-#!/usr/bin/perl
+#!/usr/bin/perl -w
###############################################################################
# #
# IPFire.org - A linux based firewall #
###############################################################################
use strict;
-use Time::Local;
-no warnings 'uninitialized';
-# enable only the following on debugging purpose
-#use warnings;
-#use CGI::Carp 'fatalsToBrowser';
+require '/var/ipfire/general-functions.pl';
+require "${General::swroot}/lang.pl";
+require "/usr/lib/firewall/firewall-lib.pl";
+
+# Set to one to enable debugging mode.
+my $DEBUG = 0;
+
+my $IPTABLES = "iptables --wait";
+
+# iptables chains
+my $CHAIN_INPUT = "INPUTFW";
+my $CHAIN_FORWARD = "FORWARDFW";
+my $CHAIN_OUTPUT = "OUTGOINGFW";
+my $CHAIN = $CHAIN_FORWARD;
+my $CHAIN_NAT_SOURCE = "NAT_SOURCE";
+my $CHAIN_NAT_DESTINATION = "NAT_DESTINATION";
+my $CHAIN_MANGLE_NAT_DESTINATION_FIX = "NAT_DESTINATION";
+my @VALID_CHAINS = ($CHAIN_INPUT, $CHAIN_FORWARD, $CHAIN_OUTPUT);
+my @ANY_ADDRESSES = ("0.0.0.0/0.0.0.0", "0.0.0.0/0", "0/0");
+
+my @PROTOCOLS = ("tcp", "udp", "icmp", "igmp", "ah", "esp", "gre", "ipv6", "ipip");
+my @PROTOCOLS_WITH_PORTS = ("tcp", "udp");
+
+my @VALID_TARGETS = ("ACCEPT", "DROP", "REJECT");
my %fwdfwsettings=();
my %defaultNetworks=();
-my %configfwdfw=();
-my %color=();
-my %icmptypes=();
-my %ovpnSettings=();
+my %configfwdfw=();;
my %customgrp=();
-our %sourcehash=();
-our %targethash=();
-my @timeframe=();
my %configinputfw=();
my %configoutgoingfw=();
my %confignatfw=();
my %aliases=();
-my @DPROT=();
my @p2ps=();
-require '/var/ipfire/general-functions.pl';
-require "${General::swroot}/lang.pl";
-require "/usr/lib/firewall/firewall-lib.pl";
my $configfwdfw = "${General::swroot}/firewall/config";
my $configinput = "${General::swroot}/firewall/input";
my $p2pfile = "${General::swroot}/firewall/p2protocols";
my $configgrp = "${General::swroot}/fwhosts/customgroups";
my $netsettings = "${General::swroot}/ethernet/settings";
-my $errormessage = '';
-my $orange = '';
-my $green = '';
-my $blue = '';
-my ($TYPE,$PROT,$SPROT,$DPROT,$SPORT,$DPORT,$TIME,$TIMEFROM,$TIMETILL,$SRC_TGT);
-my $CHAIN = "FORWARDFW";
-my $conexists = 'off';
-my $command = 'iptables -A';
-my $dnat ='';
-my $snat ='';
&General::readhash("${General::swroot}/firewall/settings", \%fwdfwsettings);
&General::readhash("$netsettings", \%defaultNetworks);
&General::readhasharray($configgrp, \%customgrp);
&General::get_aliases(\%aliases);
-#check if we have an internetconnection
-open (CONN,"/var/ipfire/red/iface");
-my $con = <CONN>;
-close(CONN);
-if (-f "/var/ipfire/red/active"){
- $conexists='on';
+my @log_limit_options = &make_log_limit_options();
+
+# MAIN
+&main();
+
+sub main {
+ # Flush all chains.
+ &flush();
+
+ # Reload firewall rules.
+ &preparerules();
+
+ # Load P2P block rules.
+ &p2pblock();
+
+ # Reload firewall policy.
+ run("/usr/sbin/firewall-policy");
}
-open (CONN1,"/var/ipfire/red/local-ipaddress");
-my $redip = <CONN1>;
-close(CONN1);
-#################
-# DEBUG/TEST #
-#################
-my $MODE=0; # 0 - normal operation
- # 1 - print configline and rules to console
- #
-#################
-my $param=shift;
-
-if($param eq 'flush'){
- if ($MODE eq '1'){
- print " Flushing chains...\n";
- }
- &flush;
-}else{
- if ($MODE eq '1'){
- print " Flushing chains...\n";
- }
- &flush;
- if ($MODE eq '1'){
- print " Preparing rules...\n";
- }
- &preparerules;
- if($MODE eq '0'){
- if ($fwdfwsettings{'POLICY'} eq 'MODE1'){
- &p2pblock;
- system ("/usr/sbin/firewall-policy");
- }elsif($fwdfwsettings{'POLICY'} eq 'MODE2'){
- &p2pblock;
- system ("iptables -A $CHAIN -m conntrack --ctstate NEW -j ACCEPT");
- system ("/usr/sbin/firewall-policy");
- system ("/etc/sysconfig/firewall.local reload");
+
+sub run {
+ # Executes or prints the given shell command.
+ my $command = shift;
+
+ if ($DEBUG) {
+ print "$command\n";
+ } else {
+ system "$command";
+
+ if ($?) {
+ print_error("ERROR: $command");
}
}
}
-sub flush
-{
- system ("iptables -F FORWARDFW");
- system ("iptables -F INPUTFW");
- system ("iptables -F OUTGOINGFW");
- system ("iptables -t nat -F NAT_DESTINATION");
- system ("iptables -t nat -F NAT_SOURCE");
+
+sub print_error {
+ my $message = shift;
+
+ print STDERR "$message\n";
+}
+
+sub print_rule {
+ my $hash = shift;
+
+ print "\nRULE:";
+
+ my $i = 0;
+ foreach (@$hash) {
+ printf(" %2d: %s", $i++, $_);
+ }
+ print "\n";
+}
+
+sub flush {
+ run("$IPTABLES -F $CHAIN_INPUT");
+ run("$IPTABLES -F $CHAIN_FORWARD");
+ run("$IPTABLES -F $CHAIN_OUTPUT");
+ run("$IPTABLES -t nat -F $CHAIN_NAT_SOURCE");
+ run("$IPTABLES -t nat -F $CHAIN_NAT_DESTINATION");
+ run("$IPTABLES -t mangle -F $CHAIN_MANGLE_NAT_DESTINATION_FIX");
}
-sub preparerules
-{
+
+sub preparerules {
if (! -z "${General::swroot}/firewall/config"){
&buildrules(\%configfwdfw);
}
&buildrules(\%configoutgoingfw);
}
}
-sub buildrules
-{
- my $hash=shift;
- my $STAG;
- my $natip;
- my $snatport;
- my $fireport;
- my $nat;
- my $fwaccessdport;
- my $natchain;
- my $icmptype;
- foreach my $key (sort {$a <=> $b} keys %$hash){
- next if (($$hash{$key}[6] eq 'RED' || $$hash{$key}[6] eq 'RED1') && $conexists eq 'off' );
- $command="iptables -A";
- if ($$hash{$key}[28] eq 'ON'){
- $command='iptables -t nat -A';
- $natip=&get_nat_ip($$hash{$key}[29],$$hash{$key}[31]);
- if($$hash{$key}[31] eq 'dnat'){
- $nat='DNAT';
- if ($$hash{$key}[30] =~ /\|/){
- $$hash{$key}[30]=~ tr/|/,/;
- $fireport='-m multiport --dport '.$$hash{$key}[30];
- }else{
- $fireport='--dport '.$$hash{$key}[30] if ($$hash{$key}[30]>0);
- }
- }else{
- $nat='SNAT';
+
+sub buildrules {
+ my $hash = shift;
+
+ foreach my $key (sort {$a <=> $b} keys %$hash) {
+ # Skip disabled rules.
+ next unless ($$hash{$key}[2] eq 'ON');
+
+ if ($DEBUG) {
+ print_rule($$hash{$key});
+ }
+
+ # Check if the target is valid.
+ my $target = $$hash{$key}[0];
+ if (!$target ~~ @VALID_TARGETS) {
+ print_error("Invalid target '$target' for rule $key");
+ next;
+ }
+
+ # Check if the chain is valid.
+ my $chain = $$hash{$key}[1];
+ if (!$chain ~~ @VALID_CHAINS) {
+ print_error("Invalid chain '$chain' in rule $key");
+ next;
+ }
+
+ # Collect all sources.
+ my @sources = &fwlib::get_addresses($hash, $key, "src");
+
+ # Collect all destinations.
+ my @destinations = &fwlib::get_addresses($hash, $key, "tgt");
+
+ # True if the destination is the firewall itself.
+ my $destination_is_firewall = ($$hash{$key}[5] eq "ipfire");
+
+ # Check if logging should be enabled.
+ my $LOG = ($$hash{$key}[17] eq 'ON');
+
+ # Check if NAT is enabled and initialize variables, that we use for that.
+ my $NAT = ($$hash{$key}[28] eq 'ON');
+ my $NAT_MODE;
+ if ($NAT) {
+ $NAT_MODE = uc($$hash{$key}[31]);
+ }
+
+ # Set up time constraints.
+ my @time_options = ();
+ if ($$hash{$key}[18] eq 'ON') {
+ push(@time_options, ("-m", "time"));
+
+ # Select all days of the week this match is active.
+ my @weekdays = ();
+ if ($$hash{$key}[19] ne '') {
+ push (@weekdays, "Mon");
+ }
+ if ($$hash{$key}[20] ne '') {
+ push (@weekdays, "Tue");
+ }
+ if ($$hash{$key}[21] ne '') {
+ push (@weekdays, "Wed");
+ }
+ if ($$hash{$key}[22] ne '') {
+ push (@weekdays, "Thu");
+ }
+ if ($$hash{$key}[23] ne '') {
+ push (@weekdays, "Fri");
+ }
+ if ($$hash{$key}[24] ne '') {
+ push (@weekdays, "Sat");
+ }
+ if ($$hash{$key}[25] ne '') {
+ push (@weekdays, "Sun");
+ }
+ if (@weekdays) {
+ push(@time_options, ("--weekdays", join(",", @weekdays)));
+ }
+
+ # Convert start time.
+ my $time_start = &format_time($$hash{$key}[26]);
+ if ($time_start) {
+ push(@time_options, ("--timestart", $time_start));
+ }
+
+ # Convert end time.
+ my $time_stop = &format_time($$hash{$key}[27]);
+ if ($time_stop) {
+ push(@time_options, ("--timestop", $time_stop));
}
}
- $STAG='';
- if($$hash{$key}[2] eq 'ON'){
- #get source ip's
- if ($$hash{$key}[3] eq 'cust_grp_src'){
- foreach my $grp (sort {$a <=> $b} keys %customgrp){
- if($customgrp{$grp}[0] eq $$hash{$key}[4]){
- &get_address($customgrp{$grp}[3],$customgrp{$grp}[2],"src");
- }
- }
- }else{
- &get_address($$hash{$key}[3],$$hash{$key}[4],"src");
+
+ # Check which protocols are used in this rule and so that we can
+ # later group rules by protocols.
+ my @protocols = &get_protocols($hash, $key);
+ if (!@protocols) {
+ print_error("Invalid protocol configuration for rule $key");
+ next;
+ }
+
+ foreach my $protocol (@protocols) {
+ # Check if the given protocol is supported.
+ if (($protocol ne "all") && (!$protocol ~~ @PROTOCOLS)) {
+ print_error("Protocol $protocol is not supported (rule $key)");
+ next;
}
- #get target ip's
- if ($$hash{$key}[5] eq 'cust_grp_tgt'){
- foreach my $grp (sort {$a <=> $b} keys %customgrp){
- if($customgrp{$grp}[0] eq $$hash{$key}[6]){
- &get_address($customgrp{$grp}[3],$customgrp{$grp}[2],"tgt");
+
+ # Prepare protocol options (like ICMP types, ports, etc...).
+ my @protocol_options = &get_protocol_options($hash, $key, $protocol, 0);
+
+ # Check if this protocol knows ports.
+ my $protocol_has_ports = ($protocol ~~ @PROTOCOLS_WITH_PORTS);
+
+ foreach my $source (@sources) {
+ foreach my $destination (@destinations) {
+ # Skip invalid rules.
+ next if (!$source || !$destination || ($destination eq "none"));
+
+ # Sanitize source.
+ if ($source ~~ @ANY_ADDRESSES) {
+ $source = "";
}
- }
- }elsif($$hash{$key}[5] eq 'ipfire' ){
- if($$hash{$key}[6] eq 'GREEN'){
- $targethash{$key}[0]=$defaultNetworks{'GREEN_ADDRESS'};
- }
- if($$hash{$key}[6] eq 'BLUE'){
- $targethash{$key}[0]=$defaultNetworks{'BLUE_ADDRESS'};
- }
- if($$hash{$key}[6] eq 'ORANGE'){
- $targethash{$key}[0]=$defaultNetworks{'ORANGE_ADDRESS'};
- }
- if($$hash{$key}[6] eq 'ALL'){
- $targethash{$key}[0]='0.0.0.0/0';
- }
- if($$hash{$key}[6] eq 'RED' || $$hash{$key}[6] eq 'RED1'){
- open(FILE, "/var/ipfire/red/local-ipaddress")or die "Couldn't open local-ipaddress";
- $targethash{$key}[0]= <FILE>;
- close(FILE);
- }else{
- foreach my $alias (sort keys %aliases){
- if ($$hash{$key}[6] eq $alias){
- $targethash{$key}[0]=$aliases{$alias}{'IPT'};
- }
+
+ # Sanitize destination.
+ if ($destination ~~ @ANY_ADDRESSES) {
+ $destination = "";
}
- }
- }else{
- &get_address($$hash{$key}[5],$$hash{$key}[6],"tgt");
- }
- ##get source prot and port
- $SRC_TGT='SRC';
- $SPORT = &get_port($hash,$key);
- $SRC_TGT='';
-
- ##get target prot and port
- $DPROT=&get_prot($hash,$key);
-
- if ($DPROT eq ''){$DPROT=' ';}
- @DPROT=split(",",$DPROT);
-
- #get time if defined
- if($$hash{$key}[18] eq 'ON'){
- my ($time1,$time2,$daylight);
- my $daylight=$$hash{$key}[28];
- $time1=&get_time($$hash{$key}[26],$daylight);
- $time2=&get_time($$hash{$key}[27],$daylight);
- if($$hash{$key}[19] ne ''){push (@timeframe,"Mon");}
- if($$hash{$key}[20] ne ''){push (@timeframe,"Tue");}
- if($$hash{$key}[21] ne ''){push (@timeframe,"Wed");}
- if($$hash{$key}[22] ne ''){push (@timeframe,"Thu");}
- if($$hash{$key}[23] ne ''){push (@timeframe,"Fri");}
- if($$hash{$key}[24] ne ''){push (@timeframe,"Sat");}
- if($$hash{$key}[25] ne ''){push (@timeframe,"Sun");}
- $TIME=join(",",@timeframe);
-
- $TIMEFROM="--timestart $time1 ";
- $TIMETILL="--timestop $time2 ";
- $TIME="-m time --weekdays $TIME $TIMEFROM $TIMETILL";
- }
- if ($MODE eq '1'){
- print "NR:$key ";
- foreach my $i (0 .. $#{$$hash{$key}}){
- print "$i: $$hash{$key}[$i] ";
- }
- print "\n";
- print"##################################\n";
- #print rules to console
- foreach my $DPROT (@DPROT){
- $DPORT = &get_port($hash,$key,$DPROT);
- if ($DPROT ne 'TCP' && $DPROT ne 'UDP' && $DPROT ne 'ICMP' ){
- $DPORT='';
+
+ # Array with iptables arguments.
+ my @options = ();
+
+ # Append protocol.
+ if ($protocol ne "all") {
+ push(@options, @protocol_options);
}
- $PROT=$DPROT;
- $PROT="-p $PROT" if ($PROT ne '' && $PROT ne ' ');
- foreach my $a (sort keys %sourcehash){
- foreach my $b (sort keys %targethash){
- next if ($targethash{$b}[0] eq 'none');
- $STAG='';
- if ($sourcehash{$a}[0] ne $targethash{$b}[0] && $targethash{$b}[0] ne 'none' || $sourcehash{$a}[0] eq '0.0.0.0/0.0.0.0'){
- if($DPROT ne ''){
- if(substr($sourcehash{$a}[0], 3, 3) ne 'mac' && $sourcehash{$a}[0] ne ''){ $STAG="-s";}
- #Process ICMP RULE
- if(substr($DPORT, 2, 4) eq 'icmp'){
- my @icmprule= split(",",substr($DPORT, 12,));
- foreach (@icmprule){
- $icmptype="--icmp-type ";
- if ($_ eq "BLANK") {
- $icmptype="";
- $_="";
- }
- if ($$hash{$key}[17] eq 'ON'){
- print "$command $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $icmptype $_ $TIME -j LOG\n";
- }
- print "$command $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $icmptype $_ $TIME -j $$hash{$key}[0]\n";
- }
- #PROCESS DNAT RULE (Portforward)
- }elsif($$hash{$key}[28] eq 'ON' && $$hash{$key}[31] eq 'dnat'){
- $natchain='NAT_DESTINATION';
- if ($$hash{$key}[17] eq 'ON'){
- print "$command $natchain $PROT $STAG $sourcehash{$a}[0] $SPORT $natip $fireport $TIME -j LOG --log-prefix 'DNAT' \n";
- }
- my ($ip,$sub) =split("/",$targethash{$b}[0]);
- #Process NAT with servicegroup used
- if ($$hash{$key}[28] eq 'ON' && $$hash{$key}[31] eq 'dnat' && $$hash{$key}[14] eq 'cust_srvgrp'){
- print "$command $natchain $PROT $STAG $sourcehash{$a}[0] $SPORT $natip $fireport $TIME -j $nat --to $ip $DPORT\n";
- $fwaccessdport=$DPORT;
- }else{
- print "$command $natchain $PROT $STAG $sourcehash{$a}[0] $SPORT $natip $fireport $TIME -j $nat --to $ip$DPORT\n";
- $DPORT =~ s/\-/:/g;
- if ($DPORT){
- $fwaccessdport="--dport ".substr($DPORT,1,);
- }elsif(! $DPORT && $$hash{$key}[30] ne ''){
- if ($$hash{$key}[30]=~m/|/i){
- $$hash{$key}[30] =~ s/\|/,/g;
- $fwaccessdport="-m multiport --dport $$hash{$key}[30]";
- }else{
- $fwaccessdport="--dport $$hash{$key}[30]";
- }
- }
- }
- print "iptables -A FORWARDFW $PROT -i $con $STAG $sourcehash{$a}[0] -d $ip $fwaccessdport $TIME -j $$hash{$key}[0]\n";
- next;
- #PROCESS SNAT RULE
- }elsif($$hash{$key}[28] eq 'ON' && $$hash{$key}[31] eq 'snat'){
- $natchain='NAT_SOURCE';
- if ($$hash{$key}[17] eq 'ON' ){
- print "$command $natchain $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j LOG --log-prefix 'SNAT' \n";
- }
- print "$command $natchain $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j $nat --to $natip\n";
- }
- #PROCESS EVERY OTHER RULE (If NOT ICMP, else the rule would be applied double)
- if ($PROT ne '-p ICMP'){
- if ($$hash{$key}[17] eq 'ON' && $$hash{$key}[28] ne 'ON'){
- print "$command $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j LOG\n";
- }
- print "iptables -A $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j $$hash{$key}[0]\n";
- }
- #PROCESS Prot ICMP and type = All ICMP-Types
- if ($PROT eq '-p ICMP' && $$hash{$key}[9] eq 'All ICMP-Types'){
- if ($$hash{$key}[17] eq 'ON' && $$hash{$key}[28] ne 'ON'){
- print "$command $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j LOG\n";
- }
- print "iptables -A $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j $$hash{$key}[0]\n";
- }
- }
- }
- }
+
+ # Prepare source options.
+ my @source_options = ();
+ if ($source =~ /mac/) {
+ push(@source_options, $source);
+ } elsif ($source) {
+ push(@source_options, ("-s", $source));
}
- print"\n";
- }
- }elsif($MODE eq '0'){
- foreach my $DPROT (@DPROT){
- $DPORT = &get_port($hash,$key,$DPROT);
- $PROT=$DPROT;
- $PROT="-p $PROT" if ($PROT ne '' && $PROT ne ' ');
- if ($DPROT ne 'TCP' && $DPROT ne'UDP' && $DPROT ne 'ICMP' ){
- $DPORT='';
+
+ # Prepare destination options.
+ my @destination_options = ();
+ if ($destination) {
+ push(@destination_options, ("-d", $destination));
}
- foreach my $a (sort keys %sourcehash){
- foreach my $b (sort keys %targethash){
- next if ($targethash{$b}[0] eq 'none');
- $STAG='';
- if ($sourcehash{$a}[0] ne $targethash{$b}[0] && $targethash{$b}[0] ne 'none' || $sourcehash{$a}[0] eq '0.0.0.0/0.0.0.0'){
- if($DPROT ne ''){
- if(substr($sourcehash{$a}[0], 3, 3) ne 'mac' && $sourcehash{$a}[0] ne ''){ $STAG="-s";}
- #Process ICMP RULE
- if(substr($DPORT, 2, 4) eq 'icmp'){
- my @icmprule= split(",",substr($DPORT, 12,));
- foreach (@icmprule){
- $icmptype="--icmp-type ";
- if ($_ eq "BLANK") {
- $icmptype="";
- $_="";
- }
- if ($$hash{$key}[17] eq 'ON'){
- system ("$command $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $icmptype $_ $TIME -j LOG");
- }
- system ("$command $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $icmptype $_ $TIME -j $$hash{$key}[0]");
- }
- #PROCESS DNAT RULE (Portforward)
- }elsif($$hash{$key}[28] eq 'ON' && $$hash{$key}[31] eq 'dnat'){
- $natchain='NAT_DESTINATION';
- if ($$hash{$key}[17] eq 'ON'){
- system "$command $natchain $PROT $STAG $sourcehash{$a}[0] $SPORT $natip $fireport $TIME -j LOG --log-prefix 'DNAT' \n";
- }
- my ($ip,$sub) =split("/",$targethash{$b}[0]);
- #Process NAT with servicegroup used
- if ($$hash{$key}[28] eq 'ON' && $$hash{$key}[31] eq 'dnat' && $$hash{$key}[14] eq 'cust_srvgrp'){
- system "$command $natchain $PROT $STAG $sourcehash{$a}[0] $SPORT $natip $fireport $TIME -j $nat --to $ip $DPORT\n";
- $fwaccessdport=$DPORT;
- }else{
- system "$command $natchain $PROT $STAG $sourcehash{$a}[0] $SPORT $natip $fireport $TIME -j $nat --to $ip$DPORT\n";
- $DPORT =~ s/\-/:/g;
- if ($DPORT){
- $fwaccessdport="--dport ".substr($DPORT,1,);
- }elsif(! $DPORT && $$hash{$key}[30] ne ''){
- if ($$hash{$key}[30]=~m/|/i){
- $$hash{$key}[30] =~ s/\|/,/g;
- $fwaccessdport="-m multiport --dport $$hash{$key}[30]";
- }else{
- $fwaccessdport="--dport $$hash{$key}[30]";
- }
- }
- }
- system "iptables -A FORWARDFW $PROT -i $con $STAG $sourcehash{$a}[0] -d $ip $fwaccessdport $TIME -j $$hash{$key}[0]\n";
- next;
- #PROCESS SNAT RULE
- }elsif($$hash{$key}[28] eq 'ON' && $$hash{$key}[31] eq 'snat'){
- $natchain='NAT_SOURCE';
- if ($$hash{$key}[17] eq 'ON' ){
- system "$command $natchain $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j LOG --log-prefix 'SNAT' \n";
- }
- system "$command $natchain $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j $nat --to $natip\n";
- }
- #PROCESS EVERY OTHER RULE (If NOT ICMP, else the rule would be applied double)
- if ($PROT ne '-p ICMP'){
- if ($$hash{$key}[17] eq 'ON' && $$hash{$key}[28] ne 'ON'){
- system "$command $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j LOG\n";
- }
- system "iptables -A $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j $$hash{$key}[0]\n";
- }
- #PROCESS Prot ICMP and type = All ICMP-Types
- if ($PROT eq '-p ICMP' && $$hash{$key}[9] eq 'All ICMP-Types'){
- if ($$hash{$key}[17] eq 'ON' && $$hash{$key}[28] ne 'ON'){
- system "$command $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j LOG\n";
- }
- system "iptables -A $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j $$hash{$key}[0]\n";
+
+ # Add time constraint options.
+ push(@options, @time_options);
+
+ my $firewall_is_in_source_subnet = 0;
+ if ($source) {
+ $firewall_is_in_source_subnet = &firewall_is_in_subnet($source);
+ }
+
+ # Process NAT rules.
+ if ($NAT) {
+ my $nat_address = &fwlib::get_nat_address($$hash{$key}[29], $source);
+
+ # Skip NAT rules if the NAT address is unknown
+ # (i.e. no internet connection has been established, yet).
+ next unless ($nat_address);
+
+ # Destination NAT
+ if ($NAT_MODE eq "DNAT") {
+ # Make port-forwardings useable from the internal networks.
+ my @internal_addresses = &fwlib::get_internal_firewall_ip_addresses(1);
+ unless ($nat_address ~~ @internal_addresses) {
+ &add_dnat_mangle_rules($nat_address, @options);
+ }
+
+ my @nat_options = ();
+ if ($protocol ne "all") {
+ my @nat_protocol_options = &get_protocol_options($hash, $key, $protocol, 1);
+ push(@nat_options, @nat_protocol_options);
+ }
+ push(@nat_options, @source_options);
+ push(@nat_options, ("-d", $nat_address));
+ push(@nat_options, @time_options);
+
+ my $dnat_port;
+ if ($protocol_has_ports) {
+ $dnat_port = &get_dnat_target_port($hash, $key);
+ }
+
+ my @nat_action_options = ();
+
+ # Use iptables REDIRECT
+ my $use_redirect = ($destination_is_firewall && !$destination && $protocol_has_ports && $dnat_port);
+ if ($use_redirect) {
+ push(@nat_action_options, ("-j", "REDIRECT", "--to-ports", $dnat_port));
+
+ # Use iptables DNAT
+ } else {
+ if ($destination_is_firewall && !$destination) {
+ $destination = &fwlib::get_external_address();
+ }
+ next unless ($destination);
+
+ my ($dnat_address, $dnat_mask) = split("/", $destination);
+ @destination_options = ("-d", $dnat_address);
+
+ if ($protocol_has_ports) {
+ my $dnat_port = &get_dnat_target_port($hash, $key);
+
+ if ($dnat_port) {
+ $dnat_address .= ":$dnat_port";
}
}
+
+ push(@nat_action_options, ("-j", "DNAT", "--to-destination", $dnat_address));
}
+
+ if ($LOG) {
+ run("$IPTABLES -t nat -A $CHAIN_NAT_DESTINATION @nat_options @log_limit_options -j LOG --log-prefix 'DNAT '");
+ }
+ run("$IPTABLES -t nat -A $CHAIN_NAT_DESTINATION @nat_options @nat_action_options");
+
+ # Source NAT
+ } elsif ($NAT_MODE eq "SNAT") {
+ my @nat_options = @options;
+
+ push(@nat_options, @source_options);
+ push(@nat_options, @destination_options);
+
+ if ($LOG) {
+ run("$IPTABLES -t nat -A $CHAIN_NAT_SOURCE @nat_options @log_limit_options -j LOG --log-prefix 'SNAT '");
+ }
+ run("$IPTABLES -t nat -A $CHAIN_NAT_SOURCE @nat_options -j SNAT --to-source $nat_address");
+ }
+ }
+
+ push(@options, @source_options);
+
+ if ($firewall_is_in_source_subnet && ($fwdfwsettings{"POLICY"} eq "MODE1") && ($chain eq $CHAIN_FORWARD)) {
+ if ($LOG && !$NAT) {
+ run("$IPTABLES -A $CHAIN_INPUT @options @log_limit_options -j LOG --log-prefix '$CHAIN_INPUT '");
}
+ run("$IPTABLES -A $CHAIN_INPUT @options -j $target");
}
+
+ push(@options, @destination_options);
+
+ # Insert firewall rule.
+ if ($LOG && !$NAT) {
+ run("$IPTABLES -A $chain @options @log_limit_options -j LOG --log-prefix '$chain '");
+ }
+ run("$IPTABLES -A $chain @options -j $target");
}
}
}
- %sourcehash=();
- %targethash=();
- undef $TIME;
- undef $TIMEFROM;
- undef $TIMETILL;
- undef $fireport;
}
}
-sub get_nat_ip
-{
- my $val=shift;
- my $type=shift;
- my $result;
- if($val eq 'RED' || $val eq 'GREEN' || $val eq 'ORANGE' || $val eq 'BLUE'){
- $result=$defaultNetworks{$val.'_ADDRESS'};
- }elsif($val eq 'ALL'){
- $result='-i '.$con;
- }elsif($val eq 'Default IP' && $type eq 'dnat'){
- $result='-d '.$redip;
- }elsif($val eq 'Default IP' && $type eq 'snat'){
- $result=$redip;
- }else{
- foreach my $al (sort keys %aliases){
- if($val eq $al && $type eq 'dnat'){
- $result='-d '.$aliases{$al}{'IPT'};
- }elsif($val eq $al && $type eq 'snat'){
- $result=$aliases{$al}{'IPT'};
- }
- }
+
+# Formats the given timestamp into the iptables format which is "hh:mm" UTC.
+sub format_time {
+ my $val = shift;
+
+ # Convert the given time into minutes.
+ my $minutes = &time_convert_to_minutes($val);
+
+ # Move the timestamp into UTC.
+ $minutes += &time_utc_offset();
+
+ # Make sure $minutes is between 00:00 and 23:59.
+ if ($minutes < 0) {
+ $minutes += 1440;
}
- return $result;
-}
-sub get_time
-{
- my $val=shift;
- my $val1=shift;
- my $time;
- my $minutes;
- my $ruletime;
- $minutes = &utcmin($val);
- $ruletime = $minutes + &time_get_utc($val);
- if ($ruletime < 0){$ruletime +=1440;}
- if ($ruletime > 1440){$ruletime -=1440;}
- $time=sprintf "%02d:%02d", $ruletime / 60, $ruletime % 60;
- return $time;
+
+ if ($minutes > 1440) {
+ $minutes -= 1440;
+ }
+
+ # Format as hh:mm.
+ return sprintf("%02d:%02d", $minutes / 60, $minutes % 60);
}
-sub time_get_utc
-{
- # Calculates the UTCtime from a given time
- my $val=shift;
- my @localtime=localtime(time);
- my @gmtime=gmtime(time);
- my $diff = ($gmtime[2]*60+$gmtime[1]%60)-($localtime[2]*60+$localtime[1]%60);
- return $diff;
+
+# Calculates the offsets in minutes from the local timezone to UTC.
+sub time_utc_offset {
+ my @localtime = localtime(time);
+ my @gmtime = gmtime(time);
+
+ return ($gmtime[2] * 60 + $gmtime[1] % 60) - ($localtime[2] * 60 + $localtime[1] % 60);
}
-sub utcmin
-{
- my $ruletime=shift;
- my ($hrs,$min) = split(":",$ruletime);
- my $newtime = $hrs*60+$min;
- return $newtime;
+
+# Takes a timestamp like "14:00" and converts it into minutes since midnight.
+sub time_convert_to_minutes {
+ my ($hrs, $min) = split(":", shift);
+
+ return ($hrs * 60) + $min;
}
-sub p2pblock
-{
- my $P2PSTRING;
+
+sub p2pblock {
+ my $P2PSTRING = "";
my $DO;
open( FILE, "< $p2pfile" ) or die "Unable to read $p2pfile";
@p2ps = <FILE>;
}
}
}
- if ($MODE eq 1){
- if($P2PSTRING){
- print"/sbin/iptables -A FORWARDFW $CMD $P2PSTRING -j $DO\n";
- }
- }else{
- if($P2PSTRING){
- system("/sbin/iptables -A FORWARDFW $CMD $P2PSTRING -j $DO");
+
+ if($P2PSTRING) {
+ run("$IPTABLES -A FORWARDFW $CMD $P2PSTRING -j $DO");
+ }
+}
+
+sub get_protocols {
+ my $hash = shift;
+ my $key = shift;
+
+ my $uses_source_ports = ($$hash{$key}[7] eq "ON");
+ my $uses_services = ($$hash{$key}[11] eq "ON");
+
+ my @protocols = ();
+
+ # Rules which don't have source ports or services (like ICMP, ESP, ...).
+ if (!$uses_source_ports && !$uses_services) {
+ push(@protocols, $$hash{$key}[8]);
+
+ # Rules which either use ports or services.
+ } elsif ($uses_source_ports || $uses_services) {
+ # Check if service group or service
+ if ($$hash{$key}[14] eq 'cust_srv') {
+ push(@protocols, &fwlib::get_srv_prot($$hash{$key}[15]));
+
+ } elsif($$hash{$key}[14] eq 'cust_srvgrp'){
+ my $protos = &fwlib::get_srvgrp_prot($$hash{$key}[15]);
+ push(@protocols, split(",", $protos));
+
+ } else {
+ # Fetch the protocol for this rule.
+ my $protocol = lc($$hash{$key}[8]);
+
+ # Fetch source and destination ports for this rule.
+ my $source_ports = $$hash{$key}[10];
+ my $destination_ports = $$hash{$key}[15];
+
+ # Check if ports are set for protocols which do not support ports.
+ if (!($protocol ~~ @PROTOCOLS_WITH_PORTS) && ($source_ports || $destination_ports)) {
+ print_error("$protocol does not support ports");
+ return ();
+ }
+
+ push(@protocols, $protocol);
}
}
+
+ # Remove all empty elements
+ @protocols = map { $_ ? $_ : () } @protocols;
+
+ # If no protocol has been defined, we assume "all".
+ if (!@protocols) {
+ push(@protocols, "all");
+ }
+
+ # Make all protocol names lowercase.
+ @protocols = map { lc } @protocols;
+
+ return @protocols;
}
-sub get_address
-{
- my $base=shift; #source of checking ($configfwdfw{$key}[x] or groupkey
- my $base2=shift;
- my $type=shift; #src or tgt
- my $hash;
- if ($type eq 'src'){
- $hash=\%sourcehash;
- }else{
- $hash=\%targethash;
+
+sub get_protocol_options {
+ my $hash = shift;
+ my $key = shift;
+ my $protocol = shift;
+ my $nat_options_wanted = shift;
+ my @options = ();
+
+ # Nothing to do if no protocol is specified.
+ if ($protocol eq "all") {
+ return @options;
+ } else {
+ push(@options, ("-p", $protocol));
}
- my $key = &General::findhasharraykey($hash);
- if($base eq 'src_addr' || $base eq 'tgt_addr' ){
- if (&General::validmac($base2)){
- $$hash{$key}[0] = "-m mac --mac-source $base2";
- }else{
- $$hash{$key}[0] = $base2;
- }
- }elsif($base eq 'std_net_src' || $base eq 'std_net_tgt' || $base eq 'Standard Network'){
- $$hash{$key}[0]=&fwlib::get_std_net_ip($base2,$con);
- }elsif($base eq 'cust_net_src' || $base eq 'cust_net_tgt' || $base eq 'Custom Network'){
- $$hash{$key}[0]=&fwlib::get_net_ip($base2);
- }elsif($base eq 'cust_host_src' || $base eq 'cust_host_tgt' || $base eq 'Custom Host'){
- $$hash{$key}[0]=&fwlib::get_host_ip($base2,$type);
- }elsif($base eq 'ovpn_net_src' || $base eq 'ovpn_net_tgt' || $base eq 'OpenVPN static network'){
- $$hash{$key}[0]=&fwlib::get_ovpn_net_ip($base2,1);
- }elsif($base eq 'ovpn_host_src' ||$base eq 'ovpn_host_tgt' || $base eq 'OpenVPN static host'){
- $$hash{$key}[0]=&fwlib::get_ovpn_host_ip($base2,33);
- }elsif($base eq 'ovpn_n2n_src' ||$base eq 'ovpn_n2n_tgt' || $base eq 'OpenVPN N-2-N'){
- $$hash{$key}[0]=&fwlib::get_ovpn_n2n_ip($base2,11);
- }elsif($base eq 'ipsec_net_src' || $base eq 'ipsec_net_tgt' || $base eq 'IpSec Network'){
- $$hash{$key}[0]=&fwlib::get_ipsec_net_ip($base2,11);
- }elsif($base eq 'ipfire_src' ){
- if($base2 eq 'GREEN'){
- $$hash{$key}[0]=$defaultNetworks{'GREEN_ADDRESS'};
- }
- if($base2 eq 'BLUE'){
- $$hash{$key}[0]=$defaultNetworks{'BLUE_ADDRESS'};
- }
- if($base2 eq 'ORANGE'){
- $$hash{$key}[0]=$defaultNetworks{'ORANGE_ADDRESS'};
- }
- if($base2 eq 'ALL'){
- $$hash{$key}[0]='0.0.0.0/0';
- }
- if($base2 eq 'RED' || $base2 eq 'RED1'){
- open(FILE, "/var/ipfire/red/local-ipaddress")or die "Couldn't open local-ipaddress";
- $$hash{$key}[0]= <FILE>;
- close(FILE);
- }else{
- foreach my $alias (sort keys %aliases){
- if ($base2 eq $alias){
- $$hash{$key}[0]=$aliases{$alias}{'IPT'};
- }
+
+ # Process source ports.
+ my $use_src_ports = ($$hash{$key}[7] eq "ON");
+ my $src_ports = $$hash{$key}[10];
+
+ if ($use_src_ports && $src_ports) {
+ push(@options, &format_ports($src_ports, "src"));
+ }
+
+ # Process destination ports.
+ my $use_dst_ports = ($$hash{$key}[11] eq "ON");
+ my $use_dnat = (($$hash{$key}[28] eq "ON") && ($$hash{$key}[31] eq "dnat"));
+
+ if ($use_dst_ports) {
+ my $dst_ports_mode = $$hash{$key}[14];
+ my $dst_ports = $$hash{$key}[15];
+
+ if (($dst_ports_mode eq "TGT_PORT") && $dst_ports) {
+ if ($nat_options_wanted && $use_dnat && $$hash{$key}[30]) {
+ $dst_ports = $$hash{$key}[30];
+ }
+ push(@options, &format_ports($dst_ports, "dst"));
+
+ } elsif ($dst_ports_mode eq "cust_srv") {
+ if ($protocol eq "ICMP") {
+ push(@options, ("--icmp-type", &fwlib::get_srv_port($dst_ports, 3, "ICMP")));
+ } else {
+ $dst_ports = &fwlib::get_srv_port($dst_ports, 1, uc($protocol));
+ push(@options, &format_ports($dst_ports, "dst"));
}
+
+ } elsif ($dst_ports_mode eq "cust_srvgrp") {
+ push(@options, &fwlib::get_srvgrp_port($dst_ports, uc($protocol)));
}
}
+
+ # Check if a single ICMP type is selected.
+ if (!$use_src_ports && !$use_dst_ports && $protocol eq "icmp") {
+ my $icmp_type = $$hash{$key}[9];
+
+ if (($icmp_type ne "All ICMP-Types") && $icmp_type) {
+ push(@options, ("--icmp-type", $icmp_type));
+ }
+ }
+
+ return @options;
}
-sub get_prot
-{
- my $hash=shift;
- my $key=shift;
- #check AH,GRE,ESP or ICMP
- if ($$hash{$key}[7] ne 'ON' && $$hash{$key}[11] ne 'ON'){
- return "$$hash{$key}[8]";
+
+sub format_ports {
+ my $ports = shift;
+ my $type = shift;
+
+ my $arg;
+ if ($type eq "src") {
+ $arg = "--sport";
+ } elsif ($type eq "dst") {
+ $arg = "--dport";
}
- if ($$hash{$key}[7] eq 'ON' || $$hash{$key}[11] eq 'ON'){
- #check if servicegroup or service
- if($$hash{$key}[14] eq 'cust_srv'){
- return &fwlib::get_srv_prot($$hash{$key}[15]);
- }elsif($$hash{$key}[14] eq 'cust_srvgrp'){
- return &fwlib::get_srvgrp_prot($$hash{$key}[15]);
- }elsif (($$hash{$key}[10] ne '' || $$hash{$key}[15] ne '') && $$hash{$key}[8] eq ''){ #when ports are used and prot set to "all"
- return "TCP,UDP";
- }elsif (($$hash{$key}[10] ne '' || $$hash{$key}[15] ne '') && ($$hash{$key}[8] eq 'TCP' || $$hash{$key}[8] eq 'UDP')){ #when ports are used and prot set to "tcp" or "udp"
- return "$$hash{$key}[8]";
- }elsif (($$hash{$key}[10] eq '' && $$hash{$key}[15] eq '') && $$hash{$key}[8] ne 'ICMP'){ #when ports are NOT used and prot NOT set to "ICMP"
- return "$$hash{$key}[8]";
- }else{
- return "$$hash{$key}[8]";
- }
+
+ my @options = ();
+
+ if ($ports =~ /\|/) {
+ $ports =~ s/\|/,/g;
+ push(@options, ("-m", "multiport"));
}
- #DNAT
- if ($SRC_TGT eq '' && $$hash{$key}[31] eq 'dnat' && $$hash{$key}[11] eq '' && $$hash{$key}[12] ne ''){
- return "$$hash{$key}[8]";
+
+ if ($ports) {
+ push(@options, ($arg, $ports));
}
+
+ return @options;
}
-sub get_port
-{
- my $hash=shift;
- my $key=shift;
- my $prot=shift;
- #Get manual defined Ports from SOURCE
- if ($$hash{$key}[7] eq 'ON' && $SRC_TGT eq 'SRC'){
- if ($$hash{$key}[10] ne ''){
- $$hash{$key}[10] =~ s/\|/,/g;
- if(index($$hash{$key}[10],",") > 0){
- return "-m multiport --sport $$hash{$key}[10] ";
- }else{
- if($$hash{$key}[28] ne 'ON' || ($$hash{$key}[28] eq 'ON' && $$hash{$key}[31] eq 'snat') ||($$hash{$key}[28] eq 'ON' && $$hash{$key}[31] eq 'dnat') ){
- return "--sport $$hash{$key}[10] ";
- }else{
- return ":$$hash{$key}[10]";
- }
- }
- }
- #Get manual ports from TARGET
- }elsif($$hash{$key}[11] eq 'ON' && $SRC_TGT eq ''){
- if($$hash{$key}[14] eq 'TGT_PORT'){
- if ($$hash{$key}[15] ne ''){
- $$hash{$key}[15] =~ s/\|/,/g;
- if(index($$hash{$key}[15],",") > 0){
- return "-m multiport --dport $$hash{$key}[15] ";
- }else{
- if($$hash{$key}[28] ne 'ON' || ($$hash{$key}[28] eq 'ON' && $$hash{$key}[31] eq 'snat') ){
- return "--dport $$hash{$key}[15] ";
- }else{
- $$hash{$key}[15] =~ s/\:/-/g;
- return ":$$hash{$key}[15]";
- }
- }
- }
- #Get ports defined in custom Service (firewall-groups)
- }elsif($$hash{$key}[14] eq 'cust_srv'){
- if ($prot ne 'ICMP'){
- if($$hash{$key}[31] eq 'dnat' && $$hash{$key}[28] eq 'ON'){
- my $ports =&fwlib::get_srv_port($$hash{$key}[15],1,$prot);
- $ports =~ s/\:/-/g;
- return ":".$ports
- }else{
- return "--dport ".&fwlib::get_srv_port($$hash{$key}[15],1,$prot);
- }
- }elsif($prot eq 'ICMP' && $$hash{$key}[11] eq 'ON'){ #When PROT is ICMP and "use targetport is checked, this is an icmp-service
- return "--icmp-type ".&fwlib::get_srv_port($$hash{$key}[15],3,$prot);
- }
- #Get ports from services which are used in custom servicegroups (firewall-groups)
- }elsif($$hash{$key}[14] eq 'cust_srvgrp'){
- if ($prot ne 'ICMP'){
- return &fwlib::get_srvgrp_port($$hash{$key}[15],$prot);
- }
- elsif($prot eq 'ICMP'){
- return &fwlib::get_srvgrp_port($$hash{$key}[15],$prot);
- }
+
+sub get_dnat_target_port {
+ my $hash = shift;
+ my $key = shift;
+
+ if ($$hash{$key}[14] eq "TGT_PORT") {
+ my $port = $$hash{$key}[15];
+ my $external_port = $$hash{$key}[30];
+
+ if ($external_port && ($port ne $external_port)) {
+ return $$hash{$key}[15];
}
}
- #CHECK ICMP
- if ($$hash{$key}[7] ne 'ON' && $$hash{$key}[11] ne 'ON' && $SRC_TGT eq ''){
- if($$hash{$key}[9] ne '' && $$hash{$key}[9] ne 'All ICMP-Types'){
- return "--icmp-type $$hash{$key}[9] ";
- }elsif($$hash{$key}[9] eq 'All ICMP-Types'){
- return;
- }
+}
+
+sub add_dnat_mangle_rules {
+ my $nat_address = shift;
+ my @options = @_;
+
+ my $mark = 0;
+ foreach my $zone ("GREEN", "BLUE", "ORANGE") {
+ $mark++;
+
+ # Skip rule if not all required information exists.
+ next unless (exists $defaultNetworks{$zone . "_NETADDRESS"});
+ next unless (exists $defaultNetworks{$zone . "_NETMASK"});
+
+ my @mangle_options = @options;
+
+ my $netaddress = $defaultNetworks{$zone . "_NETADDRESS"};
+ $netaddress .= "/" . $defaultNetworks{$zone . "_NETMASK"};
+
+ push(@mangle_options, ("-s", $netaddress, "-d", $nat_address));
+ push(@mangle_options, ("-j", "MARK", "--set-mark", $mark));
+
+ run("$IPTABLES -t mangle -A $CHAIN_MANGLE_NAT_DESTINATION_FIX @mangle_options");
}
}
+
+sub make_log_limit_options {
+ my @options = ("-m", "limit");
+
+ # Maybe we should get this from the configuration.
+ my $limit = 10;
+
+ # We limit log messages to $limit messages per minute.
+ push(@options, ("--limit", "$limit/min"));
+
+ # And we allow bursts of 2x $limit.
+ push(@options, ("--limit-burst", $limit * 2));
+
+ return @options;
+}
+
+sub firewall_is_in_subnet {
+ my $subnet = shift;
+
+ # ORANGE is missing here, because nothing may ever access
+ # the firewall from this network.
+ my $address = &fwlib::get_internal_firewall_ip_address($subnet, 0);
+
+ if ($address) {
+ return 1;
+ }
+
+ return 0;
+}
+
projects / people / teissler / ipfire-2.x.git / blobdiff