == 53 || $_ == 222 || $_ == 444 || $_ == 81 ) {
624 return 0; }
625 elsif ($_ >= 1 && $_ <= 65535) {
626 return 1; }
627 return 0;
628 }
629
630 sub validmac
631 {
632 my $checkmac = $_[0];
633 my $ot = '[0-9a-f]{2}'; # 2 Hex digits (one octet)
634 if ($checkmac !~ /^$ot:$ot:$ot:$ot:$ot:$ot$/i)
635 {
636 return 0;
637 }
638 return 1;
639 }
640
641 sub validhostname
642 {
643 # Checks a hostname against RFC1035
644 my $hostname = $_[0];
645
646 # Each part should be at least two characters in length
647 # but no more than 63 characters
648 if (length ($hostname) < 1 || length ($hostname) > 63) {
649 return 0;}
650 # Only valid characters are a-z, A-Z, 0-9 and -
651 if ($hostname !~ /^[a-zA-Z0-9-\s]*$/) {
652 return 0;}
653 # First character can only be a letter or a digit
654 if (substr ($hostname, 0, 1) !~ /^[a-zA-Z0-9]*$/) {
655 return 0;}
656 # Last character can only be a letter or a digit
657 if (substr ($hostname, -1, 1) !~ /^[a-zA-Z0-9]*$/) {
658 return 0;}
659 return 1;
660 }
661
662 sub validdomainname
663 {
664 my $part;
665
666 # Checks a domain name against RFC1035
667 my $domainname = $_[0];
668 my @parts = split (/\./, $domainname); # Split hostname at the '.'
669
670 foreach $part (@parts) {
671 # Each part should be at least two characters in length
672 # but no more than 63 characters
673 if (length ($part) < 2 || length ($part) > 63) {
674 return 0;}
675 # Only valid characters are a-z, A-Z, 0-9 and -
676 if ($part !~ /^[a-zA-Z0-9-]*$/) {
677 return 0;}
678 # First character can only be a letter or a digit
679 if (substr ($part, 0, 1) !~ /^[a-zA-Z0-9]*$/) {
680 return 0;}
681 # Last character can only be a letter or a digit
682 if (substr ($part, -1, 1) !~ /^[a-zA-Z0-9]*$/) {
683 return 0;}
684 }
685 return 1;
686 }
687
688 sub validfqdn
689 {
690 my $part;
691
692 # Checks a fully qualified domain name against RFC1035
693 my $fqdn = $_[0];
694 my @parts = split (/\./, $fqdn); # Split hostname at the '.'
695 if (scalar(@parts) < 2) { # At least two parts should
696 return 0;} # exist in a FQDN
697 # (i.e. hostname.domain)
698 foreach $part (@parts) {
699 # Each part should be at least one character in length
700 # but no more than 63 characters
701 if (length ($part) < 1 || length ($part) > 63) {
702 return 0;}
703 # Only valid characters are a-z, A-Z, 0-9 and -
704 if ($part !~ /^[a-zA-Z0-9-]*$/) {
705 return 0;}
706 # First character can only be a letter or a digit
707 if (substr ($part, 0, 1) !~ /^[a-zA-Z0-9]*$/) {
708 return 0;}
709 # Last character can only be a letter or a digit
710 if (substr ($part, -1, 1) !~ /^[a-zA-Z0-9]*$/) {
711 return 0;}
712 }
713 return 1;
714 }
715
716 sub validportrange # used to check a port range
717 {
718 my $port = $_[0]; # port values
719 $port =~ tr/-/:/; # replace all - with colons just in case someone used -
720 my $srcdst = $_[1]; # is it a source or destination port
721
722 if (!($port =~ /^(\d+)\:(\d+)$/)) {
723
724 if (!(&validport($port))) {
725 if ($srcdst eq 'src'){
726 return $Lang::tr{'source port numbers'};
727 } else {
728 return $Lang::tr{'destination port numbers'};
729 }
730 }
731 }
732 else
733 {
734 my @ports = ($1, $2);
735 if ($1 >= $2){
736 if ($srcdst eq 'src'){
737 return $Lang::tr{'bad source range'};
738 } else {
739 return $Lang::tr{'bad destination range'};
740 }
741 }
742 foreach $_ (@ports)
743 {
744 if (!(&validport($_))) {
745 if ($srcdst eq 'src'){
746 return $Lang::tr{'source port numbers'};
747 } else {
748 return $Lang::tr{'destination port numbers'};
749 }
750 }
751 }
752 return;
753 }
754 }
755
756 # Test if IP is within a subnet
757 # Call: IpInSubnet (Addr, Subnet, Subnet Mask)
758 # Subnet can be an IP of the subnet: 10.0.0.0 or 10.0.0.1
759 # Everything in dottted notation
760 # Return: TRUE/FALSE
761 sub IpInSubnet
762 {
763 my $ip = unpack('N', &Socket::inet_aton(shift));
764 my $start = unpack('N', &Socket::inet_aton(shift));
765 my $mask = unpack('N', &Socket::inet_aton(shift));
766 $start &= $mask; # base of subnet...
767 my $end = $start + ~$mask;
768 return (($ip >= $start) && ($ip <= $end));
769 }
770
771 #
772 # Return the following IP (IP+1) in dotted notation.
773 # Call: NextIP ('1.1.1.1');
774 # Return: '1.1.1.2'
775 #
776 sub NextIP
777 {
778 return &Socket::inet_ntoa( pack("N", 1 + unpack('N', &Socket::inet_aton(shift))
779 )
780 );
781 }
782 sub NextIP2
783 {
784 return &Socket::inet_ntoa( pack("N", 4 + unpack('N', &Socket::inet_aton(shift))
785 )
786 );
787 }
788 sub ipcidr
789 {
790 my ($ip,$cidr) = &Net::IPv4Addr::ipv4_parse(shift);
791 return "$ip\/$cidr";
792 }
793
794 sub ipcidr2msk
795 {
796 my ($ip,$cidr) = &Net::IPv4Addr::ipv4_parse(shift);
797 my $netmask = &Net::IPv4Addr::ipv4_cidr2msk($cidr);
798 return "$ip\/$netmask";
799 }
800
801
802 sub validemail {
803 my $mail = shift;
804 return 0 if ( $mail !~ /^[0-9a-zA-Z\.\-\_]+\@[0-9a-zA-Z\.\-]+$/ );
805 return 0 if ( $mail =~ /^[^0-9a-zA-Z]|[^0-9a-zA-Z]$/);
806 return 0 if ( $mail !~ /([0-9a-zA-Z]{1})\@./ );
807 return 0 if ( $mail !~ /.\@([0-9a-zA-Z]{1})/ );
808 return 0 if ( $mail =~ /.\.\-.|.\-\..|.\.\..|.\-\-./g );
809 return 0 if ( $mail =~ /.\.\_.|.\-\_.|.\_\..|.\_\-.|.\_\_./g );
810 return 0 if ( $mail !~ /\.([a-zA-Z]{2,4})$/ );
811 return 1;
812 }
813
814 #
815 # Currently only vpnmain use this three procs (readhasharray, writehasharray, findhasharray)
816 # The 'key' used is numeric but is perfectly unneeded! This will to be removed so don't use
817 # this code. Vpnmain will be splitted in parts: x509/pki, connection ipsec, connection other,... .
818 #
819 sub readhasharray {
820 my ($filename, $hash) = @_;
821 %$hash = ();
822
823 open(FILE, $filename) or die "Unable to read file $filename";
824
825 while (<FILE>) {
826 my ($key, $rest, @temp);
827 chomp;
828 ($key, $rest) = split (/,/, $_, 2);
829 if ($key =~ /^[0-9]+$/) {
830 @temp = split (/,/, $rest);
831 $hash->{$key} = \@temp;
832 }
833 }
834 close FILE;
835 return;
836 }
837
838 sub writehasharray {
839 my ($filename, $hash) = @_;
840 my ($key, @temp, $i);
841
842 open(FILE, ">$filename") or die "Unable to write to file $filename";
843
844 foreach $key (keys %$hash) {
845 if ($key =~ /^[0-9]+$/) {
846 print FILE "$key";
847 foreach $i (0 .. $#{$hash->{$key}}) {
848 print FILE ",$hash->{$key}[$i]";
849 }
850 print FILE "\n";
851 }
852 }
853 close FILE;
854 return;
855 }
856
857 sub findhasharraykey {
858 foreach my $i (1 .. 1000000) {
859 if ( ! exists $_[0]{$i}) {
860 return $i;
861 }
862 }
863 }
864
865 sub srtarray
866 # Darren Critchley - darrenc@telus.net - (c) 2003
867 # &srtarray(SortOrder, AlphaNumeric, SortDirection, ArrayToBeSorted)
868 # This subroutine will take the following parameters:
869 # ColumnNumber = the column which you want to sort on, starts at 1
870 # AlphaNumberic = a or n (lowercase) defines whether the sort should be alpha or numberic
871 # SortDirection = asc or dsc (lowercase) Ascending or Descending sort
872 # ArrayToBeSorted = the array that wants sorting
873 #
874 # Returns an array that is sorted to your specs
875 #
876 # If SortOrder is greater than the elements in array, then it defaults to the first element
877 #
878 {
879 my ($colno, $alpnum, $srtdir, @tobesorted) = @_;
880 my @tmparray;
881 my @srtedarray;
882 my $line;
883 my $newline;
884 my $ctr;
885 my $ttlitems = scalar @tobesorted; # want to know the number of rows in the passed array
886 if ($ttlitems < 1){ # if no items, don't waste our time lets leave
887 return (@tobesorted);
888 }
889 my @tmp = split(/\,/,$tobesorted[0]);
890 $ttlitems = scalar @tmp; # this should be the number of elements in each row of the passed in array
891
892 # Darren Critchley - validate parameters
893 if ($colno > $ttlitems){$colno = '1';}
894 $colno--; # remove one from colno to deal with arrays starting at 0
895 if($colno < 0){$colno = '0';}
896 if ($alpnum ne '') { $alpnum = lc($alpnum); } else { $alpnum = 'a'; }
897 if ($srtdir ne '') { $srtdir = lc($srtdir); } else { $srtdir = 'src'; }
898
899 foreach $line (@tobesorted)
900 {
901 chomp($line);
902 if ($line ne '') {
903 my @temp = split(/\,/,$line);
904 # Darren Critchley - juggle the fields so that the one we want to sort on is first
905 my $tmpholder = $temp[0];
906 $temp[0] = $temp[$colno];
907 $temp[$colno] = $tmpholder;
908 $newline = "";
909 for ($ctr=0; $ctr < $ttlitems ; $ctr++) {
910 $newline=$newline . $temp[$ctr] . ",";
911 }
912 chop($newline);
913 push(@tmparray,$newline);
914 }
915 }
916 if ($alpnum eq 'n') {
917 @tmparray = sort {$a <=> $b} @tmparray;
918 } else {
919 @tmparray = (sort @tmparray);
920 }
921 foreach $line (@tmparray)
922 {
923 chomp($line);
924 if ($line ne '') {
925 my @temp = split(/\,/,$line);
926 my $tmpholder = $temp[0];
927 $temp[0] = $temp[$colno];
928 $temp[$colno] = $tmpholder;
929 $newline = "";
930 for ($ctr=0; $ctr < $ttlitems ; $ctr++){
931 $newline=$newline . $temp[$ctr] . ",";
932 }
933 chop($newline);
934 push(@srtedarray,$newline);
935 }
936 }
937
938 if ($srtdir eq 'dsc') {
939 @tmparray = reverse(@srtedarray);
940 return (@tmparray);
941 } else {
942 return (@srtedarray);
943 }
944 }
945
946 sub FetchPublicIp {
947 my %proxysettings;
948 &General::readhash("${General::swroot}/proxy/settings", \%proxysettings);
949 if ($_=$proxysettings{'UPSTREAM_PROXY'}) {
950 my ($peer, $peerport) = (/^(?:[a-zA-Z ]+\:\/\/)?(?:[A-Za-z0-9\_\.\-]*?(?:\:[A-Za-z0-9\_\.\-]*?)?\@)?([a-zA-Z0-9\.\_\-]*?)(?:\:([0-9]{1,5}))?(?:\/.*?)?$/);
951 Net::SSLeay::set_proxy($peer,$peerport,$proxysettings{'UPSTREAM_USER'},$proxysettings{'UPSTREAM_PASSWORD'} );
952 }
953 my $user_agent = &MakeUserAgent();
954 my ($out, $response) = Net::SSLeay::get_http( 'checkip4.dns.lightningwirelabs.com',
955 80,
956 "/",
957 Net::SSLeay::make_headers('User-Agent' => $user_agent )
958 );
959 if ($response =~ m%HTTP/1\.. 200 OK%) {
960 $out =~ /Your IP address is: (\d+.\d+.\d+.\d+)/;
961 return $1;
962 }
963 return '';
964 }
965
966 #
967 # Check if hostname.domain provided have IP provided
968 # use gethostbyname to verify that
969 # Params:
970 # IP
971 # hostname
972 # domain
973 # Output
974 # 1 IP matches host.domain
975 # 0 not in sync
976 #
977 sub DyndnsServiceSync ($;$;$) {
978
979 my ($ip,$hostName,$domain) = @_;
980 my @addresses;
981
982 #fix me no ip GROUP, what is the name ?
983 $hostName =~ s/$General::noipprefix//;
984 if ($hostName) { #may be empty
985 $hostName = "$hostName.$domain";
986 @addresses = gethostbyname($hostName);
987 }
988
989 if ($addresses[0] eq '') { # nothing returned ?
990 $hostName = $domain; # try resolving with domain only
991 @addresses = gethostbyname($hostName);
992 }
993
994 if ($addresses[0] ne '') { # got something ?
995 #&General::log("name:$addresses[0], alias:$addresses[1]");
996 # Build clear text list of IP
997 @addresses = map ( &Socket::inet_ntoa($_), @addresses[4..$#addresses]);
998 if (grep (/$ip/, @addresses)) {
999 return 1;
1000 }
1001 }
1002 return 0;
1003 }
1004 #
1005 # This sub returns the red IP used to compare in DyndnsServiceSync
1006 #
1007 sub GetDyndnsRedIP {
1008 my %settings;
1009 &General::readhash("${General::swroot}/ddns/settings", \%settings);
1010
1011 open(IP, "${General::swroot}/red/local-ipaddress") or return 'unavailable';
1012 my $ip = <IP>;
1013 close(IP);
1014 chomp $ip;
1015
1016 # 100.64.0.0/10 is reserved for dual-stack lite (http://tools.ietf.org/html/rfc6598).
1017 if (&General::IpInSubnet ($ip,'10.0.0.0','255.0.0.0') ||
1018 &General::IpInSubnet ($ip,'172.16.0.0.','255.240.0.0') ||
1019 &General::IpInSubnet ($ip,'192.168.0.0','255.255.0.0') ||
1020 &General::IpInSubnet ($ip,'100.64.0.0', '255.192.0.0'))
1021 {
1022 if ($settings{'BEHINDROUTER'} eq 'FETCH_IP') {
1023 my $RealIP = &General::FetchPublicIp;
1024 $ip = (&General::validip ($RealIP) ? $RealIP : 'unavailable');
1025 }
1026 }
1027 return $ip;
1028 }
1029
1030 # Translate ICMP code to text
1031 # ref: http://www.iana.org/assignments/icmp-parameters
1032 sub GetIcmpDescription ($) {
1033 my $index = shift;
1034 my @icmp_description = (
1035 'Echo Reply', #0
1036 'Unassigned',
1037 'Unassigned',
1038 'Destination Unreachable',
1039 'Source Quench',
1040 'Redirect',
1041 'Alternate Host Address',
1042 'Unassigned',
1043 'Echo',
1044 'Router Advertisement',
1045 'Router Solicitation', #10
1046 'Time Exceeded',
1047 'Parameter Problem',
1048 'Timestamp',
1049 'Timestamp Reply',
1050 'Information Request',
1051 'Information Reply',
1052 'Address Mask Request',
1053 'Address Mask Reply',
1054 'Reserved (for Security)',
1055 'Reserved (for Robustness Experiment)', #20
1056 'Reserved',
1057 'Reserved',
1058 'Reserved',
1059 'Reserved',
1060 'Reserved',
1061 'Reserved',
1062 'Reserved',
1063 'Reserved',
1064 'Reserved',
1065 'Traceroute', #30
1066 'Datagram Conversion Error',
1067 'Mobile Host Redirect',
1068 'IPv6 Where-Are-You',
1069 'IPv6 I-Am-Here',
1070 'Mobile Registration Request',
1071 'Mobile Registration Reply',
1072 'Domain Name Request',
1073 'Domain Name Reply',
1074 'SKIP',
1075 'Photur', #40
1076 'Experimental');
1077 if ($index>41) {return 'unknown'} else {return $icmp_description[$index]};
1078 }
1079
1080 sub GetCoreUpdateVersion() {
1081 my $core_update;
1082
1083 open(FILE, "/opt/pakfire/db/core/mine");
1084 while (<FILE>) {
1085 $core_update = $_;
1086 last;
1087 }
1088 close(FILE);
1089
1090 return $core_update;
1091 }
1092
1093 sub MakeUserAgent() {
1094 my $user_agent = "IPFire/$General::version";
1095
1096 my $core_update = &GetCoreUpdateVersion();
1097 if ($core_update ne "") {
1098 $user_agent .= "/$core_update";
1099 }
1100
1101 return $user_agent;
1102 }
1103
1104 sub RedIsWireless() {
1105 # This function checks if a network device is a wireless device.
1106
1107 my %settings = ();
1108 &readhash("${General::swroot}/ethernet/settings", \%settings);
1109
1110 # Find the name of the network device.
1111 my $device = $settings{'RED_DEV'};
1112
1113 # Exit, if no device is configured.
1114 return 0 if ($device eq "");
1115
1116 # Return 1 if the device is a wireless one.
1117 my $path = "/sys/class/net/$device/wireless";
1118 if (-d $path) {
1119 return 1;
1120 }
1121
1122 # Otherwise return zero.
1123 return 0;
1124 }
1125
1126 # Function to read a file with UTF-8 charset.
1127 sub read_file_utf8 ($) {
1128 my ($file) = @_;
1129
1130 open my $in, '<:encoding(UTF-8)', $file or die "Could not open '$file' for reading $!";
1131 local $/ = undef;
1132 my $all = <$in>;
1133 close $in;
1134
1135 return $all;
1136 }
1137
1138 # Function to write a file with UTF-8 charset.
1139 sub write_file_utf8 ($) {
1140 my ($file, $content) = @_;
1141
1142 open my $out, '>:encoding(UTF-8)', $file or die "Could not open '$file' for writing $!";;
1143 print $out $content;
1144 close $out;
1145
1146 return;
1147 }
1148
1149 my $FIREWALL_RELOAD_INDICATOR = "${General::swroot}/firewall/reread";
1150
1151 sub firewall_config_changed() {
1152 open FILE, ">$FIREWALL_RELOAD_INDICATOR" or die "Could not open $FIREWALL_RELOAD_INDICATOR";
1153 close FILE;
1154 }
1155
1156 sub firewall_needs_reload() {
1157 if (-e "$FIREWALL_RELOAD_INDICATOR") {
1158 return 1;
1159 }
1160
1161 return 0;
1162 }
1163
1164 sub firewall_reload() {
1165 system("/usr/local/bin/firewallctrl");
1166 }
1167
1168 1;