config/forwardfw/firewall-lib.pl

   1 #!/usr/bin/perl
   2 ###############################################################################
   3 #                                                                             #
   4 # IPFire.org - A linux based firewall                                         #
   5 # Copyright (C) 2012                                                                                                              #
   6 #                                                                             #
   7 # This program is free software: you can redistribute it and/or modify        #
   8 # it under the terms of the GNU General Public License as published by        #
   9 # the Free Software Foundation, either version 3 of the License, or           #
  10 # (at your option) any later version.                                         #
  11 #                                                                             #
  12 # This program is distributed in the hope that it will be useful,             #
  13 # but WITHOUT ANY WARRANTY; without even the implied warranty of              #
  14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
  15 # GNU General Public License for more details.                                #
  16 #                                                                             #
  17 # You should have received a copy of the GNU General Public License           #
  18 # along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
  19 #                                                                             #
  20 ###############################################################################
  21
  22
  23 use strict;
  24 no warnings 'uninitialized';
  25
  26 package fwlib;
  27
  28 my %customnetwork=();
  29 my %customhost=();
  30 my %customgrp=();
  31 my %customservice=();
  32 my %customservicegrp=();
  33 my %ccdnet=();
  34 my %ccdhost=();
  35 my %ipsecconf=();
  36 my %ipsecsettings=();
  37 my %netsettings=();
  38 my %ovpnsettings=();
  39
  40 require '/var/ipfire/general-functions.pl';
  41
  42 my $confignet           = "${General::swroot}/fwhosts/customnetworks";
  43 my $confighost          = "${General::swroot}/fwhosts/customhosts";
  44 my $configgrp           = "${General::swroot}/fwhosts/customgroups";
  45 my $configsrv           = "${General::swroot}/fwhosts/customservices";
  46 my $configsrvgrp        = "${General::swroot}/fwhosts/customservicegrp";
  47 my $configccdnet        = "${General::swroot}/ovpn/ccd.conf";
  48 my $configccdhost       = "${General::swroot}/ovpn/ovpnconfig";
  49 my $configipsec         = "${General::swroot}/vpn/config";
  50 my $configovpn          = "${General::swroot}/ovpn/settings";
  51 my $val;
  52 my $field;
  53
  54 &General::readhash("/var/ipfire/ethernet/settings", \%netsettings);
  55 &General::readhash("${General::swroot}/ovpn/settings", \%ovpnsettings);
  56 &General::readhash("${General::swroot}/vpn/settings", \%ipsecsettings);
  57
  58
  59 &General::readhasharray("$confignet", \%customnetwork);
  60 &General::readhasharray("$confighost", \%customhost);
  61 &General::readhasharray("$configgrp", \%customgrp);
  62 &General::readhasharray("$configccdnet", \%ccdnet);
  63 &General::readhasharray("$configccdhost", \%ccdhost);
  64 &General::readhasharray("$configipsec", \%ipsecconf);
  65 &General::readhasharray("$configsrv", \%customservice);
  66 &General::readhasharray("$configsrvgrp", \%customservicegrp);
  67
  68 sub get_srv_prot
  69 {
  70         my $val=shift;
  71         foreach my $key (sort keys %customservice){
  72                 if($customservice{$key}[0] eq $val){
  73                         if ($customservice{$key}[0] eq $val){
  74                                 return $customservice{$key}[2];
  75                         }
  76                 }
  77         }
  78 }
  79 sub get_srvgrp_prot
  80 {
  81         my $val=shift;
  82         my @ips=();
  83         my $tcp;
  84         my $udp;
  85         my $icmp;
  86         foreach my $key (sort keys %customservicegrp){
  87                 if($customservicegrp{$key}[0] eq $val){
  88                         if (&get_srv_prot($customservicegrp{$key}[2]) eq 'TCP'){
  89                                 $tcp=1;
  90                         }elsif(&get_srv_prot($customservicegrp{$key}[2]) eq 'UDP'){
  91                                 $udp=1;
  92                         }elsif(&get_srv_prot($customservicegrp{$key}[2]) eq 'ICMP'){
  93                                 $icmp=1;
  94                         }
  95                 }
  96         }
  97         if ($tcp eq '1'){push (@ips,'TCP');}
  98         if ($udp eq '1'){push (@ips,'UDP');}
  99         if ($icmp eq '1'){push (@ips,'ICMP');}
 100         my $back=join(",",@ips);
 101         return $back;
 102
 103 }
 104
 105
 106 sub get_srv_port
 107 {
 108         my $val=shift;
 109         my $field=shift;
 110         my $prot=shift;
 111         foreach my $key (sort keys %customservice){
 112                 if($customservice{$key}[0] eq $val){
 113                         if($customservice{$key}[2] eq $prot){
 114                                 return $customservice{$key}[$field];
 115                         }
 116                 }
 117         }
 118 }
 119 sub get_srvgrp_port
 120 {
 121         my $val=shift;
 122         my $prot=shift;
 123         my $back;
 124         my $value;
 125         my @ips=();
 126         foreach my $key (sort keys %customservicegrp){
 127                 if($customservicegrp{$key}[0] eq $val){
 128                         if ($prot ne 'ICMP'){
 129                                 $value=&get_srv_port($customservicegrp{$key}[2],1,$prot);
 130                         }elsif ($prot eq 'ICMP'){
 131                                 $value=&get_srv_port($customservicegrp{$key}[2],3,$prot);
 132                         }
 133                         push (@ips,$value) if ($value ne '') ;
 134                 }
 135         }
 136         if($prot ne 'ICMP'){
 137                 if ($#ips gt 0){$back="-m multiport --dports ";}else{$back="--dport ";}
 138         }elsif ($prot eq 'ICMP'){
 139                 $back="--icmp-type ";
 140         }
 141
 142         $back.=join(",",@ips);
 143         return $back;
 144 }
 145 sub get_ipsec_net_ip
 146 {
 147         my $val=shift;
 148         my $field=shift;
 149         foreach my $key (sort keys %ipsecconf){
 150                 if($ipsecconf{$key}[1] eq $val){
 151                         return $ipsecconf{$key}[$field];
 152                 }
 153         }
 154 }
 155 sub get_ipsec_host_ip
 156 {
 157         my $val=shift;
 158         my $field=shift;
 159         foreach my $key (sort keys %ipsecconf){
 160                 if($ipsecconf{$key}[1] eq $val){
 161                         return $ipsecconf{$key}[$field];
 162                 }
 163         }
 164 }
 165 sub get_ovpn_n2n_ip
 166 {
 167         my $val=shift;
 168         my $field=shift;
 169         foreach my $key (sort keys %ccdhost){
 170                 if($ccdhost{$key}[1] eq $val){
 171                         return $ccdhost{$key}[$field];
 172                 }
 173         }
 174 }
 175 sub get_ovpn_host_ip
 176 {
 177         my $val=shift;
 178         my $field=shift;
 179         foreach my $key (sort keys %ccdhost){
 180                 if($ccdhost{$key}[1] eq $val){
 181                         return $ccdhost{$key}[$field];
 182                 }
 183         }
 184 }
 185 sub get_ovpn_net_ip
 186 {
 187
 188         my $val=shift;
 189         my $field=shift;
 190         foreach my $key (sort keys %ccdnet){
 191                 if($ccdnet{$key}[0] eq $val){
 192                         return $ccdnet{$key}[$field];
 193                 }
 194         }
 195 }
 196 sub get_grp_ip
 197 {
 198         my $val=shift;
 199         my $src=shift;
 200         foreach my $key (sort keys %customgrp){
 201                 if ($customgrp{$key}[0] eq $val){
 202                         &get_address($customgrp{$key}[3],$src);
 203                 }
 204         }
 205
 206 }
 207 sub get_std_net_ip
 208 {
 209         my $val=shift;
 210         if ($val eq 'ALL'){
 211                 return "0.0.0.0/0.0.0.0";
 212         }elsif($val eq 'GREEN'){
 213                 return "$netsettings{'GREEN_NETADDRESS'}/$netsettings{'GREEN_NETMASK'}";
 214         }elsif($val eq 'ORANGE'){
 215                 return "$netsettings{'ORANGE_NETADDRESS'}/$netsettings{'ORANGE_NETMASK'}";
 216         }elsif($val eq 'BLUE'){
 217                 return "$netsettings{'BLUE_NETADDRESS'}/$netsettings{'BLUE_NETMASK'}";
 218         }elsif($val =~ /OpenVPN/i){
 219                 return "$ovpnsettings{'DOVPN_SUBNET'}";
 220         }elsif($val =~ /IPsec/i){
 221                 return "$ipsecsettings{'RW_NET'}";
 222         }
 223 }
 224 sub get_net_ip
 225 {
 226         my $val=shift;
 227         foreach my $key (sort keys %customnetwork){
 228                 if($customnetwork{$key}[0] eq $val){
 229                         return "$customnetwork{$key}[1]/$customnetwork{$key}[2]";
 230                 }
 231         }
 232 }
 233 sub get_host_ip
 234 {
 235         my $val=shift;
 236         my $src=shift;
 237         foreach my $key (sort keys %customhost){
 238                 if($customhost{$key}[0] eq $val){
 239                         if ($customhost{$key}[1] eq 'mac' && $src eq 'src'){
 240                         return "-m mac --mac-source $customhost{$key}[2]";
 241                         }elsif($customhost{$key}[1] eq 'ip' && $src eq 'src'){
 242                                 return "$customhost{$key}[2]";
 243                         }elsif($customhost{$key}[1] eq 'ip' && $src eq 'tgt'){
 244                                 return "$customhost{$key}[2]";
 245                         }elsif($customhost{$key}[1] eq 'mac' && $src eq 'tgt'){
 246                                 return "none";
 247                         }
 248                 }
 249         }
 250 }
 251
 252 return 1;