config/forwardfw/convert-outgoingfw

   1 #!/usr/bin/perl
   2 ########################################################################
   3 # Script:       convert-outgoingfw
   4 # Date:         21.03.2013
   5 # Author:       Alexander Marx (amarx@ipfire.org)
   6 ########################################################################
   7 #
   8 # This script converts old groups and firewallrules
   9 # to the new one. This is a 3-step process.
  10 # STEP1: convert groups ->LOG /var/log/converters
  11 # STEP2: convert rules  ->LOG /var/log/converters
  12 # STEP3: convert P2P rules
  13 #
  14 ########################################################################
  15
  16 require '/var/ipfire/general-functions.pl';
  17
  18 use Socket;
  19 use File::Path;
  20 use File::Copy;
  21
  22 my $ipgrouppath         = "${General::swroot}/outgoing/groups/ipgroups/";
  23 my $macgrouppath        = "${General::swroot}/outgoing/groups/macgroups/";
  24 my $outgoingrules       = "${General::swroot}/outgoing/rules";
  25 my $outfwsettings       = "${General::swroot}/outgoing/settings";
  26 my $host                        = "Converted ";
  27 my $confighosts         = "${General::swroot}/fwhosts/customhosts";
  28 my $confignets          = "${General::swroot}/fwhosts/customnetworks";
  29 my $configgroups        = "${General::swroot}/fwhosts/customgroups";
  30 my $ovpnsettings        = "${General::swroot}/ovpn/settings";
  31 my $ovpnconfig          = "${General::swroot}/ovpn/ovpnconfig";
  32 my $ccdconfig           = "${General::swroot}/ovpn/ccd.conf";
  33 my $fwdfwconfig         = "${General::swroot}/forward/config";
  34 my $outfwconfig         = "${General::swroot}/forward/outgoing";
  35 my $fwdfwsettings       = "${General::swroot}/forward/settings";
  36 my @ipgroups = qx(ls $ipgrouppath);
  37 my @macgroups = qx(ls $macgrouppath);
  38 my @hostarray=();
  39 my %outsettings=();
  40 my %hosts=();
  41 my %nets=();
  42 my %groups=();
  43 my %settingsovpn=();
  44 my %configovpn=();
  45 my %ccdconf=();
  46 my %fwconfig=();
  47 my %fwconfigout=();
  48 my %fwdsettings=();
  49 my %ownnet=();
  50 my %ovpnSettings = ();
  51 &General::readhash("${General::swroot}/ovpn/settings", \%ovpnSettings);
  52 &General::readhash($outfwsettings,\%outsettings);
  53 &General::readhash("${General::swroot}/ethernet/settings", \%ownnet);
  54 #ONLY RUN if /var/ipfire/outgoing exists
  55 if ( -d "/var/ipfire/outgoing"){
  56         &process_groups;
  57         &process_rules;
  58         &process_p2p;
  59 }
  60 system("/usr/local/bin/forwardfwctrl");
  61 sub process_groups
  62 {
  63         if(! -d "/var/log/converters"){ mkdir("/var/log/converters");}
  64         if( -f "/var/log/converters/groups-convert.log"){rmtree("var/log/converters");}
  65         open (LOG, ">/var/log/converters/groups-convert.log") or die $!;
  66         #IP Group processing
  67         foreach my $group (@ipgroups){
  68                 my $now=localtime;
  69                 chomp $group;
  70                 print LOG "\n$now Processing IP-GROUP: $group...\n";
  71                 open (DATEI, "<$ipgrouppath/$group");
  72                 my @zeilen = <DATEI>;
  73                 foreach my $ip (@zeilen){
  74                         chomp($ip);
  75                         $ip =~ s/\s//gi;
  76                         print LOG "$now Check IP $ip from Group $group ";
  77                         my $val=&check_ip($ip);
  78                         if($val){
  79                                 push(@hostarray,$val.",ip");
  80                                 print LOG "$now -> OK\n";
  81                         }
  82                         else{
  83                                 print LOG "$now -> IP \"$ip\" from group $group not converted (invalid IP) \n";
  84                         }
  85                         $val='';
  86                 }
  87                 &new_hostgrp($group,'ip');
  88                 @hostarray=();
  89         }
  90         $group='';
  91         @zeilen=();
  92         @hostarray=();
  93         #MAC Group processing
  94         foreach my $group (@macgroups){
  95                 chomp $group;
  96                 print LOG "\nProcessing MAC-GROUP: $group...\n";
  97                 open (DATEI, "<$macgrouppath/$group");
  98                 my @zeilen = <DATEI>;
  99                 foreach my $mac (@zeilen){
 100                         chomp($mac);
 101                         $mac =~ s/\s//gi;
 102                         print LOG "$now Checking MAC $mac from group $group ";
 103                         #MAC checking
 104                         if(&General::validmac($mac)){
 105                                 $val=$mac;
 106                         }
 107                         if($val){
 108                                 push(@hostarray,$val.",mac");
 109                                 print LOG "$now -> OK\n";
 110                         }
 111                         else{
 112                                 print LOG "$now -> Mac $mac from group $group not converted (invalid MAC)\n";
 113                         }
 114                         $val='';
 115                 }
 116                 &new_hostgrp($group,'mac');
 117                 @hostarray=();
 118                 @zeilen=();
 119         }
 120         close (LOG);
 121 }
 122 sub check_ip
 123 {
 124         my $adr=shift;
 125         my $a;
 126         #ip with subnet in decimal
 127         if($adr =~ m/^(\d\d?\d?).(\d\d?\d?).(\d\d?\d?).(\d\d?\d?)\/(\d{1,2})$/){
 128                 $adr=int($1).".".int($2).".".int($3).".".int($4);
 129                 my $b = &General::iporsubtodec($5);
 130                 $a=$adr."/".$b;
 131         }elsif($adr =~ /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/){
 132                 $adr=int($1).".".int($2).".".int($3).".".int($4);
 133                 if(&General::validip($adr)){
 134                         $a=$adr."/255.255.255.255";
 135                 }
 136         }
 137         if(&General::validipandmask($adr)){
 138                 $a=&General::iporsubtodec($adr);
 139         }
 140         return $a;
 141 }
 142 sub new_hostgrp
 143 {
 144         &General::readhasharray($confighosts,\%hosts);
 145         &General::readhasharray($confignets,\%nets);
 146         &General::readhasharray($configgroups,\%groups);
 147         my $grp=shift;
 148         my $run=shift;
 149         my $name; #"converted"
 150         my $name2;
 151         my $name3; #custom host/custom net
 152         foreach my $adr (@hostarray){
 153                 if($run eq 'ip'){
 154                         my ($ip,$type)                  = split(",",$adr);
 155                         my ($ippart,$subnet)    = split("/",$ip);
 156                         my ($byte1,$byte2,$byte3,$byte4) = split(/\./,$subnet);
 157                         if($byte4 eq '255'){
 158                                 print LOG "Processing SINGLE HOST $ippart/$subnet from group $grp\n";
 159                                 if(!&check_host($ip)){
 160                                         my $key         = &General::findhasharraykey(\%hosts);
 161                                         $name="host ";
 162                                         $name2=$name.$ippart;
 163                                         $name3="Custom Host";
 164                                         $hosts{$key}[0] = $name2;
 165                                         $hosts{$key}[1] = $type;
 166                                         $hosts{$key}[2] = $ip;
 167                                         $hosts{$key}[3] = '';
 168                                         $hosts{$key}[4] = 1;
 169                                         print LOG "->Host (IP) $ip added to custom hosts\n"
 170                                 }else{
 171                                         print LOG "->Host (IP) $ip already exists in custom hosts\n";
 172                                         $name="host ";
 173                                         $name2=$name.$ippart;
 174                                         foreach my $key (sort keys %hosts){
 175                                                 if($hosts{$key}[0] eq $name2){
 176                                                         $hosts{$key}[4]++;
 177                                                 }
 178                                         }
 179                                         $name="host ";
 180                                         $name2=$name.$ippart;
 181                                         $name3="Custom Host";
 182                                 }
 183                         }elsif($byte4 < '255'){
 184                                 print LOG "Processing NETWORK $ippart/$subnet from Group $grp\n";
 185                                 if(!&check_net($ippart,$subnet)){
 186                                         #Check if this network is one one of IPFire internal networks
 187                                         if (($ownnet{'GREEN_NETADDRESS'}                ne '' && $ownnet{'GREEN_NETADDRESS'}    ne '0.0.0.0') && &General::IpInSubnet($ippart,$ownnet{'GREEN_NETADDRESS'},$ownnet{'GREEN_NETMASK'}))
 188                                         {
 189                                                 $name2='GREEN';
 190                                                 $name3='Standard Network';
 191                                         }elsif (($ownnet{'ORANGE_NETADDRESS'}   ne '' && $ownnet{'ORANGE_NETADDRESS'}   ne '0.0.0.0') && &General::IpInSubnet($ippart,$ownnet{'ORANGE_NETADDRESS'},$ownnet{'ORANGE_NETMASK'}))
 192                                         {
 193                                                 $name2='ORANGE';
 194                                                 $name3='Standard Network';
 195                                         }elsif (($ownnet{'BLUE_NETADDRESS'}     ne '' && $ownnet{'BLUE_NETADDRESS'}     ne '0.0.0.0') && &General::IpInSubnet($ippart,$ownnet{'BLUE_NETADDRESS'},$ownnet{'BLUE_NETMASK'}))
 196                                         {
 197                                                 $name2='BLUE';
 198                                                 $name3='Standard Network';
 199                                         }elsif ($ippart eq '0.0.0.0')
 200                                         {
 201                                                 $name2='ALL';
 202                                                 $name3='Standard Network';
 203                                         }elsif(defined($ovpnSettings{'DOVPN_SUBNET'}) && "$ippart/".&General::iporsubtodec($subnet) eq $ovpnSettings{'DOVPN_SUBNET'})
 204                                         {
 205                                                 $name2='OpenVPN-Dyn';
 206                                                 $name3='Standard Network';
 207                                         }else{
 208                                                 my $netkey      =  &General::findhasharraykey(\%nets);
 209                                                 $name="net ";
 210                                                 $name2=$name.$ippart;
 211                                                 $name3="Custom Network";
 212                                                 $nets{$netkey}[0] = $name2;
 213                                                 $nets{$netkey}[1] = $ippart;
 214                                                 $nets{$netkey}[2] = $subnet;
 215                                                 $nets{$netkey}[3] = '';
 216                                                 $nets{$netkey}[4] = 1;
 217                                                 print LOG "->Network $ippart/$subnet added to custom networks\n";
 218                                         }
 219                                 }else{
 220                                         print LOG "Network $ippart already exists in custom networks\n";
 221                                         $name="net ";
 222                                         $name2=$name.$ippart;
 223                                         foreach my $key (sort keys %nets){
 224                                                 if($nets{$key}[0] eq $name2){
 225                                                         $nets{$key}[4]++;
 226                                                 }
 227                                         }
 228                                         $name="net ";
 229                                         $name2=$name.$ippart;
 230                                         $name3="Custom Network";
 231                                 }
 232                         }
 233                         if($name2 && !&check_grp($grp,$name2)){
 234                                 my $grpkey      = &General::findhasharraykey(\%groups);
 235                                 $groups{$grpkey}[0]     = $grp;
 236                                 $groups{$grpkey}[1]     = '';
 237                                 $groups{$grpkey}[2]     = $name2;
 238                                 $groups{$grpkey}[3]     = $name3;
 239                                 $groups{$grpkey}[4]     = 0;
 240                                 print LOG "->$name2 added to group $grp\n";
 241                         }
 242                 }elsif($run eq 'mac'){
 243                         #MACRUN
 244                         my ($mac,$type)                         = split(",",$adr);
 245                         print LOG "Processing HOST (MAC) $mac\n";
 246                         if(!&check_host($mac)){
 247                                 my $key         = &General::findhasharraykey(\%hosts);
 248                                 $name="host ";
 249                                 $name2=$name.$mac;
 250                                 $name3="Custom Host";
 251                                 $hosts{$key}[0] = $name2;
 252                                 $hosts{$key}[1] = $type;
 253                                 $hosts{$key}[2] = $mac;
 254                                 $hosts{$key}[3] = '';
 255                                 $hosts{$key}[4] = 1;
 256                                 print LOG "->Host (MAC) $mac added to custom hosts\n";
 257                         }else{
 258                                 print LOG "->Host (MAC) $mac already exists in custom hosts \n";
 259                                 $name="host ";
 260                                 $name2=$name.$mac;
 261                                 foreach my $key (sort keys %hosts){
 262                                         if($hosts{$key}[0] eq $name2){
 263                                                 $hosts{$key}[4]++;
 264                                         }
 265                                 }
 266                                 $name="host ";
 267                                 $name2=$name.$mac;
 268                                 $name3="Custom Host";
 269                         }
 270                         if($name2 && !&check_grp($grp,$name2)){
 271                                 my $grpkey      = &General::findhasharraykey(\%groups);
 272                                 $groups{$grpkey}[0]     = $grp;
 273                                 $groups{$grpkey}[1]     = '';
 274                                 $groups{$grpkey}[2]     = $name2;
 275                                 $groups{$grpkey}[3]     = $name3;
 276                                 $groups{$grpkey}[4]     = 0;
 277                                 print LOG "->$name2 added to group $grp\n";
 278                         }
 279                 }
 280         }
 281         @hostarray=();
 282         &General::writehasharray($confighosts,\%hosts);
 283         &General::writehasharray($configgroups,\%groups);
 284         &General::writehasharray($confignets,\%nets);
 285
 286 }
 287 sub check_host
 288 {
 289         my $ip=shift;
 290         foreach my $key (sort keys %hosts)
 291         {
 292                 if($hosts{$key}[2] eq $ip)
 293                 {
 294                         return 1;
 295                 }
 296         }
 297         return 0;
 298 }
 299 sub check_net
 300 {
 301         my $ip=shift;
 302         my $sub=shift;
 303         foreach my $key (sort keys %nets)
 304         {
 305                 if($nets{$key}[1] eq $ip && $nets{$key}[2] eq $sub)
 306                 {
 307                         return 1;
 308                 }
 309         }
 310         return 0;
 311 }
 312 sub check_grp
 313 {
 314         my $grp=shift;
 315         my $value=shift;
 316         foreach my $key (sort keys %groups)
 317         {
 318                 if($groups{$key}[0] eq $grp && $groups{$key}[2] eq $value)
 319                 {
 320                         return 1;
 321                 }
 322         }
 323         return 0;
 324 }
 325 sub process_rules
 326 {
 327         my ($type,$action,$active,$grp1,$source,$grp2,$useport,$port,$prot,$grp3,$target,$remark,$log,$time,$time_mon,$time_tue,$time_wed,$time_thu,$time_fri,$time_sat,$time_sun,$time_from,$time_to);
 328         #open LOG
 329         if( -f "/var/log/converters/outgoingfw-convert.log"){unlink ("/var/log/converters/outgoingfw-convert.log");}
 330         open (LOG, ">/var/log/converters/outgoingfw-convert.log") or die $!;
 331
 332         &General::readhash($fwdfwsettings,\%fwdsettings);
 333         if ($outsettings{'POLICY'} eq 'MODE1'){
 334                 $fwdsettings{'POLICY'}='MODE1';
 335                 $fwdsettings{'POLICY1'}='MODE2';
 336                 $type='ALLOW';
 337                 $action='ACCEPT';
 338         }else{
 339                 $fwdsettings{'POLICY'}='MODE2';
 340                 $fwdsettings{'POLICY1'}='MODE2';
 341                 $type='DENY';
 342                 $action='DROP';
 343         }
 344         &General::writehash($fwdfwsettings,\%fwdsettings);
 345         open (DATEI, "<$outgoingrules");
 346         my @lines = <DATEI>;
 347         foreach my $rule (@lines)
 348         {
 349                 my $now=localtime;
 350                 chomp($rule);
 351                 $port='';
 352                 print LOG "$now processing: $rule\n";
 353                 my @configline=();
 354                 @configline = split( /\;/, $rule );
 355                 my @prot=();
 356                 if($configline[0] eq $type){
 357                         #some variables we can use from old config
 358                         if($configline[1] eq 'on'){ $active='ON';}else{$active='';}
 359                         if($configline[3] eq 'all' && $configline[8] ne ''){
 360                                 push(@prot,"TCP");
 361                                 push(@prot,"UDP");
 362                         }elsif($configline[3] eq 'all' && $configline[8] eq ''){
 363                                 push(@prot,"");
 364                         }else{
 365                                 push(@prot,$configline[3]);
 366                         }
 367                         if($configline[4] ne ''){
 368                                 $configline[4] =~ s/,/;/g;
 369                                 $remark = $configline[4];
 370                         }else{$remark = '';}
 371                         if($configline[9] eq 'Active'){ $log='ON';}else{$log='';}
 372                         if($configline[10] eq 'on' && $configline[11] eq 'on' && $configline[12] eq 'on' && $configline[13] eq 'on' && $configline[14] eq 'on' && $configline[15] eq 'on' && $configline[16] eq 'on'){
 373                                 if($configline[17] eq '00:00' && $configline[18] eq '00:00'){
 374                                         $time='';
 375                                 }else{
 376                                         $time='ON';
 377                                 }
 378                         }else{
 379                                 $time='ON';
 380                         }
 381                         $time_mon=$configline[10];
 382                         $time_tue=$configline[11];
 383                         $time_wed=$configline[12];
 384                         $time_thu=$configline[13];
 385                         $time_fri=$configline[14];
 386                         $time_sat=$configline[15];
 387                         $time_sun=$configline[16];
 388                         $time_from=$configline[17];
 389                         $time_to=$configline[18];
 390                         ############################################################
 391                         #sourcepart
 392                         if ($configline[2] eq 'green') {
 393                                 $grp1='std_net_src';
 394                                 $source='GREEN';
 395                         }elsif ($configline[2] eq 'orange') {
 396                                 $grp1='std_net_src';
 397                                 $source='ORANGE';
 398                         }elsif ($configline[2] eq 'red') {
 399                                 $grp1='std_net_src';
 400                                 $source='IPFire';
 401                                 &General::readhash($fwdfwsettings,\%fwdsettings);
 402                                 $fwdsettings{'POLICY1'}=$outsettings{'POLICY'};
 403                                 $fwdsettings{'POLICY'}=$outsettings{'POLICY'};
 404                                 &General::writehash($fwdfwsettings,\%fwdsettings);
 405                         }elsif ($configline[2] eq 'blue') {
 406                                 $grp1='std_net_src';
 407                                 $source='BLUE';
 408                         }elsif ($configline[2] eq 'ipsec') {
 409                                 print LOG "$now -> Rule not converted, ipsec+ interface is obsolet since IPFire 2.7 \n";
 410                                 next;
 411                         }elsif ($configline[2] eq 'ovpn') {
 412                                 print LOG "$now ->Creating networks/groups for OpenVPN...\n";
 413                                 &build_ovpn_grp;
 414                                 $grp1='cust_grp_src';
 415                                 $source='ovpn'
 416                         }elsif ($configline[2] eq 'ip') {
 417                                 my $z=&check_ip($configline[5]);
 418                                 if($z){
 419                                         my ($ipa,$subn) = split("/",$z);
 420                                         $subn=&General::iporsubtocidr($subn);
 421                                         $grp1='src_addr';
 422                                         $source="$ipa/$subn";
 423                                 }else{
 424                                         print LOG "$now -> Rule not converted, missing/invalid source ip \"$configline[5]\"\n";
 425                                         next;
 426                                 }
 427                         }elsif ($configline[2] eq 'mac') {
 428                                 if(&General::validmac($configline[6])){
 429                                         $grp1='src_addr';
 430                                         $source=$configline[6];
 431                                 }else{
 432                                         print LOG"$now -> Rule not converted, invalid MAC \"$configline[6]\" \n";
 433                                         next;
 434                                 }
 435                         }elsif ($configline[2] eq 'all') {
 436                                 $grp1='std_net_src';
 437                                 $source='ALL';
 438                         }else{
 439                                 foreach my $key (sort keys %groups){
 440                                         if($groups{$key}[0] eq $configline[2]){
 441                                                 $grp1='cust_grp_src';
 442                                                 $source=$configline[2];
 443                                         }
 444                                 }
 445                                 if ($grp1 eq '' || $source eq ''){
 446                                         print LOG "$now -> Rule not converted, no valid source recognised\n";
 447                                 }
 448                         }
 449                         ############################################################
 450                         #destinationpart
 451                         if($configline[7] ne ''){
 452                                 my $address=&check_ip($configline[7]);
 453                                  if($address){
 454                                          my ($dip,$dsub) = split("/",$address);
 455                                          $dsub=&General::iporsubtocidr($dsub);
 456                                          $grp2='tgt_addr';
 457                                          $target="$dip/$dsub";
 458                                  }elsif(!$address){
 459                                         my $getwebsiteip=&get_ip_from_domain($configline[7]);
 460                                         if ($getwebsiteip){
 461                                                 $grp2='tgt_addr';
 462                                                 $target=$getwebsiteip;
 463                                                 $remark.=" $configline[7]";
 464                                         }else{
 465                                                 print LOG "$now -> Rule not converted, invalid domain \"$configline[7]\"\n";
 466                                                 next;
 467                                         }
 468                                  }
 469                         }else{
 470                                 $grp2='std_net_tgt';
 471                                 $target='ALL';
 472                         }
 473                         if($configline[8] ne '' && $configline[3] ne 'gre' && $configline[3] ne 'esp'){
 474                                 my @values=();
 475                                 my @parts=split(",",$configline[8]);
 476                                 foreach (@parts){
 477                                         $_=~ tr/-/:/;
 478                                         if (!($_ =~ /^(\d+)\:(\d+)$/)) {
 479                                                 if(&General::validport($_)){
 480                                                         $useport='ON';
 481                                                         push (@values,$_);
 482                                                         $grp3='TGT_PORT';
 483                                                 }else{
 484                                                         print LOG "$now -> Rule not converted, invalid destination Port \"$configline[8]\"\n";
 485                                                         next;
 486                                                 }
 487                                          }else{
 488                                                 my ($a1,$a2) = split(/\:/,$_);
 489                                                 if (&General::validport($a1) && &General::validport($a2) && $a1 < $a2){
 490                                                         $useport='ON';
 491                                                         push (@values,"$a1:$a2");
 492                                                         $grp3='TGT_PORT';
 493                                                 }else{
 494                                                         print LOG "$now -> Rule not converted, invalid destination Port \"$configline[8]\"\n";
 495                                                         next;
 496                                                 }
 497                                          }
 498                                  }
 499                                 $port=join("|",@values);
 500                                 @values=();
 501                                 @parts=();
 502                         }
 503                 }else{
 504                         print LOG "-> Rule not converted because not for Firewall mode $outsettings{'POLICY'} (we are only converting for actual mode)\n";
 505                 }
 506                 &General::readhasharray($fwdfwconfig,\%fwconfig);
 507                 &General::readhasharray($outfwconfig,\%fwconfigout);
 508                 my $check;
 509                 my $chain;
 510                 foreach my $protocol (@prot){
 511                         my $now=localtime;
 512                         if ($source eq 'IPFire'){
 513                                 $chain='OUTGOINGFW';
 514                         }else{
 515                                 $chain='FORWARDFW';
 516                         }
 517                         $protocol=uc($protocol);
 518                         print LOG "$now -> Converted: $action,$chain,$active,$grp1,$source,$grp2,$target,,,,,$useport,$protocol,,$grp3,$port,$remark,$log,$time,$time_mon,$time_tue,$time_wed,$time_thu,$time_fri,$time_sat,$time_sun,$time_from,$time_to\n";
 519                         #Put rules into system....
 520                         ###########################
 521                         #check for double rules
 522                         foreach my $key (sort keys %fwconfig){
 523                                 if("$action,$chain,$active,$grp1,$source,$grp2,$target,,,,,$useport,$protocol,,$grp3,$port,$remark,$log,$time,$time_mon,$time_tue,$time_wed,$time_thu,$time_fri,$time_sat,$time_sun,$time_from,$time_to"
 524                                         eq "$fwconfig{$key}[0],$fwconfig{$key}[1],$fwconfig{$key}[2],$fwconfig{$key}[3],$fwconfig{$key}[4],$fwconfig{$key}[5],$fwconfig{$key}[6],,,,,$fwconfig{$key}[11],$fwconfig{$key}[12],,$fwconfig{$key}[14],$fwconfig{$key}[15],$fwconfig{$key}[16],$fwconfig{$key}[17],$fwconfig{$key}[18],$fwconfig{$key}[19],$fwconfig{$key}[20],$fwconfig{$key}[21],$fwconfig{$key}[22],$fwconfig{$key}[23],$fwconfig{$key}[24],$fwconfig{$key}[25],$fwconfig{$key}[26],$fwconfig{$key}[27]"){
 525                                                 $check='on';
 526                                                 next;
 527                                 }
 528                         }
 529                         if($check ne 'on'){
 530                                 #increase groupcounter
 531                                 my $check1;
 532                                 if($grp1 eq 'cust_grp_src'){
 533                                         foreach my $key (sort keys %groups){
 534                                                 if($groups{$key}[0] eq $source){
 535                                                         $groups{$key}[4]++;
 536                                                         $check1='on';
 537                                                 }
 538                                         }
 539                                         if($check1 eq 'on'){
 540                                                 &General::writehasharray($configgroups,\%groups);
 541                                         }
 542                                 }
 543                                 if ($chain eq 'FORWARDFW'){
 544                                         my $key = &General::findhasharraykey(\%fwconfig);
 545                                         $fwconfig{$key}[0]      = $action;
 546                                         $fwconfig{$key}[1]      = $chain;
 547                                         $fwconfig{$key}[2]      = $active;
 548                                         $fwconfig{$key}[3]      = $grp1;
 549                                         $fwconfig{$key}[4]      = $source;
 550                                         $fwconfig{$key}[5]      = $grp2;
 551                                         $fwconfig{$key}[6]      = $target;
 552                                         $fwconfig{$key}[11] = $useport;
 553                                         $fwconfig{$key}[12] = $protocol;
 554                                         $fwconfig{$key}[14] = $grp3;
 555                                         $fwconfig{$key}[15] = $port;
 556                                         $fwconfig{$key}[16] = $remark;
 557                                         $fwconfig{$key}[17] = $log;
 558                                         $fwconfig{$key}[18] = $time;
 559                                         $fwconfig{$key}[19] = $time_mon;
 560                                         $fwconfig{$key}[20] = $time_tue;
 561                                         $fwconfig{$key}[21] = $time_wed;
 562                                         $fwconfig{$key}[22] = $time_thu;
 563                                         $fwconfig{$key}[23] = $time_fri;
 564                                         $fwconfig{$key}[24] = $time_sat;
 565                                         $fwconfig{$key}[25] = $time_sun;
 566                                         $fwconfig{$key}[26] = $time_from;
 567                                         $fwconfig{$key}[27] = $time_to;
 568                                         $fwconfig{$key}[28] = '';
 569                                         $fwconfig{$key}[29] = 'ALL';
 570                                         $fwconfig{$key}[30] = '';
 571                                         $fwconfig{$key}[31] = 'dnat';
 572                                 }else{
 573                                         my $key = &General::findhasharraykey(\%fwconfigout);
 574                                         $fwconfigout{$key}[0]   = $action;
 575                                         $fwconfigout{$key}[1]   = $chain;
 576                                         $fwconfigout{$key}[2]   = $active;
 577                                         $fwconfigout{$key}[3]   = $grp1;
 578                                         $fwconfigout{$key}[4]   = $source;
 579                                         $fwconfigout{$key}[5]   = $grp2;
 580                                         $fwconfigout{$key}[6]   = $target;
 581                                         $fwconfigout{$key}[11]  = $useport;
 582                                         $fwconfigout{$key}[12]  = $protocol;
 583                                         $fwconfigout{$key}[14]  = $grp3;
 584                                         $fwconfigout{$key}[15]  = $port;
 585                                         $fwconfigout{$key}[16]  = $remark;
 586                                         $fwconfigout{$key}[17]  = $log;
 587                                         $fwconfigout{$key}[18]  = $time;
 588                                         $fwconfigout{$key}[19]  = $time_mon;
 589                                         $fwconfigout{$key}[20]  = $time_tue;
 590                                         $fwconfigout{$key}[21]  = $time_wed;
 591                                         $fwconfigout{$key}[22]  = $time_thu;
 592                                         $fwconfigout{$key}[23]  = $time_fri;
 593                                         $fwconfigout{$key}[24]  = $time_sat;
 594                                         $fwconfigout{$key}[25]  = $time_sun;
 595                                         $fwconfigout{$key}[26]  = $time_from;
 596                                         $fwconfigout{$key}[27]  = $time_to;
 597                                         $fwconfigout{$key}[28]  = '';
 598                                         $fwconfigout{$key}[29]  = 'ALL';
 599                                         $fwconfigout{$key}[30]  = '';
 600                                         $fwconfigout{$key}[31]  = 'dnat';
 601                                 }
 602                                 &General::writehasharray($fwdfwconfig,\%fwconfig);
 603                                 &General::writehasharray($outfwconfig,\%fwconfigout);
 604                         }
 605                 }
 606                 @prot=();
 607         }
 608         close(LOG);
 609         @lines=();
 610 }
 611 sub get_ip_from_domain
 612 {
 613         $web=shift;
 614         my $resolvedip;
 615         my $checked;
 616         my ($name,$aliases,$addrtype,$length,@addrs) = gethostbyname($web);
 617         if(@addrs){
 618                 $resolvedip=inet_ntoa($addrs[0]);
 619                 return $resolvedip;
 620         }
 621         return;
 622 }
 623 sub build_ovpn_grp
 624 {
 625         my $now=localtime;
 626         &General::readhasharray($confighosts,\%hosts);
 627         &General::readhasharray($confignets,\%nets);
 628         &General::readhasharray($configgroups,\%groups);
 629         &General::readhasharray($ovpnconfig,\%configovpn);
 630         &General::readhasharray($ccdconfig,\%ccdconf);
 631         &General::readhash($ovpnsettings,\%settingsovpn);
 632         #get ovpn nets
 633         my @ovpnnets=();
 634         if($settingsovpn{'DOVPN_SUBNET'}){
 635                 my ($net,$subnet)=split("/",$settingsovpn{'DOVPN_SUBNET'});
 636                 push (@ovpnnets,"$net,$subnet,dynamic");
 637                 print LOG "$now ->found dynamic OpenVPN net\n";
 638         }
 639         foreach my $key (sort keys %ccdconf){
 640                 my ($net,$subnet)=split("/",$ccdconf{$key}[1]);
 641                 $subnet=&General::iporsubtodec($subnet);
 642                 push (@ovpnnets,"$net,$subnet,$ccdconf{$key}[0]");
 643                 print LOG "$now ->found OpenVPN static net $net/$subnet\n";
 644         }
 645         foreach my $key (sort keys %configovpn){
 646                 if ($configovpn{$key}[3] eq 'net'){
 647                         my ($net,$subnet)=split("/",$configovpn{$key}[27]);
 648                         push (@ovpnnets,"$net,$subnet,$configovpn{$key}[2]");
 649                         print LOG "$now ->found OpenVPN $net/$subnet $configovpn{$key}[2]\n";
 650                 }
 651         }
 652         #add ovpn nets to customnetworks/groups
 653         foreach my $line (@ovpnnets){
 654                 my $now=localtime;
 655                 my ($net,$subnet,$name) = split(",",$line);
 656                 if (!&check_net($net,$subnet)){
 657                         my $netkey      =  &General::findhasharraykey(\%nets);
 658                         $name2=$name."(ovpn)".$net;
 659                         $name3="Custom Network";
 660                         $nets{$netkey}[0] = $name2;
 661                         $nets{$netkey}[1] = $net;
 662                         $nets{$netkey}[2] = $subnet;
 663                         $nets{$netkey}[3] = '';
 664                         $nets{$netkey}[4] = 1;
 665                         print LOG "$now ->added $name2 $net/$subnet to customnetworks\n";
 666                 }else{
 667                         print LOG "-> Custom Network with same IP already exist \"$net/$subnet\" (you can ignore this, if this run was manual from shell)\n";
 668                 }
 669                 if($name2){
 670                         my $grpkey      = &General::findhasharraykey(\%groups);
 671                         $groups{$grpkey}[0]     = "ovpn";
 672                         $groups{$grpkey}[1]     = '';
 673                         $groups{$grpkey}[2]     = $name2;
 674                         $groups{$grpkey}[3]     = "Custom Network";
 675                         $groups{$grpkey}[4]     = 0;
 676                         print LOG "$now ->added $name2 to customgroup ovpn\n";
 677                 }
 678                 $name2='';
 679         }
 680         @ovpnnets=();
 681         &General::writehasharray($confighosts,\%hosts);
 682         &General::writehasharray($configgroups,\%groups);
 683         &General::writehasharray($confignets,\%nets);
 684         print LOG "$now ->finished OVPN\n";
 685 }
 686 sub process_p2p
 687 {
 688         copy("/var/ipfire/outgoing/p2protocols","/var/ipfire/forward/p2protocols");
 689         chmod oct('0777'), '/var/ipfire/forward/p2protocols';
 690 }