e616d7efa9c9025d8f1e0540bf4e1336d7f6b5cd
[people/teissler/ipfire-2.x.git] / config / forwardfw / firewall-lib.pl
1 #!/usr/bin/perl
2 ###############################################################################
3 # #
4 # IPFire.org - A linux based firewall #
5 # Copyright (C) 2013 #
6 # #
7 # This program is free software: you can redistribute it and/or modify #
8 # it under the terms of the GNU General Public License as published by #
9 # the Free Software Foundation, either version 3 of the License, or #
10 # (at your option) any later version. #
11 # #
12 # This program is distributed in the hope that it will be useful, #
13 # but WITHOUT ANY WARRANTY; without even the implied warranty of #
14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
15 # GNU General Public License for more details. #
16 # #
17 # You should have received a copy of the GNU General Public License #
18 # along with this program. If not, see <http://www.gnu.org/licenses/>. #
19 # #
20 ###############################################################################
21 # Author: Alexander Marx (amarx@ipfire.org) #
22 ###############################################################################
23
24 use strict;
25 no warnings 'uninitialized';
26
27 package fwlib;
28
29 my %customnetwork=();
30 my %customhost=();
31 my %customgrp=();
32 my %customservice=();
33 my %customservicegrp=();
34 my %ccdnet=();
35 my %ccdhost=();
36 my %ipsecconf=();
37 my %ipsecsettings=();
38 my %netsettings=();
39 my %ovpnsettings=();
40
41 require '/var/ipfire/general-functions.pl';
42
43 my $confignet = "${General::swroot}/fwhosts/customnetworks";
44 my $confighost = "${General::swroot}/fwhosts/customhosts";
45 my $configgrp = "${General::swroot}/fwhosts/customgroups";
46 my $configsrv = "${General::swroot}/fwhosts/customservices";
47 my $configsrvgrp = "${General::swroot}/fwhosts/customservicegrp";
48 my $configccdnet = "${General::swroot}/ovpn/ccd.conf";
49 my $configccdhost = "${General::swroot}/ovpn/ovpnconfig";
50 my $configipsec = "${General::swroot}/vpn/config";
51 my $configovpn = "${General::swroot}/ovpn/settings";
52 my $val;
53 my $field;
54
55 &General::readhash("/var/ipfire/ethernet/settings", \%netsettings);
56 &General::readhash("${General::swroot}/ovpn/settings", \%ovpnsettings);
57 &General::readhash("${General::swroot}/vpn/settings", \%ipsecsettings);
58
59
60 &General::readhasharray("$confignet", \%customnetwork);
61 &General::readhasharray("$confighost", \%customhost);
62 &General::readhasharray("$configgrp", \%customgrp);
63 &General::readhasharray("$configccdnet", \%ccdnet);
64 &General::readhasharray("$configccdhost", \%ccdhost);
65 &General::readhasharray("$configipsec", \%ipsecconf);
66 &General::readhasharray("$configsrv", \%customservice);
67 &General::readhasharray("$configsrvgrp", \%customservicegrp);
68
69 sub get_srv_prot
70 {
71 my $val=shift;
72 foreach my $key (sort {$a <=> $b} keys %customservice){
73 if($customservice{$key}[0] eq $val){
74 if ($customservice{$key}[0] eq $val){
75 return $customservice{$key}[2];
76 }
77 }
78 }
79 }
80 sub get_srvgrp_prot
81 {
82 my $val=shift;
83 my @ips=();
84 my $tcp;
85 my $udp;
86 my $icmp;
87 foreach my $key (sort {$a <=> $b} keys %customservicegrp){
88 if($customservicegrp{$key}[0] eq $val){
89 if (&get_srv_prot($customservicegrp{$key}[2]) eq 'TCP'){
90 $tcp=1;
91 }elsif(&get_srv_prot($customservicegrp{$key}[2]) eq 'UDP'){
92 $udp=1;
93 }elsif(&get_srv_prot($customservicegrp{$key}[2]) eq 'ICMP'){
94 $icmp=1;
95 }
96 }
97 }
98 if ($tcp eq '1'){push (@ips,'TCP');}
99 if ($udp eq '1'){push (@ips,'UDP');}
100 if ($icmp eq '1'){push (@ips,'ICMP');}
101 my $back=join(",",@ips);
102 return $back;
103
104 }
105
106
107 sub get_srv_port
108 {
109 my $val=shift;
110 my $field=shift;
111 my $prot=shift;
112 foreach my $key (sort {$a <=> $b} keys %customservice){
113 if($customservice{$key}[0] eq $val){
114 if($customservice{$key}[2] eq $prot){
115 return $customservice{$key}[$field];
116 }
117 }
118 }
119 }
120 sub get_srvgrp_port
121 {
122 my $val=shift;
123 my $prot=shift;
124 my $back;
125 my $value;
126 my @ips=();
127 foreach my $key (sort {$a <=> $b} keys %customservicegrp){
128 if($customservicegrp{$key}[0] eq $val){
129 if ($prot ne 'ICMP'){
130 $value=&get_srv_port($customservicegrp{$key}[2],1,$prot);
131 }elsif ($prot eq 'ICMP'){
132 $value=&get_srv_port($customservicegrp{$key}[2],3,$prot);
133 }
134 push (@ips,$value) if ($value ne '') ;
135 }
136 }
137 if($prot ne 'ICMP'){
138 if ($#ips gt 0){$back="-m multiport --dports ";}else{$back="--dport ";}
139 }elsif ($prot eq 'ICMP'){
140 $back="--icmp-type ";
141 }
142
143 $back.=join(",",@ips);
144 return $back;
145 }
146 sub get_ipsec_net_ip
147 {
148 my $val=shift;
149 my $field=shift;
150 foreach my $key (sort {$a <=> $b} keys %ipsecconf){
151 if($ipsecconf{$key}[1] eq $val){
152 return $ipsecconf{$key}[$field];
153 }
154 }
155 }
156 sub get_ipsec_host_ip
157 {
158 my $val=shift;
159 my $field=shift;
160 foreach my $key (sort {$a <=> $b} keys %ipsecconf){
161 if($ipsecconf{$key}[1] eq $val){
162 return $ipsecconf{$key}[$field];
163 }
164 }
165 }
166 sub get_ovpn_n2n_ip
167 {
168 my $val=shift;
169 my $field=shift;
170 foreach my $key (sort {$a <=> $b} keys %ccdhost){
171 if($ccdhost{$key}[1] eq $val){
172 return $ccdhost{$key}[$field];
173 }
174 }
175 }
176 sub get_ovpn_host_ip
177 {
178 my $val=shift;
179 my $field=shift;
180 foreach my $key (sort {$a <=> $b} keys %ccdhost){
181 if($ccdhost{$key}[1] eq $val){
182 return $ccdhost{$key}[$field];
183 }
184 }
185 }
186 sub get_ovpn_net_ip
187 {
188
189 my $val=shift;
190 my $field=shift;
191 foreach my $key (sort {$a <=> $b} keys %ccdnet){
192 if($ccdnet{$key}[0] eq $val){
193 return $ccdnet{$key}[$field];
194 }
195 }
196 }
197 sub get_grp_ip
198 {
199 my $val=shift;
200 my $src=shift;
201 foreach my $key (sort {$a <=> $b} keys %customgrp){
202 if ($customgrp{$key}[0] eq $val){
203 &get_address($customgrp{$key}[3],$src);
204 }
205 }
206
207 }
208 sub get_std_net_ip
209 {
210 my $val=shift;
211 my $con=shift;
212 if ($val eq 'ALL'){
213 return "0.0.0.0/0.0.0.0";
214 }elsif($val eq 'GREEN'){
215 return "$netsettings{'GREEN_NETADDRESS'}/$netsettings{'GREEN_NETMASK'}";
216 }elsif($val eq 'ORANGE'){
217 return "$netsettings{'ORANGE_NETADDRESS'}/$netsettings{'ORANGE_NETMASK'}";
218 }elsif($val eq 'BLUE'){
219 return "$netsettings{'BLUE_NETADDRESS'}/$netsettings{'BLUE_NETMASK'}";
220 }elsif($val eq 'RED'){
221 return "0.0.0.0/0 -o $con";
222 }elsif($val =~ /OpenVPN/i){
223 return "$ovpnsettings{'DOVPN_SUBNET'}";
224 }elsif($val =~ /IPsec/i){
225 return "$ipsecsettings{'RW_NET'}";
226 }elsif($val eq 'IPFire'){
227 return ;
228 }
229 }
230 sub get_net_ip
231 {
232 my $val=shift;
233 foreach my $key (sort {$a <=> $b} keys %customnetwork){
234 if($customnetwork{$key}[0] eq $val){
235 return "$customnetwork{$key}[1]/$customnetwork{$key}[2]";
236 }
237 }
238 }
239 sub get_host_ip
240 {
241 my $val=shift;
242 my $src=shift;
243 foreach my $key (sort {$a <=> $b} keys %customhost){
244 if($customhost{$key}[0] eq $val){
245 if ($customhost{$key}[1] eq 'mac' && $src eq 'src'){
246 return "-m mac --mac-source $customhost{$key}[2]";
247 }elsif($customhost{$key}[1] eq 'ip' && $src eq 'src'){
248 return "$customhost{$key}[2]";
249 }elsif($customhost{$key}[1] eq 'ip' && $src eq 'tgt'){
250 return "$customhost{$key}[2]";
251 }elsif($customhost{$key}[1] eq 'mac' && $src eq 'tgt'){
252 return "none";
253 }
254 }
255 }
256 }
257
258 return 1;