Firewall: Some changes in Strings and languagefiles

[people/teissler/ipfire-2.x.git] / config / forwardfw / rules.pl

diff --git a/config/forwardfw/rules.pl b/config/forwardfw/rules.pl
index baeb7ada57f0892a08df0fc925a41d463fb71b10..f23430f72c8d67378513b47a45b195323905364c 100755 (executable)
--- a/config/forwardfw/rules.pl
+++ b/config/forwardfw/rules.pl
@@ -53,16 +53,17 @@ my $configoutgoing  = "${General::swroot}/forward/outgoing";
 my $p2pfile                    = "${General::swroot}/forward/p2protocols";
 my $configgrp          = "${General::swroot}/fwhosts/customgroups";
 my $netsettings                = "${General::swroot}/ethernet/settings";
-my $errormessage='';
-my $orange;
-my $green;
-my $blue;
+my $errormessage       = '';
+my $orange                     = '';
+my $green                      = '';
+my $blue                       = '';
 my ($TYPE,$PROT,$SPROT,$DPROT,$SPORT,$DPORT,$TIME,$TIMEFROM,$TIMETILL,$SRC_TGT);
-my $CHAIN="FORWARDFW";
-my $conexists='off';
-my $command = 'iptables -A';
-my $dnat='';
-my $snat='';
+my $CHAIN                      = "FORWARDFW";
+my $conexists          = 'off';
+my $command                    = 'iptables -A';
+my $dnat                       ='';
+my $snat                       ='';
+
 &General::readhash("${General::swroot}/forward/settings", \%fwdfwsettings);
 &General::readhash("$netsettings", \%defaultNetworks);
 &General::readhasharray($configfwdfw, \%configfwdfw);
@@ -81,13 +82,13 @@ if (-f "/var/ipfire/red/active"){
 open (CONN1,"/var/ipfire/red/local-ipaddress");
 my $redip = <CONN1>;
 close(CONN1);
-################################
-#    DEBUG/TEST                #
-################################
+#################
+#    DEBUG/TEST #
+#################
 my $MODE=0;     # 0 - normal operation
-                               # 1 - print configline and rules to console     
-                               # 
-################################               
+                               # 1 - print configline and rules to console
+                               #
+#################
 my $param=shift;
 
 if($param eq 'flush'){
@@ -107,7 +108,7 @@ if($param eq 'flush'){
        if($MODE eq '0'){
                if ($fwdfwsettings{'POLICY'} eq 'MODE1'){
                        &p2pblock;
-                       system ("/usr/sbin/firewall-policy"); 
+                       system ("/usr/sbin/firewall-policy");
                }elsif($fwdfwsettings{'POLICY'} eq 'MODE2'){
                        &p2pblock;
                        system ("iptables -A $CHAIN -m conntrack --ctstate NEW -j ACCEPT");
@@ -123,7 +124,7 @@ sub flush
        system ("iptables -F OUTGOINGFW");
        system ("iptables -t nat -F NAT_DESTINATION");
        system ("iptables -t nat -F NAT_SOURCE");
-}                      
+}
 sub preparerules
 {
        if (! -z  "${General::swroot}/forward/config"){
@@ -236,12 +237,12 @@ sub buildrules
                                if($$hash{$key}[24] ne ''){push (@timeframe,"Sat");}
                                if($$hash{$key}[25] ne ''){push (@timeframe,"Sun");}
                                $TIME=join(",",@timeframe);
-                               
+
                                $TIMEFROM="--timestart $time1 ";
                                $TIMETILL="--timestop $time2 ";
                                $TIME="-m time --weekdays $TIME $TIMEFROM $TIMETILL";
                        }
-                       if ($MODE eq '1'){      
+                       if ($MODE eq '1'){
                                print "NR:$key ";
                                foreach my $i (0 .. $#{$$hash{$key}}){
                                        print "$i: $$hash{$key}[$i]  ";
@@ -251,13 +252,12 @@ sub buildrules
                                #print rules to console
                                foreach my $DPROT (@DPROT){
                                        $DPORT = &get_port($hash,$key,$DPROT);
-                                       print "uzlputz DPROT= $DPROT $DPORT\n";
                                        $PROT=$DPROT;
                                        $PROT="-p $PROT" if ($PROT ne '' && $PROT ne ' ');
                                        foreach my $a (sort keys %sourcehash){
                                                foreach my $b (sort keys %targethash){
                                                        if ($sourcehash{$a}[0] ne $targethash{$b}[0] && $targethash{$b}[0] ne 'none' || $sourcehash{$a}[0] eq '0.0.0.0/0.0.0.0'){
-                                                               if($DPROT eq ' ' || $DPROT ne ''){
+                                                               if($DPROT ne ''){
                                                                        if(substr($sourcehash{$a}[0], 3, 3) ne 'mac' && $sourcehash{$a}[0] ne ''){ $STAG="-s";}
                                                                        if(substr($DPORT, 2, 4) eq 'icmp'){
                                                                                my @icmprule= split(",",substr($DPORT, 12,));
@@ -302,7 +302,10 @@ sub buildrules
                                                                        if ($PROT ne '-p ICMP'){
                                                                                print "iptables -A $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j $$hash{$key}[0]\n";
                                                                        }
-                                                               }                               
+                                                                       if ($PROT eq '-p ICMP' && $$hash{$key}[9] eq 'All ICMP-Types'){
+                                                                               print "iptables -A $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j $$hash{$key}[0]\n";
+                                                                       }
+                                                               }
                                                        }
                                                }
                                        }
@@ -316,7 +319,7 @@ sub buildrules
                                        foreach my $a (sort keys %sourcehash){
                                                foreach my $b (sort keys %targethash){
                                                        if ($sourcehash{$a}[0] ne $targethash{$b}[0] && $targethash{$b}[0] ne 'none' || $sourcehash{$a}[0] eq '0.0.0.0/0.0.0.0'){
-                                                               if($DPROT ne '' || $DPROT eq ' '){
+                                                               if($DPROT ne ''){
                                                                        if(substr($sourcehash{$a}[0], 3, 3) ne 'mac' && $sourcehash{$a}[0] ne ''){ $STAG="-s";}
                                                                        #Process ICMP RULE
                                                                        if(substr($DPORT, 2, 4) eq 'icmp'){
@@ -365,7 +368,11 @@ sub buildrules
                                                                        if ($PROT ne '-p ICMP'){
                                                                                system "iptables -A $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j $$hash{$key}[0]\n";
                                                                        }
-                                                               }                               
+                                                                       #PROCESS Prot ICMP and type = All ICMP-Types
+                                                                       if ($PROT eq '-p ICMP' && $$hash{$key}[9] eq 'All ICMP-Types'){
+                                                                               system "iptables -A $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j $$hash{$key}[0]\n";
+                                                                       }
+                                                               }
                                                        }
                                                }
                                        }
@@ -473,7 +480,7 @@ sub get_address
        my $type=shift; #src or tgt
        my $hash;
        if ($type eq 'src'){
-               $hash=\%sourcehash;     
+               $hash=\%sourcehash;
        }else{
                $hash=\%targethash;
        }
@@ -593,6 +600,8 @@ sub get_port
                                }else{
                                        return "--dport ".&fwlib::get_srv_port($$hash{$key}[15],1,$prot);
                                }
+                       }elsif($prot eq 'ICMP' && $$hash{$key}[11] eq 'ON'){        #When PROT is ICMP and "use targetport is checked, this is an icmp-service
+                               return "--icmp-type ".&fwlib::get_srv_port($$hash{$key}[15],3,$prot);
                        }
                }elsif($$hash{$key}[14] eq 'cust_srvgrp'){
                        if      ($prot ne 'ICMP'){