]>
git.ipfire.org Git - people/teissler/ipfire-2.x.git/blob - config/forwardfw/convert-outgoingfw
54ba709875a66feffff7f18a874fe40d80c1b924
2 ########################################################################
3 # Script: convert-outgoingfw
5 # Author: Alexander Marx (amarx@ipfire.org)
6 ########################################################################
8 # This script converts old groups and firewallrules
9 # to the new one. This is a 3-step process.
10 # STEP1: convert groups ->LOG /var/log/converters
11 # STEP2: convert rules ->LOG /var/log/converters
12 # STEP3: convert P2P rules
14 ########################################################################
16 require '/var/ipfire/general-functions.pl';
22 my $ipgrouppath = "${General::swroot}/outgoing/groups/ipgroups/";
23 my $macgrouppath = "${General::swroot}/outgoing/groups/macgroups/";
24 my $outgoingrules = "${General::swroot}/outgoing/rules";
25 my $outfwsettings = "${General::swroot}/outgoing/settings";
26 my $host = "Converted ";
27 my $confighosts = "${General::swroot}/fwhosts/customhosts";
28 my $confignets = "${General::swroot}/fwhosts/customnetworks";
29 my $configgroups = "${General::swroot}/fwhosts/customgroups";
30 my $ovpnsettings = "${General::swroot}/ovpn/settings";
31 my $ovpnconfig = "${General::swroot}/ovpn/ovpnconfig";
32 my $ccdconfig = "${General::swroot}/ovpn/ccd.conf";
33 my $fwdfwconfig = "${General::swroot}/forward/config";
34 my $outfwconfig = "${General::swroot}/forward/outgoing";
35 my $fwdfwsettings = "${General::swroot}/forward/settings";
36 my @ipgroups = qx(ls
$ipgrouppath);
37 my @macgroups = qx(ls
$macgrouppath);
49 &General
::readhash
($outfwsettings,\
%outsettings);
50 #ONLY RUN if /var/ipfire/outgoing exists
51 if ( -d
"/var/ipfire/outgoing"){
56 system("/usr/local/bin/forwardfwctrl");
59 if(! -d
"/var/log/converters"){ mkdir("/var/log/converters");}
60 if( -f
"/var/log/converters/groups-convert.log"){rmtree
("var/log/converters");}
61 open (LOG
, ">/var/log/converters/groups-convert.log") or die $!;
63 foreach my $group (@ipgroups){
66 print LOG
"\n$now Processing IP-GROUP: $group...\n";
67 open (DATEI
, "<$ipgrouppath/$group");
69 foreach my $ip (@zeilen){
72 print LOG
"$now Check IP $ip from Group $group ";
73 my $val=&check_ip
($ip);
75 push(@hostarray,$val.",ip");
76 print LOG
"$now -> OK\n";
79 print LOG
"$now -> IP \"$ip\" from group $group not converted (invalid IP) \n";
83 &new_hostgrp
($group,'ip');
90 foreach my $group (@macgroups){
92 print LOG
"\nProcessing MAC-GROUP: $group...\n";
93 open (DATEI
, "<$macgrouppath/$group");
95 foreach my $mac (@zeilen){
98 print LOG
"$now Checking MAC $mac from group $group ";
100 if(&General
::validmac
($mac)){
104 push(@hostarray,$val.",mac");
105 print LOG
"$now -> OK\n";
108 print LOG
"$now -> Mac $mac from group $group not converted (invalid MAC)\n";
112 &new_hostgrp
($group,'mac');
122 #ip with subnet in decimal
123 if($adr =~ m/^(\d\d?\d?).(\d\d?\d?).(\d\d?\d?).(\d\d?\d?)\/(\d
{1,2})$/){
124 $adr=int($1).".".int($2).".".int($3).".".int($4);
125 my $b = &General
::iporsubtodec
($5);
127 }elsif($adr =~ /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/){
128 $adr=int($1).".".int($2).".".int($3).".".int($4);
129 if(&General
::validip
($adr)){
130 $a=$adr."/255.255.255.255";
133 if(&General
::validipandmask
($adr)){
134 $a=&General
::iporsubtodec
($adr);
140 &General
::readhasharray
($confighosts,\
%hosts);
141 &General
::readhasharray
($confignets,\
%nets);
142 &General
::readhasharray
($configgroups,\
%groups);
145 my $name; #"converted"
147 my $name3; #custom host/custom net
148 foreach my $adr (@hostarray){
150 my ($ip,$type) = split(",",$adr);
151 my ($ippart,$subnet) = split("/",$ip);
152 my ($byte1,$byte2,$byte3,$byte4) = split(/\./,$subnet);
154 print LOG
"Processing SINGLE HOST $ippart/$subnet from group $grp\n";
155 if(!&check_host
($ip)){
156 my $key = &General
::findhasharraykey
(\
%hosts);
158 $name2=$name.$ippart;
159 $name3="Custom Host";
160 $hosts{$key}[0] = $name2;
161 $hosts{$key}[1] = $type;
162 $hosts{$key}[2] = $ip;
163 $hosts{$key}[3] = '';
165 print LOG
"->Host (IP) $ip added to custom hosts\n"
167 print LOG
"->Host (IP) $ip already exists in custom hosts\n";
169 $name2=$name.$ippart;
170 foreach my $key (sort keys %hosts){
171 if($hosts{$key}[0] eq $name2){
176 $name2=$name.$ippart;
177 $name3="Custom Host";
179 }elsif($byte4 < '255'){
180 print LOG
"Processing NETWORK $ippart/$subnet from Group $grp\n";
181 if(!&check_net
($ippart,$subnet)){
182 my $netkey = &General
::findhasharraykey
(\
%nets);
184 $name2=$name.$ippart;
185 $name3="Custom Network";
186 $nets{$netkey}[0] = $name2;
187 $nets{$netkey}[1] = $ippart;
188 $nets{$netkey}[2] = $subnet;
189 $nets{$netkey}[3] = '';
190 $nets{$netkey}[4] = 1;
191 print LOG
"->Network $ippart/$subnet added to custom networks\n";
193 print LOG
"Network $ippart already exists in custom networks\n";
195 $name2=$name.$ippart;
196 foreach my $key (sort keys %nets){
197 if($nets{$key}[0] eq $name2){
202 $name2=$name.$ippart;
203 $name3="Custom Network";
206 if($name2 && !&check_grp
($grp,$name2)){
207 my $grpkey = &General
::findhasharraykey
(\
%groups);
208 $groups{$grpkey}[0] = $grp;
209 $groups{$grpkey}[1] = '';
210 $groups{$grpkey}[2] = $name2;
211 $groups{$grpkey}[3] = $name3;
212 $groups{$grpkey}[4] = 0;
213 print LOG
"->$name2 added to group $grp\n";
215 }elsif($run eq 'mac'){
217 my ($mac,$type) = split(",",$adr);
218 print LOG
"Processing HOST (MAC) $mac\n";
219 if(!&check_host
($mac)){
220 my $key = &General
::findhasharraykey
(\
%hosts);
223 $name3="Custom Host";
224 $hosts{$key}[0] = $name2;
225 $hosts{$key}[1] = $type;
226 $hosts{$key}[2] = $mac;
227 $hosts{$key}[3] = '';
229 print LOG
"->Host (MAC) $mac added to custom hosts\n";
231 print LOG
"->Host (MAC) $mac already exists in custom hosts \n";
234 foreach my $key (sort keys %hosts){
235 if($hosts{$key}[0] eq $name2){
241 $name3="Custom Host";
243 if($name2 && !&check_grp
($grp,$name2)){
244 my $grpkey = &General
::findhasharraykey
(\
%groups);
245 $groups{$grpkey}[0] = $grp;
246 $groups{$grpkey}[1] = '';
247 $groups{$grpkey}[2] = $name2;
248 $groups{$grpkey}[3] = $name3;
249 $groups{$grpkey}[4] = 0;
250 print LOG
"->$name2 added to group $grp\n";
255 &General
::writehasharray
($confighosts,\
%hosts);
256 &General
::writehasharray
($configgroups,\
%groups);
257 &General
::writehasharray
($confignets,\
%nets);
263 foreach my $key (sort keys %hosts)
265 if($hosts{$key}[2] eq $ip)
276 foreach my $key (sort keys %nets)
278 if($nets{$key}[1] eq $ip && $nets{$key}[2] eq $sub)
289 foreach my $key (sort keys %groups)
291 if($groups{$key}[0] eq $grp && $groups{$key}[2] eq $value)
300 my ($type,$action,$active,$grp1,$source,$grp2,$useport,$port,$prot,$grp3,$target,$remark,$log,$time,$time_mon,$time_tue,$time_wed,$time_thu,$time_fri,$time_sat,$time_sun,$time_from,$time_to);
302 if( -f
"/var/log/converters/outgoingfw-convert.log"){unlink ("/var/log/converters/outgoingfw-convert.log");}
303 open (LOG
, ">/var/log/converters/outgoingfw-convert.log") or die $!;
305 &General
::readhash
($fwdfwsettings,\
%fwdsettings);
306 if ($outsettings{'POLICY'} eq 'MODE1'){
307 $fwdsettings{'POLICY'}='MODE1';
308 $fwdsettings{'POLICY1'}='MODE2';
312 $fwdsettings{'POLICY'}='MODE2';
313 $fwdsettings{'POLICY1'}='MODE2';
317 &General
::writehash
($fwdfwsettings,\
%fwdsettings);
318 open (DATEI
, "<$outgoingrules");
320 foreach my $rule (@lines)
325 print LOG
"$now processing: $rule\n";
327 @configline = split( /\;/, $rule );
329 if($configline[0] eq $type){
330 #some variables we can use from old config
331 if($configline[1] eq 'on'){ $active='ON';}else{$active='';}
332 if($configline[3] eq 'all' && $configline[8] ne ''){
335 }elsif($configline[3] eq 'all' && $configline[8] eq ''){
338 push(@prot,$configline[3]);
340 if($configline[4] ne ''){
341 $configline[4] =~ s/,/;/g;
342 $remark = $configline[4];
344 if($configline[9] eq 'Active'){ $log='ON';}else{$log='';}
345 if($configline[10] eq 'on' && $configline[11] eq 'on' && $configline[12] eq 'on' && $configline[13] eq 'on' && $configline[14] eq 'on' && $configline[15] eq 'on' && $configline[16] eq 'on'){
346 if($configline[17] eq '00:00' && $configline[18] eq '00:00'){
354 $time_mon=$configline[10];
355 $time_tue=$configline[11];
356 $time_wed=$configline[12];
357 $time_thu=$configline[13];
358 $time_fri=$configline[14];
359 $time_sat=$configline[15];
360 $time_sun=$configline[16];
361 $time_from=$configline[17];
362 $time_to=$configline[18];
363 ############################################################
365 if ($configline[2] eq 'green') {
368 }elsif ($configline[2] eq 'orange') {
371 }elsif ($configline[2] eq 'red') {
374 &General
::readhash
($fwdfwsettings,\
%fwdsettings);
375 $fwdsettings{'POLICY1'}=$outsettings{'POLICY'};
376 $fwdsettings{'POLICY'}=$outsettings{'POLICY'};
377 &General
::writehash
($fwdfwsettings,\
%fwdsettings);
378 }elsif ($configline[2] eq 'blue') {
381 }elsif ($configline[2] eq 'ipsec') {
382 print LOG
"$now -> Rule not converted, ipsec+ interface is obsolet since IPFire 2.7 \n";
384 }elsif ($configline[2] eq 'ovpn') {
385 print LOG
"$now ->Creating networks/groups for OpenVPN...\n";
387 $grp1='cust_grp_src';
389 }elsif ($configline[2] eq 'ip') {
390 my $z=&check_ip
($configline[5]);
392 my ($ipa,$subn) = split("/",$z);
393 $subn=&General
::iporsubtocidr
($subn);
395 $source="$ipa/$subn";
397 print LOG
"$now -> Rule not converted, missing/invalid source ip \"$configline[5]\"\n";
400 }elsif ($configline[2] eq 'mac') {
401 if(&General
::validmac
($configline[6])){
403 $source=$configline[6];
405 print LOG
"$now -> Rule not converted, invalid MAC \"$configline[6]\" \n";
408 }elsif ($configline[2] eq 'all') {
412 foreach my $key (sort keys %groups){
413 if($groups{$key}[0] eq $configline[2]){
414 $grp1='cust_grp_src';
415 $source=$configline[2];
418 if ($grp1 eq '' || $source eq ''){
419 print LOG
"$now -> Rule not converted, no valid source recognised\n";
422 ############################################################
424 if($configline[7] ne ''){
425 my $address=&check_ip
($configline[7]);
427 my ($dip,$dsub) = split("/",$address);
428 $dsub=&General
::iporsubtocidr
($dsub);
430 $target="$dip/$dsub";
432 my $getwebsiteip=&get_ip_from_domain
($configline[7]);
435 $target=$getwebsiteip;
436 $remark.=" $configline[7]";
438 print LOG
"$now -> Rule not converted, invalid domain \"$configline[7]\"\n";
446 if($configline[8] ne '' && $configline[3] ne 'gre' && $configline[3] ne 'esp'){
448 my @parts=split(",",$configline[8]);
451 if (!($_ =~ /^(\d+)\:(\d+)$/)) {
452 if(&General
::validport
($_)){
457 print LOG
"$now -> Rule not converted, invalid destination Port \"$configline[8]\"\n";
461 my ($a1,$a2) = split(/\:/,$_);
462 if (&General
::validport
($a1) && &General
::validport
($a2) && $a1 < $a2){
464 push (@values,"$a1:$a2");
467 print LOG
"$now -> Rule not converted, invalid destination Port \"$configline[8]\"\n";
472 $port=join("|",@values);
477 print LOG
"-> Rule not converted because not for Firewall mode $outsettings{'POLICY'} (we are only converting for actual mode)\n";
479 &General
::readhasharray
($fwdfwconfig,\
%fwconfig);
480 &General
::readhasharray
($outfwconfig,\
%fwconfigout);
483 foreach my $protocol (@prot){
485 if ($source eq 'IPFire'){
490 $protocol=uc($protocol);
491 print LOG
"$now -> Converted: $action,$chain,$active,$grp1,$source,$grp2,$target,,,,,$useport,$protocol,,$grp3,$port,$remark,$log,$time,$time_mon,$time_tue,$time_wed,$time_thu,$time_fri,$time_sat,$time_sun,$time_from,$time_to\n";
492 #Put rules into system....
493 ###########################
494 #check for double rules
495 foreach my $key (sort keys %fwconfig){
496 if("$action,$chain,$active,$grp1,$source,$grp2,$target,,,,,$useport,$protocol,,$grp3,$port,$remark,$log,$time,$time_mon,$time_tue,$time_wed,$time_thu,$time_fri,$time_sat,$time_sun,$time_from,$time_to"
497 eq "$fwconfig{$key}[0],$fwconfig{$key}[1],$fwconfig{$key}[2],$fwconfig{$key}[3],$fwconfig{$key}[4],$fwconfig{$key}[5],$fwconfig{$key}[6],,,,,$fwconfig{$key}[11],$fwconfig{$key}[12],,$fwconfig{$key}[14],$fwconfig{$key}[15],$fwconfig{$key}[16],$fwconfig{$key}[17],$fwconfig{$key}[18],$fwconfig{$key}[19],$fwconfig{$key}[20],$fwconfig{$key}[21],$fwconfig{$key}[22],$fwconfig{$key}[23],$fwconfig{$key}[24],$fwconfig{$key}[25],$fwconfig{$key}[26],$fwconfig{$key}[27]"){
503 #increase groupcounter
505 if($grp1 eq 'cust_grp_src'){
506 foreach my $key (sort keys %groups){
507 if($groups{$key}[0] eq $source){
513 &General
::writehasharray
($configgroups,\
%groups);
516 if ($chain eq 'FORWARDFW'){
517 my $key = &General
::findhasharraykey
(\
%fwconfig);
518 $fwconfig{$key}[0] = $action;
519 $fwconfig{$key}[1] = $chain;
520 $fwconfig{$key}[2] = $active;
521 $fwconfig{$key}[3] = $grp1;
522 $fwconfig{$key}[4] = $source;
523 $fwconfig{$key}[5] = $grp2;
524 $fwconfig{$key}[6] = $target;
525 $fwconfig{$key}[11] = $useport;
526 $fwconfig{$key}[12] = $protocol;
527 $fwconfig{$key}[14] = $grp3;
528 $fwconfig{$key}[15] = $port;
529 $fwconfig{$key}[16] = $remark;
530 $fwconfig{$key}[17] = $log;
531 $fwconfig{$key}[18] = $time;
532 $fwconfig{$key}[19] = $time_mon;
533 $fwconfig{$key}[20] = $time_tue;
534 $fwconfig{$key}[21] = $time_wed;
535 $fwconfig{$key}[22] = $time_thu;
536 $fwconfig{$key}[23] = $time_fri;
537 $fwconfig{$key}[24] = $time_sat;
538 $fwconfig{$key}[25] = $time_sun;
539 $fwconfig{$key}[26] = $time_from;
540 $fwconfig{$key}[27] = $time_to;
542 my $key = &General
::findhasharraykey
(\
%fwconfigout);
543 $fwconfigout{$key}[0] = $action;
544 $fwconfigout{$key}[1] = $chain;
545 $fwconfigout{$key}[2] = $active;
546 $fwconfigout{$key}[3] = $grp1;
547 $fwconfigout{$key}[4] = $source;
548 $fwconfigout{$key}[5] = $grp2;
549 $fwconfigout{$key}[6] = $target;
550 $fwconfigout{$key}[11] = $useport;
551 $fwconfigout{$key}[12] = $protocol;
552 $fwconfigout{$key}[14] = $grp3;
553 $fwconfigout{$key}[15] = $port;
554 $fwconfigout{$key}[16] = $remark;
555 $fwconfigout{$key}[17] = $log;
556 $fwconfigout{$key}[18] = $time;
557 $fwconfigout{$key}[19] = $time_mon;
558 $fwconfigout{$key}[20] = $time_tue;
559 $fwconfigout{$key}[21] = $time_wed;
560 $fwconfigout{$key}[22] = $time_thu;
561 $fwconfigout{$key}[23] = $time_fri;
562 $fwconfigout{$key}[24] = $time_sat;
563 $fwconfigout{$key}[25] = $time_sun;
564 $fwconfigout{$key}[26] = $time_from;
565 $fwconfigout{$key}[27] = $time_to;
567 &General
::writehasharray
($fwdfwconfig,\
%fwconfig);
568 &General
::writehasharray
($outfwconfig,\
%fwconfigout);
576 sub get_ip_from_domain
581 my ($name,$aliases,$addrtype,$length,@addrs) = gethostbyname($web);
583 $resolvedip=inet_ntoa
($addrs[0]);
591 &General
::readhasharray
($confighosts,\
%hosts);
592 &General
::readhasharray
($confignets,\
%nets);
593 &General
::readhasharray
($configgroups,\
%groups);
594 &General
::readhasharray
($ovpnconfig,\
%configovpn);
595 &General
::readhasharray
($ccdconfig,\
%ccdconf);
596 &General
::readhash
($ovpnsettings,\
%settingsovpn);
599 if($settingsovpn{'DOVPN_SUBNET'}){
600 my ($net,$subnet)=split("/",$settingsovpn{'DOVPN_SUBNET'});
601 push (@ovpnnets,"$net,$subnet,dynamic");
602 print LOG
"$now ->found dynamic OpenVPN net\n";
604 foreach my $key (sort keys %ccdconf){
605 my ($net,$subnet)=split("/",$ccdconf{$key}[1]);
606 $subnet=&General
::iporsubtodec
($subnet);
607 push (@ovpnnets,"$net,$subnet,$ccdconf{$key}[0]");
608 print LOG
"$now ->found OpenVPN static net $net/$subnet\n";
610 foreach my $key (sort keys %configovpn){
611 if ($configovpn{$key}[3] eq 'net'){
612 my ($net,$subnet)=split("/",$configovpn{$key}[27]);
613 push (@ovpnnets,"$net,$subnet,$configovpn{$key}[2]");
614 print LOG
"$now ->found OpenVPN $net/$subnet $configovpn{$key}[2]\n";
617 #add ovpn nets to customnetworks/groups
618 foreach my $line (@ovpnnets){
620 my ($net,$subnet,$name) = split(",",$line);
621 if (!&check_net
($net,$subnet)){
622 my $netkey = &General
::findhasharraykey
(\
%nets);
623 $name2=$name."(ovpn)".$net;
624 $name3="Custom Network";
625 $nets{$netkey}[0] = $name2;
626 $nets{$netkey}[1] = $net;
627 $nets{$netkey}[2] = $subnet;
628 $nets{$netkey}[3] = '';
629 $nets{$netkey}[4] = 1;
630 print LOG
"$now ->added $name2 $net/$subnet to customnetworks\n";
632 print LOG
"-> Custom Network with same IP already exist \"$net/$subnet\" (you can ignore this, if this run was manual from shell)\n";
635 my $grpkey = &General
::findhasharraykey
(\
%groups);
636 $groups{$grpkey}[0] = "ovpn";
637 $groups{$grpkey}[1] = '';
638 $groups{$grpkey}[2] = $name2;
639 $groups{$grpkey}[3] = "Custom Network";
640 $groups{$grpkey}[4] = 0;
641 print LOG
"$now ->added $name2 to customgroup ovpn\n";
646 &General
::writehasharray
($confighosts,\
%hosts);
647 &General
::writehasharray
($configgroups,\
%groups);
648 &General
::writehasharray
($confignets,\
%nets);
649 print LOG
"$now ->finished OVPN\n";
653 copy
("/var/ipfire/outgoing/p2protocols","/var/ipfire/forward/p2protocols");
654 chmod oct('0777'), '/var/ipfire/forward/p2protocols';