]> git.ipfire.org Git - people/teissler/ipfire-2.x.git/blobdiff - html/cgi-bin/firewall.cgi
projects / people / teissler / ipfire-2.x.git / blobdiff
? search:
summary | shortlog | log | commit | commitdiff | tree
raw | inline | side by side
openssl: Don't propose too weak ciphers.
[people/teissler/ipfire-2.x.git] / html / cgi-bin / firewall.cgi
diff --git a/html/cgi-bin/firewall.cgi b/html/cgi-bin/firewall.cgi
index fc6633f2b6f87b8e6e37e492e7ec8f1da4ab314d..71ca752574f56f8448ea33c5c94df6c38781d816 100755 (executable)
--- a/html/cgi-bin/firewall.cgi
+++ b/html/cgi-bin/firewall.cgi
@@ -251,17 +251,6 @@ if ($fwdfwsettings{'ACTION'} eq 'saverule')
                        }
                }
                if (!$errormessage){
-                       &checkcounter($fwdfwsettings{'oldgrp1a'},$fwdfwsettings{'oldgrp1b'},$fwdfwsettings{'grp1'},$fwdfwsettings{$fwdfwsettings{'grp1'}});
-                       if ($fwdfwsettings{'nobase'} ne 'on'){
-                               &checkcounter($fwdfwsettings{'oldgrp2a'},$fwdfwsettings{'oldgrp2b'},$fwdfwsettings{'grp2'},$fwdfwsettings{$fwdfwsettings{'grp2'}});
-                       }
-                       if($fwdfwsettings{'oldusesrv'} eq '' &&  $fwdfwsettings{'USESRV'} eq 'ON'){
-                               &checkcounter(0,0,$fwdfwsettings{'grp3'},$fwdfwsettings{$fwdfwsettings{'grp3'}});
-                       }elsif ($fwdfwsettings{'USESRV'} eq '' && $fwdfwsettings{'oldusesrv'} eq 'ON') {
-                               &checkcounter($fwdfwsettings{'oldgrp3a'},$fwdfwsettings{'oldgrp3b'},0,0);
-                       }elsif ($fwdfwsettings{'oldusesrv'} eq $fwdfwsettings{'USESRV'} && $fwdfwsettings{'oldgrp3b'} ne $fwdfwsettings{$fwdfwsettings{'grp3'}} && $fwdfwsettings{'updatefwrule'} eq 'on'){
-                               &checkcounter($fwdfwsettings{'oldgrp3a'},$fwdfwsettings{'oldgrp3b'},$fwdfwsettings{'grp3'},$fwdfwsettings{$fwdfwsettings{'grp3'}});
-                       }
                        if($fwdfwsettings{'nosave2'} ne 'on'){
                                &saverule(\%configinputfw,$configinput);
                        }
@@ -307,18 +296,6 @@ if ($fwdfwsettings{'ACTION'} eq 'saverule')
                }
                #increase counters
                if (!$errormessage){
-                &checkcounter($fwdfwsettings{'oldgrp1a'},$fwdfwsettings{'oldgrp1b'},$fwdfwsettings{'grp1'},$fwdfwsettings{$fwdfwsettings{'grp1'}});
-                &checkcounter($fwdfwsettings{'oldgrp2a'},$fwdfwsettings{'oldgrp2b'},$fwdfwsettings{'grp2'},$fwdfwsettings{$fwdfwsettings{'grp2'}});
-                       if($fwdfwsettings{'oldusesrv'} eq '' &&  $fwdfwsettings{'USESRV'} eq 'ON'){
-                               &checkcounter(0,0,$fwdfwsettings{'grp3'},$fwdfwsettings{$fwdfwsettings{'grp3'}});
-                       }elsif ($fwdfwsettings{'USESRV'} eq '' && $fwdfwsettings{'oldusesrv'} eq 'ON') {
-                               &checkcounter($fwdfwsettings{'oldgrp3a'},$fwdfwsettings{'oldgrp3b'},0,0);
-                       }elsif ($fwdfwsettings{'oldusesrv'} eq $fwdfwsettings{'USESRV'} && $fwdfwsettings{'oldgrp3b'} ne $fwdfwsettings{$fwdfwsettings{'grp3'}} && $fwdfwsettings{'updatefwrule'} eq 'on'){
-                               &checkcounter($fwdfwsettings{'oldgrp3a'},$fwdfwsettings{'oldgrp3b'},$fwdfwsettings{'grp3'},$fwdfwsettings{$fwdfwsettings{'grp3'}});
-                       }
-                       if ($fwdfwsettings{'nobase'} eq 'on'){
-                               &checkcounter(0,0,$fwdfwsettings{'grp3'},$fwdfwsettings{$fwdfwsettings{'grp3'}});
-                       }
                        if ($fwdfwsettings{'nosave2'} ne 'on'){
                                &saverule(\%configoutgoingfw,$configoutgoing);
                        }
@@ -364,18 +341,6 @@ if ($fwdfwsettings{'ACTION'} eq 'saverule')
                }
                #increase counters
                if (!$errormessage){
-                       &checkcounter($fwdfwsettings{'oldgrp1a'},$fwdfwsettings{'oldgrp1b'},$fwdfwsettings{'grp1'},$fwdfwsettings{$fwdfwsettings{'grp1'}});
-                       &checkcounter($fwdfwsettings{'oldgrp2a'},$fwdfwsettings{'oldgrp2b'},$fwdfwsettings{'grp2'},$fwdfwsettings{$fwdfwsettings{'grp2'}});
-                       if($fwdfwsettings{'oldusesrv'} eq '' &&  $fwdfwsettings{'USESRV'} eq 'ON'){
-                               &checkcounter(0,0,$fwdfwsettings{'grp3'},$fwdfwsettings{$fwdfwsettings{'grp3'}});
-                       }elsif ($fwdfwsettings{'USESRV'} eq '' && $fwdfwsettings{'oldusesrv'} eq 'ON') {
-                               &checkcounter($fwdfwsettings{'oldgrp3a'},$fwdfwsettings{'oldgrp3b'},0,0);
-                       }elsif ($fwdfwsettings{'oldusesrv'} eq $fwdfwsettings{'USESRV'} && $fwdfwsettings{'oldgrp3b'} ne $fwdfwsettings{$fwdfwsettings{'grp3'}} && $fwdfwsettings{'updatefwrule'} eq 'on'){
-                               &checkcounter($fwdfwsettings{'oldgrp3a'},$fwdfwsettings{'oldgrp3b'},$fwdfwsettings{'grp3'},$fwdfwsettings{$fwdfwsettings{'grp3'}});
-                       }
-                       if ($fwdfwsettings{'nobase'} eq 'on'){
-                               &checkcounter(0,0,$fwdfwsettings{'grp3'},$fwdfwsettings{$fwdfwsettings{'grp3'}});
-                       }
                        if ($fwdfwsettings{'nosave2'} ne 'on'){
                                &saverule(\%configfwdfw,$configfwdfw);
                        }
@@ -497,8 +462,6 @@ sub changerule
        $fwdfwsettings{'config'}=$oldchain;
        $fwdfwsettings{'nobase'}='on';
        &deleterule;
-       &checkcounter(0,0,$fwdfwsettings{'grp1'},$fwdfwsettings{$fwdfwsettings{'grp1'}});
-       &checkcounter(0,0,$fwdfwsettings{'grp3'},$fwdfwsettings{$fwdfwsettings{'grp3'}});
 }
 sub checksource
 {
@@ -766,8 +729,11 @@ sub checkrule
 {
        #check valid port for NAT
        if($fwdfwsettings{'USE_NAT'} eq 'ON'){
-               #if no port is given in nat area, take target host port
+               #if no dest port is given in nat area, take target host port
                if($fwdfwsettings{'nat'} eq 'dnat' && $fwdfwsettings{'grp3'} eq 'TGT_PORT' && $fwdfwsettings{'dnatport'} eq ''){$fwdfwsettings{'dnatport'}=$fwdfwsettings{'TGT_PORT'};}
+               if($fwdfwsettings{'TGT_PORT'} eq ''){
+                       $errormessage=$Lang::tr{'fwdfw dnat porterr2'};
+               }
                #check if port given in nat area is a single valid port or portrange
                if($fwdfwsettings{'nat'} eq 'dnat' && $fwdfwsettings{'TGT_PORT'} ne '' && !&check_natport($fwdfwsettings{'dnatport'})){
                        $errormessage=$Lang::tr{'fwdfw target'}.": ".$Lang::tr{'fwdfw dnat porterr'}."<br>";
@@ -820,6 +786,10 @@ sub checkrule
                                        }
                                        $fwdfwsettings{'dnatport'}=join("|",@values);
                }
+               #check if a rule with prot tcp or udp and ports is edited and now prot is "all", then delete all ports
+               if($fwdfwsettings{'PROT'} eq ''){
+                       $fwdfwsettings{'dnatport'}='';
+               }
        }
        #check valid remark
        if ($fwdfwsettings{'ruleremark'} ne '' && !&validremark($fwdfwsettings{'ruleremark'})){
@@ -933,34 +903,6 @@ sub checkrule
                $fwdfwsettings{'ICMP_TYPES'}='';
        }
 }
-sub checkcounter
-{
-       my ($base1,$val1,$base2,$val2) = @_;
-               
-       if($base1 eq 'cust_net_src' || $base1 eq 'cust_net_tgt'){
-               &dec_counter($confignet,\%customnetwork,$val1);
-       }elsif($base1 eq 'cust_host_src' || $base1 eq 'cust_host_tgt'){
-               &dec_counter($confighost,\%customhost,$val1);
-       }elsif($base1 eq 'cust_grp_src' || $base1 eq 'cust_grp_tgt'){
-               &dec_counter($configgrp,\%customgrp,$val1);
-       }elsif($base1 eq 'cust_srv'){
-               &dec_counter($configsrv,\%customservice,$val1);
-       }elsif($base1 eq 'cust_srvgrp'){
-               &dec_counter($configsrvgrp,\%customservicegrp,$val1);   
-       }
-
-       if($base2 eq 'cust_net_src' || $base2 eq 'cust_net_tgt'){
-               &inc_counter($confignet,\%customnetwork,$val2);
-       }elsif($base2 eq 'cust_host_src' || $base2 eq 'cust_host_tgt'){
-               &inc_counter($confighost,\%customhost,$val2);
-       }elsif($base2 eq 'cust_grp_src' || $base2 eq 'cust_grp_tgt'){
-               &inc_counter($configgrp,\%customgrp,$val2);
-       }elsif($base2 eq 'cust_srv'){
-               &inc_counter($configsrv,\%customservice,$val2);
-       }elsif($base2 eq 'cust_srvgrp'){
-               &inc_counter($configsrvgrp,\%customservicegrp,$val2);   
-       }
-}
 sub checkvpn
 {
        my $ip=shift;
@@ -992,15 +934,6 @@ sub deleterule
        my %delhash=();
        &General::readhasharray($fwdfwsettings{'config'}, \%delhash);
        foreach my $key (sort {$a <=> $b} keys %delhash){
-               if ($key == $fwdfwsettings{'key'}){
-                       #check hosts/net and groups
-                       &checkcounter($delhash{$key}[3],$delhash{$key}[4],,);
-                       &checkcounter($delhash{$key}[5],$delhash{$key}[6],,);
-                       #check services and groups
-                       if ($delhash{$key}[11] eq 'ON'){
-                               &checkcounter($delhash{$key}[14],$delhash{$key}[15],,);
-                       }
-               }
                if ($key >= $fwdfwsettings{'key'}) {
                        my $next = $key + 1;
                        if (exists $delhash{$next}) {
@@ -1033,21 +966,6 @@ sub disable_rule
        &General::writehasharray("$configfwdfw", \%configfwdfw);
        &General::firewall_config_changed();
 }
-sub dec_counter
-{
-       my $config=shift;
-       my %hash=%{(shift)};
-       my $val=shift;
-       my $pos;
-       &General::readhasharray($config, \%hash);
-       foreach my $key (sort { uc($hash{$a}[0]) cmp uc($hash{$b}[0]) }  keys %hash){
-               if($hash{$key}[0] eq $val){
-                       $pos=$#{$hash{$key}};
-                       $hash{$key}[$pos] = $hash{$key}[$pos]-1;
-               }
-       }
-       &General::writehasharray($config, \%hash);
-}
 sub error
 {
        if ($errormessage) {
@@ -2364,15 +2282,14 @@ sub validremark
                return 0;}
        return 1;
 }
-
-sub viewtablerule {
+sub viewtablerule
+{
        &General::readhash("/var/ipfire/ethernet/settings", \%netsettings);
 
        &viewtablenew(\%configfwdfw, $configfwdfw, $Lang::tr{'firewall rules'});
        &viewtablenew(\%configinputfw, $configinput, $Lang::tr{'external access'});
        &viewtablenew(\%configoutgoingfw, $configoutgoing, $Lang::tr{'outgoing firewall'});
 }
-
 sub viewtablenew
 {
        my $hash=shift;
@@ -2631,15 +2548,12 @@ END
                                }
                                print"<br>-&gt;";
                        }
-                       if ($$hash{$key}[5] eq 'ipfire'){
-                               $ipfireiface='Interface';
-                       }
-                       if ($$hash{$key}[5] eq 'std_net_tgt' || $$hash{$key}[5] eq 'ipfire'  || $$hash{$key}[6] eq 'RED1' || $$hash{$key}[6] eq 'GREEN' || $$hash{$key}[6] eq 'ORANGE' || $$hash{$key}[6] eq 'BLUE' ){
+                       if ($$hash{$key}[5] eq 'std_net_tgt' || $$hash{$key}[5] eq 'ipfire'){
                                if ($$hash{$key}[6] eq 'RED1'){
-                                       print "$ipfireiface $Lang::tr{'red1'}";
+                                       print "$Lang::tr{'red1'}";
                                }elsif ($$hash{$key}[6] eq 'GREEN' || $$hash{$key}[6] eq 'ORANGE' || $$hash{$key}[6] eq 'BLUE'|| $$hash{$key}[6] eq 'ALL' || $$hash{$key}[6] eq 'RED')
                                {
-                                       print "$ipfireiface ".&get_name($$hash{$key}[6]);
+                                       print &get_name($$hash{$key}[6]);
                                }else{
                                        print $$hash{$key}[6];
                                }
Timo's tree of IPFire 2.x