Forward Firewall: fixed 12 Bugs from forum.
[people/teissler/ipfire-2.x.git] / config / forwardfw / firewall-lib.pl
1 #!/usr/bin/perl
2 ###############################################################################
3 # #
4 # IPFire.org - A linux based firewall #
5 # Copyright (C) 2012 #
6 # #
7 # This program is free software: you can redistribute it and/or modify #
8 # it under the terms of the GNU General Public License as published by #
9 # the Free Software Foundation, either version 3 of the License, or #
10 # (at your option) any later version. #
11 # #
12 # This program is distributed in the hope that it will be useful, #
13 # but WITHOUT ANY WARRANTY; without even the implied warranty of #
14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
15 # GNU General Public License for more details. #
16 # #
17 # You should have received a copy of the GNU General Public License #
18 # along with this program. If not, see <http://www.gnu.org/licenses/>. #
19 # #
20 ###############################################################################
21
22
23 use strict;
24 no warnings 'uninitialized';
25
26 package fwlib;
27
28 my %customnetwork=();
29 my %customhost=();
30 my %customgrp=();
31 my %customservice=();
32 my %customservicegrp=();
33 my %ccdnet=();
34 my %ccdhost=();
35 my %ipsecconf=();
36 my %ipsecsettings=();
37 my %netsettings=();
38 my %ovpnsettings=();
39
40 require '/var/ipfire/general-functions.pl';
41
42 my $confignet = "${General::swroot}/fwhosts/customnetworks";
43 my $confighost = "${General::swroot}/fwhosts/customhosts";
44 my $configgrp = "${General::swroot}/fwhosts/customgroups";
45 my $configsrv = "${General::swroot}/fwhosts/customservices";
46 my $configsrvgrp = "${General::swroot}/fwhosts/customservicegrp";
47 my $configccdnet = "${General::swroot}/ovpn/ccd.conf";
48 my $configccdhost = "${General::swroot}/ovpn/ovpnconfig";
49 my $configipsec = "${General::swroot}/vpn/config";
50 my $configovpn = "${General::swroot}/ovpn/settings";
51 my $val;
52 my $field;
53
54 &General::readhash("/var/ipfire/ethernet/settings", \%netsettings);
55 &General::readhash("${General::swroot}/ovpn/settings", \%ovpnsettings);
56 &General::readhash("${General::swroot}/vpn/settings", \%ipsecsettings);
57
58
59 &General::readhasharray("$confignet", \%customnetwork);
60 &General::readhasharray("$confighost", \%customhost);
61 &General::readhasharray("$configgrp", \%customgrp);
62 &General::readhasharray("$configccdnet", \%ccdnet);
63 &General::readhasharray("$configccdhost", \%ccdhost);
64 &General::readhasharray("$configipsec", \%ipsecconf);
65 &General::readhasharray("$configsrv", \%customservice);
66 &General::readhasharray("$configsrvgrp", \%customservicegrp);
67
68 sub get_srv_prot
69 {
70 my $val=shift;
71 foreach my $key (sort keys %customservice){
72 if($customservice{$key}[0] eq $val){
73 if ($customservice{$key}[0] eq $val){
74 return $customservice{$key}[2];
75 }
76 }
77 }
78 }
79 sub get_srvgrp_prot
80 {
81 my $val=shift;
82 my @ips=();
83 my $tcp;
84 my $udp;
85 my $icmp;
86 foreach my $key (sort keys %customservicegrp){
87 if($customservicegrp{$key}[0] eq $val){
88 if (&get_srv_prot($customservicegrp{$key}[2]) eq 'TCP'){
89 $tcp=1;
90 }elsif(&get_srv_prot($customservicegrp{$key}[2]) eq 'UDP'){
91 $udp=1;
92 }elsif(&get_srv_prot($customservicegrp{$key}[2]) eq 'ICMP'){
93 $icmp=1;
94 }
95 }
96 }
97 if ($tcp eq '1'){push (@ips,'TCP');}
98 if ($udp eq '1'){push (@ips,'UDP');}
99 if ($icmp eq '1'){push (@ips,'ICMP');}
100 my $back=join(",",@ips);
101 return $back;
102
103 }
104
105
106 sub get_srv_port
107 {
108 my $val=shift;
109 my $field=shift;
110 my $prot=shift;
111 foreach my $key (sort keys %customservice){
112 if($customservice{$key}[0] eq $val){
113 if($customservice{$key}[2] eq $prot){
114 return $customservice{$key}[$field];
115 }
116 }
117 }
118 }
119 sub get_srvgrp_port
120 {
121 my $val=shift;
122 my $prot=shift;
123 my $back;
124 my $value;
125 my @ips=();
126 foreach my $key (sort keys %customservicegrp){
127 if($customservicegrp{$key}[0] eq $val){
128 if ($prot ne 'ICMP'){
129 $value=&get_srv_port($customservicegrp{$key}[2],1,$prot);
130 }elsif ($prot eq 'ICMP'){
131 $value=&get_srv_port($customservicegrp{$key}[2],3,$prot);
132 }
133 push (@ips,$value) if ($value ne '') ;
134 }
135 }
136 if($prot ne 'ICMP'){
137 if ($#ips gt 0){$back="-m multiport --dports ";}else{$back="--dport ";}
138 }elsif ($prot eq 'ICMP'){
139 $back="--icmp-type ";
140 }
141
142 $back.=join(",",@ips);
143 return $back;
144 }
145 sub get_ipsec_net_ip
146 {
147 my $val=shift;
148 my $field=shift;
149 foreach my $key (sort keys %ipsecconf){
150 if($ipsecconf{$key}[1] eq $val){
151 return $ipsecconf{$key}[$field];
152 }
153 }
154 }
155 sub get_ipsec_host_ip
156 {
157 my $val=shift;
158 my $field=shift;
159 foreach my $key (sort keys %ipsecconf){
160 if($ipsecconf{$key}[1] eq $val){
161 return $ipsecconf{$key}[$field];
162 }
163 }
164 }
165 sub get_ovpn_n2n_ip
166 {
167 my $val=shift;
168 my $field=shift;
169 foreach my $key (sort keys %ccdhost){
170 if($ccdhost{$key}[1] eq $val){
171 return $ccdhost{$key}[$field];
172 }
173 }
174 }
175 sub get_ovpn_host_ip
176 {
177 my $val=shift;
178 my $field=shift;
179 foreach my $key (sort keys %ccdhost){
180 if($ccdhost{$key}[1] eq $val){
181 return $ccdhost{$key}[$field];
182 }
183 }
184 }
185 sub get_ovpn_net_ip
186 {
187
188 my $val=shift;
189 my $field=shift;
190 foreach my $key (sort keys %ccdnet){
191 if($ccdnet{$key}[0] eq $val){
192 return $ccdnet{$key}[$field];
193 }
194 }
195 }
196 sub get_grp_ip
197 {
198 my $val=shift;
199 my $src=shift;
200 foreach my $key (sort keys %customgrp){
201 if ($customgrp{$key}[0] eq $val){
202 &get_address($customgrp{$key}[3],$src);
203 }
204 }
205
206 }
207 sub get_std_net_ip
208 {
209 my $val=shift;
210 if ($val eq 'ALL'){
211 return "0.0.0.0/0.0.0.0";
212 }elsif($val eq 'GREEN'){
213 return "$netsettings{'GREEN_NETADDRESS'}/$netsettings{'GREEN_NETMASK'}";
214 }elsif($val eq 'ORANGE'){
215 return "$netsettings{'ORANGE_NETADDRESS'}/$netsettings{'ORANGE_NETMASK'}";
216 }elsif($val eq 'BLUE'){
217 return "$netsettings{'BLUE_NETADDRESS'}/$netsettings{'BLUE_NETMASK'}";
218 }elsif($val eq 'RED'){
219 return "0.0.0.0/0 -o red0";
220 }elsif($val =~ /OpenVPN/i){
221 return "$ovpnsettings{'DOVPN_SUBNET'}";
222 }elsif($val =~ /IPsec/i){
223 return "$ipsecsettings{'RW_NET'}";
224 }
225 }
226 sub get_net_ip
227 {
228 my $val=shift;
229 foreach my $key (sort keys %customnetwork){
230 if($customnetwork{$key}[0] eq $val){
231 return "$customnetwork{$key}[1]/$customnetwork{$key}[2]";
232 }
233 }
234 }
235 sub get_host_ip
236 {
237 my $val=shift;
238 my $src=shift;
239 foreach my $key (sort keys %customhost){
240 if($customhost{$key}[0] eq $val){
241 if ($customhost{$key}[1] eq 'mac' && $src eq 'src'){
242 return "-m mac --mac-source $customhost{$key}[2]";
243 }elsif($customhost{$key}[1] eq 'ip' && $src eq 'src'){
244 return "$customhost{$key}[2]";
245 }elsif($customhost{$key}[1] eq 'ip' && $src eq 'tgt'){
246 return "$customhost{$key}[2]";
247 }elsif($customhost{$key}[1] eq 'mac' && $src eq 'tgt'){
248 return "none";
249 }
250 }
251 }
252 }
253
254 return 1;