Firewall: Bugfix - when using addressgroups with mac addresses in source, the mac...

[people/teissler/ipfire-2.x.git] / config / firewall / rules.pl

diff --git a/config/firewall/rules.pl b/config/firewall/rules.pl
index b3be47da03506e0bfbcfd673408bff389a113808..f26ae5f39481ccb59fae4f564baa98c47a242ed7 100755 (executable)
--- a/config/firewall/rules.pl
+++ b/config/firewall/rules.pl
@@ -45,12 +45,12 @@ my @DPROT=();
 my @p2ps=();
 require '/var/ipfire/general-functions.pl';
 require "${General::swroot}/lang.pl";
-require "${General::swroot}/forward/bin/firewall-lib.pl";
+require "${General::swroot}/firewall/bin/firewall-lib.pl";
 
-my $configfwdfw                = "${General::swroot}/forward/config";
-my $configinput            = "${General::swroot}/forward/input";
-my $configoutgoing  = "${General::swroot}/forward/outgoing";
-my $p2pfile                    = "${General::swroot}/forward/p2protocols";
+my $configfwdfw                = "${General::swroot}/firewall/config";
+my $configinput            = "${General::swroot}/firewall/input";
+my $configoutgoing  = "${General::swroot}/firewall/outgoing";
+my $p2pfile                    = "${General::swroot}/firewall/p2protocols";
 my $configgrp          = "${General::swroot}/fwhosts/customgroups";
 my $netsettings                = "${General::swroot}/ethernet/settings";
 my $errormessage       = '';
@@ -64,7 +64,7 @@ my $command                   = 'iptables -A';
 my $dnat                       ='';
 my $snat                       ='';
 
-&General::readhash("${General::swroot}/forward/settings", \%fwdfwsettings);
+&General::readhash("${General::swroot}/firewall/settings", \%fwdfwsettings);
 &General::readhash("$netsettings", \%defaultNetworks);
 &General::readhasharray($configfwdfw, \%configfwdfw);
 &General::readhasharray($configinput, \%configinputfw);
@@ -86,8 +86,8 @@ close(CONN1);
 #    DEBUG/TEST #
 #################
 my $MODE=0;     # 0 - normal operation
-                               # 1 - print configline and rules to console
-                               #
+                # 1 - print configline and rules to console
+                #
 #################
 my $param=shift;
 
@@ -127,13 +127,13 @@ sub flush
 }
 sub preparerules
 {
-       if (! -z  "${General::swroot}/forward/config"){
+       if (! -z  "${General::swroot}/firewall/config"){
                &buildrules(\%configfwdfw);
        }
-       if (! -z  "${General::swroot}/forward/input"){
+       if (! -z  "${General::swroot}/firewall/input"){
                &buildrules(\%configinputfw);
        }
-       if (! -z  "${General::swroot}/forward/outgoing"){
+       if (! -z  "${General::swroot}/firewall/outgoing"){
                &buildrules(\%configoutgoingfw);
        }
 }
@@ -252,13 +252,19 @@ sub buildrules
                                #print rules to console
                                foreach my $DPROT (@DPROT){
                                        $DPORT = &get_port($hash,$key,$DPROT);
+                                       if ($DPROT ne 'TCP' && $DPROT ne 'UDP' && $DPROT ne 'ICMP' ){
+                                               $DPORT='';
+                                       }
                                        $PROT=$DPROT;
                                        $PROT="-p $PROT" if ($PROT ne '' && $PROT ne ' ');
                                        foreach my $a (sort keys %sourcehash){
                                                foreach my $b (sort keys %targethash){
+                                                       next if ($targethash{$b}[0] eq 'none');
+                                                       $STAG='';
                                                        if ($sourcehash{$a}[0] ne $targethash{$b}[0] && $targethash{$b}[0] ne 'none' || $sourcehash{$a}[0] eq '0.0.0.0/0.0.0.0'){
                                                                if($DPROT ne ''){
                                                                        if(substr($sourcehash{$a}[0], 3, 3) ne 'mac' && $sourcehash{$a}[0] ne ''){ $STAG="-s";}
+                                                                       #Process ICMP RULE
                                                                        if(substr($DPORT, 2, 4) eq 'icmp'){
                                                                                my @icmprule= split(",",substr($DPORT, 12,));
                                                                                foreach (@icmprule){
@@ -272,10 +278,11 @@ sub buildrules
                                                                                        }
                                                                                                print "$command $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $icmptype $_ $TIME -j $$hash{$key}[0]\n";
                                                                                }
+                                                                       #PROCESS DNAT RULE (Portforward)
                                                                        }elsif($$hash{$key}[28] eq 'ON' && $$hash{$key}[31] eq 'dnat'){
                                                                                $natchain='NAT_DESTINATION';
                                                                                if ($$hash{$key}[17] eq 'ON'){
-                                                                                       print "$command $natchain $PROT $STAG $sourcehash{$a}[0] $fireport $TIME -j LOG --log-prefix 'DNAT' \n";
+                                                                                       print "$command $natchain $PROT $STAG $sourcehash{$a}[0] $SPORT $natip $fireport $TIME -j LOG --log-prefix 'DNAT' \n";
                                                                                }
                                                                                my ($ip,$sub) =split("/",$targethash{$b}[0]);
                                                                                #Process NAT with servicegroup used
@@ -298,17 +305,26 @@ sub buildrules
                                                                                }
                                                                                print "iptables -A FORWARDFW $PROT -i $con $STAG $sourcehash{$a}[0] -d $ip $fwaccessdport $TIME -j $$hash{$key}[0]\n";
                                                                                next;
+                                                                       #PROCESS SNAT RULE
                                                                        }elsif($$hash{$key}[28] eq 'ON' && $$hash{$key}[31] eq 'snat'){
                                                                                $natchain='NAT_SOURCE';
+                                                                               if ($$hash{$key}[17] eq 'ON' ){
+                                                                                       print "$command $natchain $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j LOG --log-prefix 'SNAT' \n";
+                                                                               }
                                                                                print "$command $natchain $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j $nat --to $natip\n";
                                                                        }
-                                                                       if ($$hash{$key}[17] eq 'ON' ){
-                                                                                       print "$command $natchain $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j LOG\n";
-                                                                       }
+                                                                       #PROCESS EVERY OTHER RULE (If NOT ICMP, else the rule would be applied double)
                                                                        if ($PROT ne '-p ICMP'){
+                                                                               if ($$hash{$key}[17] eq 'ON' && $$hash{$key}[28] ne 'ON'){
+                                                                                       print "$command $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j LOG\n";
+                                                                               }
                                                                                print "iptables -A $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j $$hash{$key}[0]\n";
                                                                        }
+                                                                       #PROCESS Prot ICMP and type = All ICMP-Types
                                                                        if ($PROT eq '-p ICMP' && $$hash{$key}[9] eq 'All ICMP-Types'){
+                                                                               if ($$hash{$key}[17] eq 'ON' && $$hash{$key}[28] ne 'ON'){
+                                                                                       print "$command $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j LOG\n";
+                                                                               }
                                                                                print "iptables -A $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j $$hash{$key}[0]\n";
                                                                        }
                                                                }
@@ -322,8 +338,13 @@ sub buildrules
                                        $DPORT = &get_port($hash,$key,$DPROT);
                                        $PROT=$DPROT;
                                        $PROT="-p $PROT" if ($PROT ne '' && $PROT ne ' ');
+                                       if ($DPROT ne 'TCP' && $DPROT ne'UDP' && $DPROT ne 'ICMP' ){
+                                               $DPORT='';
+                                       }
                                        foreach my $a (sort keys %sourcehash){
                                                foreach my $b (sort keys %targethash){
+                                                       next if ($targethash{$b}[0] eq 'none');
+                                                       $STAG='';
                                                        if ($sourcehash{$a}[0] ne $targethash{$b}[0] && $targethash{$b}[0] ne 'none' || $sourcehash{$a}[0] eq '0.0.0.0/0.0.0.0'){
                                                                if($DPROT ne ''){
                                                                        if(substr($sourcehash{$a}[0], 3, 3) ne 'mac' && $sourcehash{$a}[0] ne ''){ $STAG="-s";}
@@ -345,7 +366,7 @@ sub buildrules
                                                                        }elsif($$hash{$key}[28] eq 'ON' && $$hash{$key}[31] eq 'dnat'){
                                                                                $natchain='NAT_DESTINATION';
                                                                                if ($$hash{$key}[17] eq 'ON'){
-                                                                                       system "$command $natchain $PROT $STAG $sourcehash{$a}[0] $fireport $TIME -j LOG --log-prefix 'DNAT' \n";
+                                                                                       system "$command $natchain $PROT $STAG $sourcehash{$a}[0] $SPORT $natip $fireport $TIME -j LOG --log-prefix 'DNAT' \n";
                                                                                }
                                                                                my ($ip,$sub) =split("/",$targethash{$b}[0]);
                                                                                #Process NAT with servicegroup used
@@ -371,17 +392,23 @@ sub buildrules
                                                                        #PROCESS SNAT RULE
                                                                        }elsif($$hash{$key}[28] eq 'ON' && $$hash{$key}[31] eq 'snat'){
                                                                                $natchain='NAT_SOURCE';
+                                                                               if ($$hash{$key}[17] eq 'ON' ){
+                                                                                       system "$command $natchain $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j LOG --log-prefix 'SNAT' \n";
+                                                                               }
                                                                                system "$command $natchain $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j $nat --to $natip\n";
                                                                        }
-                                                                       if ($$hash{$key}[17] eq 'ON' && substr($DPORT, 2, 4) ne 'icmp'){
-                                                                               system "$command $natchain $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j LOG\n";
-                                                                       }
                                                                        #PROCESS EVERY OTHER RULE (If NOT ICMP, else the rule would be applied double)
                                                                        if ($PROT ne '-p ICMP'){
+                                                                               if ($$hash{$key}[17] eq 'ON' && $$hash{$key}[28] ne 'ON'){
+                                                                                       system "$command $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j LOG\n";
+                                                                               }
                                                                                system "iptables -A $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j $$hash{$key}[0]\n";
                                                                        }
                                                                        #PROCESS Prot ICMP and type = All ICMP-Types
                                                                        if ($PROT eq '-p ICMP' && $$hash{$key}[9] eq 'All ICMP-Types'){
+                                                                               if ($$hash{$key}[17] eq 'ON' && $$hash{$key}[28] ne 'ON'){
+                                                                                       system "$command $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j LOG\n";
+                                                                               }
                                                                                system "iptables -A $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j $$hash{$key}[0]\n";
                                                                        }
                                                                }
@@ -577,6 +604,7 @@ sub get_port
        my $hash=shift;
        my $key=shift;
        my $prot=shift;
+       #Get manual defined Ports from SOURCE
        if ($$hash{$key}[7] eq 'ON' && $SRC_TGT eq 'SRC'){
                if ($$hash{$key}[10] ne ''){
                        $$hash{$key}[10] =~ s/\|/,/g;
@@ -590,6 +618,7 @@ sub get_port
                                }
                        }
                }
+               #Get manual ports from TARGET
        }elsif($$hash{$key}[11] eq 'ON' && $SRC_TGT eq ''){
                if($$hash{$key}[14] eq 'TGT_PORT'){
                        if ($$hash{$key}[15] ne ''){
@@ -605,16 +634,20 @@ sub get_port
                                         }
                                }
                        }
+               #Get ports defined in custom Service (firewall-groups)
                }elsif($$hash{$key}[14] eq 'cust_srv'){
                        if ($prot ne 'ICMP'){
                                if($$hash{$key}[31] eq 'dnat' && $$hash{$key}[28] eq 'ON'){
-                                       return ":".&fwlib::get_srv_port($$hash{$key}[15],1,$prot);
+                                       my $ports =&fwlib::get_srv_port($$hash{$key}[15],1,$prot);
+                                       $ports =~ s/\:/-/g;
+                                       return ":".$ports
                                }else{
                                        return "--dport ".&fwlib::get_srv_port($$hash{$key}[15],1,$prot);
                                }
                        }elsif($prot eq 'ICMP' && $$hash{$key}[11] eq 'ON'){        #When PROT is ICMP and "use targetport is checked, this is an icmp-service
                                return "--icmp-type ".&fwlib::get_srv_port($$hash{$key}[15],3,$prot);
                        }
+               #Get ports from services which are used in custom servicegroups (firewall-groups)
                }elsif($$hash{$key}[14] eq 'cust_srvgrp'){
                        if      ($prot ne 'ICMP'){
                                return &fwlib::get_srvgrp_port($$hash{$key}[15],$prot);