config/forwardfw/firewall-lib.pl

   1 #!/usr/bin/perl
   2 ###############################################################################
   3 #                                                                             #
   4 # IPFire.org - A linux based firewall                                         #
   5 # Copyright (C) 2013                                                          #
   6 #                                                                             #
   7 # This program is free software: you can redistribute it and/or modify        #
   8 # it under the terms of the GNU General Public License as published by        #
   9 # the Free Software Foundation, either version 3 of the License, or           #
  10 # (at your option) any later version.                                         #
  11 #                                                                             #
  12 # This program is distributed in the hope that it will be useful,             #
  13 # but WITHOUT ANY WARRANTY; without even the implied warranty of              #
  14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
  15 # GNU General Public License for more details.                                #
  16 #                                                                             #
  17 # You should have received a copy of the GNU General Public License           #
  18 # along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
  19 #                                                                             #
  20 ###############################################################################
  21 # Author: Alexander Marx (amarx@ipfire.org)                                   #
  22 ###############################################################################
  23
  24 use strict;
  25 no warnings 'uninitialized';
  26
  27 package fwlib;
  28
  29 my %customnetwork=();
  30 my %customhost=();
  31 my %customgrp=();
  32 my %customservice=();
  33 my %customservicegrp=();
  34 my %ccdnet=();
  35 my %ccdhost=();
  36 my %ipsecconf=();
  37 my %ipsecsettings=();
  38 my %netsettings=();
  39 my %ovpnsettings=();
  40
  41 require '/var/ipfire/general-functions.pl';
  42
  43 my $confignet           = "${General::swroot}/fwhosts/customnetworks";
  44 my $confighost          = "${General::swroot}/fwhosts/customhosts";
  45 my $configgrp           = "${General::swroot}/fwhosts/customgroups";
  46 my $configsrv           = "${General::swroot}/fwhosts/customservices";
  47 my $configsrvgrp        = "${General::swroot}/fwhosts/customservicegrp";
  48 my $configccdnet        = "${General::swroot}/ovpn/ccd.conf";
  49 my $configccdhost       = "${General::swroot}/ovpn/ovpnconfig";
  50 my $configipsec         = "${General::swroot}/vpn/config";
  51 my $configovpn          = "${General::swroot}/ovpn/settings";
  52 my $val;
  53 my $field;
  54
  55 &General::readhash("/var/ipfire/ethernet/settings", \%netsettings);
  56 &General::readhash("${General::swroot}/ovpn/settings", \%ovpnsettings);
  57 &General::readhash("${General::swroot}/vpn/settings", \%ipsecsettings);
  58
  59
  60 &General::readhasharray("$confignet", \%customnetwork);
  61 &General::readhasharray("$confighost", \%customhost);
  62 &General::readhasharray("$configgrp", \%customgrp);
  63 &General::readhasharray("$configccdnet", \%ccdnet);
  64 &General::readhasharray("$configccdhost", \%ccdhost);
  65 &General::readhasharray("$configipsec", \%ipsecconf);
  66 &General::readhasharray("$configsrv", \%customservice);
  67 &General::readhasharray("$configsrvgrp", \%customservicegrp);
  68
  69 sub get_srv_prot
  70 {
  71         my $val=shift;
  72         foreach my $key (sort {$a <=> $b} keys %customservice){
  73                 if($customservice{$key}[0] eq $val){
  74                         if ($customservice{$key}[0] eq $val){
  75                                 return $customservice{$key}[2];
  76                         }
  77                 }
  78         }
  79 }
  80 sub get_srvgrp_prot
  81 {
  82         my $val=shift;
  83         my @ips=();
  84         my $tcp;
  85         my $udp;
  86         my $icmp;
  87         foreach my $key (sort {$a <=> $b} keys %customservicegrp){
  88                 if($customservicegrp{$key}[0] eq $val){
  89                         if (&get_srv_prot($customservicegrp{$key}[2]) eq 'TCP'){
  90                                 $tcp=1;
  91                         }elsif(&get_srv_prot($customservicegrp{$key}[2]) eq 'UDP'){
  92                                 $udp=1;
  93                         }elsif(&get_srv_prot($customservicegrp{$key}[2]) eq 'ICMP'){
  94                                 $icmp=1;
  95                         }
  96                 }
  97         }
  98         if ($tcp eq '1'){push (@ips,'TCP');}
  99         if ($udp eq '1'){push (@ips,'UDP');}
 100         if ($icmp eq '1'){push (@ips,'ICMP');}
 101         my $back=join(",",@ips);
 102         return $back;
 103
 104 }
 105
 106
 107 sub get_srv_port
 108 {
 109         my $val=shift;
 110         my $field=shift;
 111         my $prot=shift;
 112         foreach my $key (sort {$a <=> $b} keys %customservice){
 113                 if($customservice{$key}[0] eq $val){
 114                         if($customservice{$key}[2] eq $prot){
 115                                 return $customservice{$key}[$field];
 116                         }
 117                 }
 118         }
 119 }
 120 sub get_srvgrp_port
 121 {
 122         my $val=shift;
 123         my $prot=shift;
 124         my $back;
 125         my $value;
 126         my @ips=();
 127         foreach my $key (sort {$a <=> $b} keys %customservicegrp){
 128                 if($customservicegrp{$key}[0] eq $val){
 129                         if ($prot ne 'ICMP'){
 130                                 $value=&get_srv_port($customservicegrp{$key}[2],1,$prot);
 131                         }elsif ($prot eq 'ICMP'){
 132                                 $value=&get_srv_port($customservicegrp{$key}[2],3,$prot);
 133                         }
 134                         push (@ips,$value) if ($value ne '') ;
 135                 }
 136         }
 137         if($prot ne 'ICMP'){
 138                 if ($#ips gt 0){$back="-m multiport --dports ";}else{$back="--dport ";}
 139         }elsif ($prot eq 'ICMP'){
 140                 $back="--icmp-type ";
 141         }
 142
 143         $back.=join(",",@ips);
 144         return $back;
 145 }
 146 sub get_ipsec_net_ip
 147 {
 148         my $val=shift;
 149         my $field=shift;
 150         foreach my $key (sort {$a <=> $b} keys %ipsecconf){
 151                 if($ipsecconf{$key}[1] eq $val){
 152                         return $ipsecconf{$key}[$field];
 153                 }
 154         }
 155 }
 156 sub get_ipsec_host_ip
 157 {
 158         my $val=shift;
 159         my $field=shift;
 160         foreach my $key (sort {$a <=> $b} keys %ipsecconf){
 161                 if($ipsecconf{$key}[1] eq $val){
 162                         return $ipsecconf{$key}[$field];
 163                 }
 164         }
 165 }
 166 sub get_ovpn_n2n_ip
 167 {
 168         my $val=shift;
 169         my $field=shift;
 170         foreach my $key (sort {$a <=> $b} keys %ccdhost){
 171                 if($ccdhost{$key}[1] eq $val){
 172                         return $ccdhost{$key}[$field];
 173                 }
 174         }
 175 }
 176 sub get_ovpn_host_ip
 177 {
 178         my $val=shift;
 179         my $field=shift;
 180         foreach my $key (sort {$a <=> $b} keys %ccdhost){
 181                 if($ccdhost{$key}[1] eq $val){
 182                         return $ccdhost{$key}[$field];
 183                 }
 184         }
 185 }
 186 sub get_ovpn_net_ip
 187 {
 188
 189         my $val=shift;
 190         my $field=shift;
 191         foreach my $key (sort {$a <=> $b} keys %ccdnet){
 192                 if($ccdnet{$key}[0] eq $val){
 193                         return $ccdnet{$key}[$field];
 194                 }
 195         }
 196 }
 197 sub get_grp_ip
 198 {
 199         my $val=shift;
 200         my $src=shift;
 201         foreach my $key (sort {$a <=> $b} keys %customgrp){
 202                 if ($customgrp{$key}[0] eq $val){
 203                         &get_address($customgrp{$key}[3],$src);
 204                 }
 205         }
 206
 207 }
 208 sub get_std_net_ip
 209 {
 210         my $val=shift;
 211         my $con=shift;
 212         if ($val eq 'ALL'){
 213                 return "0.0.0.0/0.0.0.0";
 214         }elsif($val eq 'GREEN'){
 215                 return "$netsettings{'GREEN_NETADDRESS'}/$netsettings{'GREEN_NETMASK'}";
 216         }elsif($val eq 'ORANGE'){
 217                 return "$netsettings{'ORANGE_NETADDRESS'}/$netsettings{'ORANGE_NETMASK'}";
 218         }elsif($val eq 'BLUE'){
 219                 return "$netsettings{'BLUE_NETADDRESS'}/$netsettings{'BLUE_NETMASK'}";
 220         }elsif($val eq 'RED'){
 221                 return "0.0.0.0/0 -o $con";
 222         }elsif($val =~ /OpenVPN/i){
 223                 return "$ovpnsettings{'DOVPN_SUBNET'}";
 224         }elsif($val =~ /IPsec/i){
 225                 return "$ipsecsettings{'RW_NET'}";
 226         }elsif($val eq 'IPFire'){
 227                 return ;
 228         }
 229 }
 230 sub get_net_ip
 231 {
 232         my $val=shift;
 233         foreach my $key (sort {$a <=> $b} keys %customnetwork){
 234                 if($customnetwork{$key}[0] eq $val){
 235                         return "$customnetwork{$key}[1]/$customnetwork{$key}[2]";
 236                 }
 237         }
 238 }
 239 sub get_host_ip
 240 {
 241         my $val=shift;
 242         my $src=shift;
 243         foreach my $key (sort {$a <=> $b} keys %customhost){
 244                 if($customhost{$key}[0] eq $val){
 245                         if ($customhost{$key}[1] eq 'mac' && $src eq 'src'){
 246                         return "-m mac --mac-source $customhost{$key}[2]";
 247                         }elsif($customhost{$key}[1] eq 'ip' && $src eq 'src'){
 248                                 return "$customhost{$key}[2]";
 249                         }elsif($customhost{$key}[1] eq 'ip' && $src eq 'tgt'){
 250                                 return "$customhost{$key}[2]";
 251                         }elsif($customhost{$key}[1] eq 'mac' && $src eq 'tgt'){
 252                                 return "none";
 253                         }
 254                 }
 255         }
 256 }
 257
 258 return 1;