my %ovpnsettings=();
my %ipsecsettings=();
my %aliases=();
+my @p2ps = ();
my $color;
my $confignet = "${General::swroot}/fwhosts/customnetworks";
my $confighost = "${General::swroot}/fwhosts/customhosts";
my $configfwdfw = "${General::swroot}/forward/config";
my $configinput = "${General::swroot}/forward/input";
my $configovpn = "${General::swroot}/ovpn/settings";
-
+my $p2pfile = "${General::swroot}/forward/p2protocols";
my $errormessage='';
my $hint='';
my $ipgrp="${General::swroot}/outgoing/groups";
$errormessage=&checksource;
if(!$errormessage){&checktarget;}
if(!$errormessage){&checkrule;}
-
#check if we change an forward rule to an external access
if( $fwdfwsettings{'grp2'} eq 'ipfire' && $fwdfwsettings{'oldgrp2a'} ne 'ipfire' && $fwdfwsettings{'updatefwrule'} eq 'on'){
$fwdfwsettings{'updatefwrule'}='';
&checkcounter(0,0,$fwdfwsettings{'grp1'},$fwdfwsettings{$fwdfwsettings{'grp1'}});
&checkcounter(0,0,$fwdfwsettings{'grp3'},$fwdfwsettings{$fwdfwsettings{'grp3'}});
}
-
#check if we change an external access rule to an forward
if( $fwdfwsettings{'grp2'} ne 'ipfire' && $fwdfwsettings{'oldgrp2a'} eq 'ipfire' && $fwdfwsettings{'updatefwrule'} eq 'on'){
$fwdfwsettings{'updatefwrule'}='';
if ("$fwdfwsettings{'RULE_ACTION'},$fwdfwsettings{'ACTIVE'},$fwdfwsettings{'grp1'},$fwdfwsettings{$fwdfwsettings{'grp1'}},$fwdfwsettings{'grp2'},$fwdfwsettings{$fwdfwsettings{'grp2'}},$fwdfwsettings{'USE_SRC_PORT'},$fwdfwsettings{'PROT'},$fwdfwsettings{'ICMP_TYPES'},$fwdfwsettings{'SRC_PORT'},$fwdfwsettings{'USESRV'},$fwdfwsettings{'TGT_PROT'},$fwdfwsettings{'ICMP_TGT'},$fwdfwsettings{'grp3'},$fwdfwsettings{$fwdfwsettings{'grp3'}},$fwdfwsettings{'LOG'},$fwdfwsettings{'TIME'},$fwdfwsettings{'TIME_MON'},$fwdfwsettings{'TIME_TUE'},$fwdfwsettings{'TIME_WED'},$fwdfwsettings{'TIME_THU'},$fwdfwsettings{'TIME_FRI'},$fwdfwsettings{'TIME_SAT'},$fwdfwsettings{'TIME_SUN'},$fwdfwsettings{'TIME_FROM'},$fwdfwsettings{'TIME_TO'}"
eq "$configinputfw{$key}[0],$configinputfw{$key}[2],$configinputfw{$key}[3],$configinputfw{$key}[4],$configinputfw{$key}[5],$configinputfw{$key}[6],$configinputfw{$key}[7],$configinputfw{$key}[8],$configinputfw{$key}[9],$configinputfw{$key}[10],$configinputfw{$key}[11],$configinputfw{$key}[12],$configinputfw{$key}[13],$configinputfw{$key}[14],$configinputfw{$key}[15],$configinputfw{$key}[17],$configinputfw{$key}[18],$configinputfw{$key}[19],$configinputfw{$key}[20],$configinputfw{$key}[21],$configinputfw{$key}[22],$configinputfw{$key}[23],$configinputfw{$key}[24],$configinputfw{$key}[25],$configinputfw{$key}[26],$configinputfw{$key}[27]"){
$errormessage.=$Lang::tr{'fwdfw err ruleexists'};
+ if ($fwdfwsettings{'oldruleremark'} ne $fwdfwsettings{'ruleremark'} && $fwdfwsettings{'updatefwrule'} eq 'on' && &validremark($fwdfwsettings{'ruleremark'})){
+ $errormessage='';
+ }elsif($fwdfwsettings{'oldruleremark'} ne $fwdfwsettings{'ruleremark'} && $fwdfwsettings{'updatefwrule'} eq 'on' && !&validremark($fwdfwsettings{'ruleremark'})){
+ $errormessage=$Lang::tr{'fwdfw err remark'}."<br>";
+ }
+ if ($fwdfwsettings{'oldruleremark'} eq $fwdfwsettings{'ruleremark'}){
+ $fwdfwsettings{'nosave'} = 'on';
+ }
}
}
}
+ #check if we just close a rule
+ if( $fwdfwsettings{'oldgrp1a'} eq $fwdfwsettings{'grp1'} && $fwdfwsettings{'oldgrp1b'} eq $fwdfwsettings{$fwdfwsettings{'grp1'}} && $fwdfwsettings{'oldgrp2a'} eq $fwdfwsettings{'grp2'} && $fwdfwsettings{'oldgrp2b'} eq $fwdfwsettings{$fwdfwsettings{'grp2'}} && $fwdfwsettings{'oldgrp3a'} eq $fwdfwsettings{'grp3'} && $fwdfwsettings{'oldgrp3b'} eq $fwdfwsettings{$fwdfwsettings{'grp3'}} && $fwdfwsettings{'oldusesrv'} eq $fwdfwsettings{'USESRV'} ) {
+ if($fwdfwsettings{'nosave'} eq 'on' && $fwdfwsettings{'updatefwrule'} eq 'on'){
+ $errormessage='';
+ $fwdfwsettings{'nosave2'} = 'on';
+ }
+ }
&checkcounter($fwdfwsettings{'oldgrp1a'},$fwdfwsettings{'oldgrp1b'},$fwdfwsettings{'grp1'},$fwdfwsettings{$fwdfwsettings{'grp1'}});
if ($fwdfwsettings{'nobase'} ne 'on'){
&checkcounter($fwdfwsettings{'oldgrp2a'},$fwdfwsettings{'oldgrp2b'},$fwdfwsettings{'grp2'},$fwdfwsettings{$fwdfwsettings{'grp2'}});
}elsif ($fwdfwsettings{'oldusesrv'} eq $fwdfwsettings{'USESRV'} && $fwdfwsettings{'oldgrp3b'} ne $fwdfwsettings{$fwdfwsettings{'grp3'}} && $fwdfwsettings{'updatefwrule'} eq 'on'){
&checkcounter($fwdfwsettings{'oldgrp3a'},$fwdfwsettings{'oldgrp3b'},$fwdfwsettings{'grp3'},$fwdfwsettings{$fwdfwsettings{'grp3'}});
}
-
- &saverule(\%configinputfw,$configinput);
+ if($fwdfwsettings{'nosave2'} ne 'on'){
+ &saverule(\%configinputfw,$configinput);
+ }
#print "Source: $fwdfwsettings{'grp1'} -> $fwdfwsettings{$fwdfwsettings{'grp1'}}<br>";
#print "Sourceport: $fwdfwsettings{'USE_SRC_PORT'}, $fwdfwsettings{'PROT'}, $fwdfwsettings{'ICMP_TYPES'}, $fwdfwsettings{'SRC_PORT'}<br>";
#print "Target: $fwdfwsettings{'grp2'} -> $fwdfwsettings{$fwdfwsettings{'grp2'}}<br>";
#print"ALT: $fwdfwsettings{'oldgrp3a'} $fwdfwsettings{'oldgrp3b'} NEU: $fwdfwsettings{'grp3'} $fwdfwsettings{$fwdfwsettings{'grp3'}}<br>";
#print"DIENSTE Checkalt:$fwdfwsettings{'oldusesrv'} DIENSTE Checkneu:$fwdfwsettings{'USESRV'} DIENST ALT:$fwdfwsettings{'oldgrp3a'},$fwdfwsettings{'oldgrp3b'} DIENST NEU:$fwdfwsettings{'grp3'},$fwdfwsettings{$fwdfwsettings{'grp3'}}<br>";
}else{
+ #FORWARD PART
$fwdfwsettings{'chain'} = 'FORWARDFW';
if($fwdfwsettings{'oldrulenumber'} eq $fwdfwsettings{'rulepos'}){
#check if we have an identical rule already
if ("$fwdfwsettings{'RULE_ACTION'},$fwdfwsettings{'ACTIVE'},$fwdfwsettings{'grp1'},$fwdfwsettings{$fwdfwsettings{'grp1'}},$fwdfwsettings{'grp2'},$fwdfwsettings{$fwdfwsettings{'grp2'}},$fwdfwsettings{'USE_SRC_PORT'},$fwdfwsettings{'PROT'},$fwdfwsettings{'ICMP_TYPES'},$fwdfwsettings{'SRC_PORT'},$fwdfwsettings{'USESRV'},$fwdfwsettings{'TGT_PROT'},$fwdfwsettings{'ICMP_TGT'},$fwdfwsettings{'grp3'},$fwdfwsettings{$fwdfwsettings{'grp3'}},$fwdfwsettings{'LOG'},$fwdfwsettings{'TIME'},$fwdfwsettings{'TIME_MON'},$fwdfwsettings{'TIME_TUE'},$fwdfwsettings{'TIME_WED'},$fwdfwsettings{'TIME_THU'},$fwdfwsettings{'TIME_FRI'},$fwdfwsettings{'TIME_SAT'},$fwdfwsettings{'TIME_SUN'},$fwdfwsettings{'TIME_FROM'},$fwdfwsettings{'TIME_TO'}"
eq "$configfwdfw{$key}[0],$configfwdfw{$key}[2],$configfwdfw{$key}[3],$configfwdfw{$key}[4],$configfwdfw{$key}[5],$configfwdfw{$key}[6],$configfwdfw{$key}[7],$configfwdfw{$key}[8],$configfwdfw{$key}[9],$configfwdfw{$key}[10],$configfwdfw{$key}[11],$configfwdfw{$key}[12],$configfwdfw{$key}[13],$configfwdfw{$key}[14],$configfwdfw{$key}[15],$configfwdfw{$key}[17],$configfwdfw{$key}[18],$configfwdfw{$key}[19],$configfwdfw{$key}[20],$configfwdfw{$key}[21],$configfwdfw{$key}[22],$configfwdfw{$key}[23],$configfwdfw{$key}[24],$configfwdfw{$key}[25],$configfwdfw{$key}[26],$configfwdfw{$key}[27]"){
$errormessage.=$Lang::tr{'fwdfw err ruleexists'};
+ if ($fwdfwsettings{'oldruleremark'} ne $fwdfwsettings{'ruleremark'} && $fwdfwsettings{'updatefwrule'} eq 'on' && &validremark($fwdfwsettings{'ruleremark'})){
+ $errormessage='';
+ }elsif($fwdfwsettings{'oldruleremark'} ne $fwdfwsettings{'ruleremark'} && $fwdfwsettings{'updatefwrule'} eq 'on' && !&validremark($fwdfwsettings{'ruleremark'})){
+ $errormessage=$Lang::tr{'fwdfw err remark'}."<br>";
+ }
+ if ($fwdfwsettings{'oldruleremark'} eq $fwdfwsettings{'ruleremark'}){
+ $fwdfwsettings{'nosave'} = 'on';
+ }
}
}
}
+ #check if we just close a rule
+ if( $fwdfwsettings{'oldgrp1a'} eq $fwdfwsettings{'grp1'} && $fwdfwsettings{'oldgrp1b'} eq $fwdfwsettings{$fwdfwsettings{'grp1'}} && $fwdfwsettings{'oldgrp2a'} eq $fwdfwsettings{'grp2'} && $fwdfwsettings{'oldgrp2b'} eq $fwdfwsettings{$fwdfwsettings{'grp2'}} && $fwdfwsettings{'oldgrp3a'} eq $fwdfwsettings{'grp3'} && $fwdfwsettings{'oldgrp3b'} eq $fwdfwsettings{$fwdfwsettings{'grp3'}} && $fwdfwsettings{'oldusesrv'} eq $fwdfwsettings{'USESRV'} && $fwdfwsettings{'oldruleremark'} eq $fwdfwsettings{'ruleremark'} ) {
+ if($fwdfwsettings{'nosave'} eq 'on' && $fwdfwsettings{'updatefwrule'} eq 'on'){
+ $fwdfwsettings{'nosave2'} = 'on';
+ $errormessage='';
+ }
+ }
#increase counters
&checkcounter($fwdfwsettings{'oldgrp1a'},$fwdfwsettings{'oldgrp1b'},$fwdfwsettings{'grp1'},$fwdfwsettings{$fwdfwsettings{'grp1'}});
&checkcounter($fwdfwsettings{'oldgrp2a'},$fwdfwsettings{'oldgrp2b'},$fwdfwsettings{'grp2'},$fwdfwsettings{$fwdfwsettings{'grp2'}});
if ($fwdfwsettings{'nobase'} eq 'on'){
&checkcounter(0,0,$fwdfwsettings{'grp3'},$fwdfwsettings{$fwdfwsettings{'grp3'}});
}
- &saverule(\%configfwdfw,$configfwdfw);
+ if ($fwdfwsettings{'nosave2'} ne 'on'){
+ &saverule(\%configfwdfw,$configfwdfw);
+ }
#print "Source: $fwdfwsettings{'grp1'} -> $fwdfwsettings{$fwdfwsettings{'grp1'}}<br>";
#print "Sourceport: $fwdfwsettings{'USE_SRC_PORT'}, $fwdfwsettings{'PROT'}, $fwdfwsettings{'ICMP_TYPES'}, $fwdfwsettings{'SRC_PORT'}<br>";
#print "Target: $fwdfwsettings{'grp2'} -> $fwdfwsettings{$fwdfwsettings{'grp2'}}<br>";
if ($errormessage){
&newrule;
}else{
- &rules;
+ if($fwdfwsettings{'nosave2'} ne 'on'){
+ &rules;
+ }
&base;
}
}
#$fwdfwsettings{'updatefwrule'}='on';
&newrule;
}
+if ($fwdfwsettings{'ACTION'} eq 'togglep2p')
+{
+ #$errormessage="Toggle $fwdfwsettings{'P2PROT'}<br>";
+ open( FILE, "< $p2pfile" ) or die "Unable to read $p2pfile";
+ @p2ps = <FILE>;
+ close FILE;
+ open( FILE, "> $p2pfile" ) or die "Unable to write $p2pfile";
+ foreach my $p2pentry (sort @p2ps)
+ {
+ my @p2pline = split( /\;/, $p2pentry );
+ if ($p2pline[1] eq $fwdfwsettings{'P2PROT'}) {
+ if($p2pline[2] eq 'on'){
+ $p2pline[2]='off';
+ }else{
+ $p2pline[2]='on';
+ }
+ }
+ print FILE "$p2pline[0];$p2pline[1];$p2pline[2];\n";
+ }
+ close FILE;
+ &rules;
+ &base;
+}
if ($fwdfwsettings{'ACTION'} eq '')
{
&base;
#print"<td bgcolor='$color{$i}'>$_</td>";
#}
#print"</tr></table>";
+ if ($fwdfwsettings{'POLICY'} eq 'MODE1' || $fwdfwsettings{'POLICY'} eq 'MODE2' ) {
+ &p2pblock;
+ }
&Header::openbox('100%', 'center', 'Policy');
print <<END;
<form method='post' action='$ENV{'SCRIPT_NAME'}'>
<tr><td width='10%' align='left'><b>$Lang::tr{'mode'} 2:</b><td width='90%' align='left' colspan='2'>$Lang::tr{'outgoing firewall mode2'}</td></tr>
<tr><td colspan='3'><hr /></td></tr>
<tr><td width='10%' align='left'> <select name='POLICY' style="width: 85px"><option value='MODE0' $selected{'POLICY'}{'MODE0'}>$Lang::tr{'mode'} 0</option><option value='MODE1' $selected{'POLICY'}{'MODE1'}>$Lang::tr{'mode'} 1</option><option value='MODE2' $selected{'POLICY'}{'MODE2'}>$Lang::tr{'mode'} 2</option></select>
- <td width='45%' align='left'><input type='submit' name='ACTION' value=$Lang::tr{'save'} />
- <td width='45%' align='left'>
+ <td width='45%' align='left'><input type='submit' name='ACTION' value=$Lang::tr{'save'} />
+ <td width='45%' align='left'>
END
if ($fwdfwsettings{'POLICY'} ne 'MODE0'&& $fwdfwsettings{'POLICY'} ne '' ) {
print "$Lang::tr{'outgoing firewall reset'}: <input type='submit' name='ACTION' value='$Lang::tr{'reset'}' />";
}
-print "</table></form>";
+ print "</table></form>";
&Header::closebox();
}
sub addrule
my %delhash=();
&General::readhasharray($fwdfwsettings{'config'}, \%delhash);
foreach my $key (sort {$a <=> $b} keys %delhash){
- if ($key eq $fwdfwsettings{'key'}){
+ if ($key == $fwdfwsettings{'key'}){
#check hosts/net and groups
&checkcounter($delhash{$key}[3],$delhash{$key}[4],,);
&checkcounter($delhash{$key}[5],$delhash{$key}[6],,);
&checkcounter($delhash{$key}[14],$delhash{$key}[15],,);
}
}
- if ($key ge $fwdfwsettings{'key'}) {
+ if ($key >= $fwdfwsettings{'key'}) {
my $next = $key + 1;
if (exists $delhash{$next}) {
foreach my $i (0 .. $#{$delhash{$next}}) {
sub checksource
{
my ($ip,$subnet);
-
+
#check ip-address if manual
if ($fwdfwsettings{'src_addr'} eq $fwdfwsettings{$fwdfwsettings{'grp1'}} && $fwdfwsettings{'src_addr'} ne ''){
#check if ip with subnet
$subnet = '32';
$fwdfwsettings{'isip'}='on';
}
-
+
if ($fwdfwsettings{'isip'} ne 'on'){
if (&General::validmac($fwdfwsettings{'src_addr'})){$fwdfwsettings{'ismac'}='on';}
}
$errormessage=$Lang::tr{'fwhost err hostip'}."<br>";
}
$fwdfwsettings{'src_addr'}="$ip/$subnet";
-
+
if(!&General::validipandmask($fwdfwsettings{'src_addr'})){
$errormessage.=$Lang::tr{'fwdfw err src_addr'}."<br>";
}
}elsif($fwdfwsettings{'USE_SRC_PORT'} eq 'ON' && $fwdfwsettings{'PROT'} eq 'ESP'){
$fwdfwsettings{'SRC_PORT'}='';
$fwdfwsettings{'ICMP_TYPES'}='';
+ }elsif($fwdfwsettings{'USE_SRC_PORT'} eq 'ON' && $fwdfwsettings{'PROT'} eq 'AH'){
+ $fwdfwsettings{'SRC_PORT'}='';
+ $fwdfwsettings{'ICMP_TYPES'}='';
}elsif($fwdfwsettings{'USE_SRC_PORT'} eq 'ON' && $fwdfwsettings{'PROT'} ne 'ICMP'){
$fwdfwsettings{'ICMP_TYPES'}='';
}else{
$fwdfwsettings{'PROT'}='';
}
- if($fwdfwsettings{'USE_SRC_PORT'} eq 'ON' && $fwdfwsettings{'PROT'} ne 'ICMP' && $fwdfwsettings{'SRC_PORT'} ne ''){
- #change dashes with :
- $fwdfwsettings{'SRC_PORT'}=~ tr/-/:/;
-
- if ($fwdfwsettings{'SRC_PORT'} eq "*") {
- $fwdfwsettings{'SRC_PORT'} = "1:65535";
- }
- if ($fwdfwsettings{'SRC_PORT'} =~ /^(\D)\:(\d+)$/) {
- $fwdfwsettings{'SRC_PORT'} = "1:$2";
- }
- if ($fwdfwsettings{'SRC_PORT'} =~ /^(\d+)\:(\D)$/) {
- $fwdfwsettings{'SRC_PORT'} = "$1:65535";
+ if($fwdfwsettings{'USE_SRC_PORT'} eq 'ON' && ($fwdfwsettings{'PROT'} eq 'TCP' || $fwdfwsettings{'PROT'} eq 'UDP') && $fwdfwsettings{'SRC_PORT'} ne ''){
+ my @parts=split(",",$fwdfwsettings{'SRC_PORT'});
+ my @values=();
+ foreach (@parts){
+ chomp($_);
+ if ($_ =~ /^(\d+)\:(\d+)$/) {
+ my $check;
+ #change dashes with :
+ $_=~ tr/-/:/;
+ if ($_ eq "*") {
+ push(@values,"1:65535");
+ $check='on';
+ }
+ if ($_ =~ /^(\D)\:(\d+)$/) {
+ push(@values,"1:$2");
+ $check='on';
+ }
+ if ($_ =~ /^(\d+)\:(\D)$/) {
+ push(@values,"$1:65535");
+ $check='on'
+ }
+ $errormessage .= &General::validportrange($_, 'destination');
+ if(!$check){
+ push (@values,$_);
+ }
+ }else{
+ if (&General::validport($_)){
+ push (@values,$_);
+ }else{
+
+ }
+ }
}
-
- $errormessage.=&General::validportrange($fwdfwsettings{'SRC_PORT'},'src');
+ $fwdfwsettings{'SRC_PORT'}=join("|",@values);
+ return $errormessage;
}
- return $errormessage;
}
sub checktarget
{
#check and form valid IP
$ip=&General::ip2dec($ip);
$ip=&General::dec2ip($ip);
-
+
#check if net or broadcast
my @tmp= split (/\./,$ip);
if (($tmp[3] eq "0") || ($tmp[3] eq "255"))
}
}
if ($fwdfwsettings{'grp3'} eq 'TGT_PORT'){
- if ($fwdfwsettings{'TGT_PROT'} ne 'ICMP' && $fwdfwsettings{'TGT_PROT'} ne 'GRE'){
+ if ($fwdfwsettings{'TGT_PROT'} eq 'TCP' || $fwdfwsettings{'TGT_PROT'} eq 'UDP'){
if ($fwdfwsettings{'TGT_PORT'} ne ''){
- #change dashes with :
- $fwdfwsettings{'TGT_PORT'}=~ tr/-/:/;
- if ($fwdfwsettings{'TGT_PORT'} eq "*") {
- $fwdfwsettings{'TGT_PORT'} = "1:65535";
- }
- if ($fwdfwsettings{'TGT_PORT'} =~ /^(\D)\:(\d+)$/) {
- $fwdfwsettings{'TGT_PORT'} = "1:$2";
- }
- if ($fwdfwsettings{'TGT_PORT'} =~ /^(\d+)\:(\D)$/) {
- $fwdfwsettings{'TGT_PORT'} = "$1:65535";
+ my @parts=split(",",$fwdfwsettings{'TGT_PORT'});
+ my @values=();
+ foreach (@parts){
+ chomp($_);
+ if ($_ =~ /^(\d+)\:(\d+)$/) {
+ my $check;
+ #change dashes with :
+ $_=~ tr/-/:/;
+ if ($_ eq "*") {
+ push(@values,"1:65535");
+ $check='on';
+ }
+ if ($_ =~ /^(\D)\:(\d+)$/) {
+ push(@values,"1:$2");
+ $check='on';
+ }
+ if ($_ =~ /^(\d+)\:(\D)$/) {
+ push(@values,"$1:65535");
+ $check='on'
+ }
+ $errormessage .= &General::validportrange($_, 'destination');
+ if(!$check){
+ push (@values,$_);
+ }
+ }else{
+ if (&General::validport($_)){
+ push (@values,$_);
+ }else{
+
+ }
+ }
}
- $errormessage .= &General::validportrange($fwdfwsettings{'TGT_PORT'}, 'destination');
+ $fwdfwsettings{'TGT_PORT'}=join("|",@values);
}
}elsif ($fwdfwsettings{'TGT_PROT'} eq 'GRE'){
+ $fwdfwsettings{$fwdfwsettings{'grp3'}} = '';
$fwdfwsettings{'TGT_PORT'} = '';
$fwdfwsettings{'ICMP_TGT'} = '';
- }elsif($fwdfwsettings{'TGT_PORT'} eq 'ESP'){
- $fwdfwsettings{'TGT_PORT'}='';
+ }elsif($fwdfwsettings{'TGT_PROT'} eq 'ESP'){
+ $fwdfwsettings{$fwdfwsettings{'grp3'}} = '';
+ $fwdfwsettings{'TGT_PORT'} = '';
+ $fwdfwsettings{'ICMP_TGT'}='';
+ }elsif($fwdfwsettings{'TGT_PROT'} eq 'AH'){
+ $fwdfwsettings{$fwdfwsettings{'grp3'}} = '';
+ $fwdfwsettings{'TGT_PORT'} = '';
$fwdfwsettings{'ICMP_TGT'}='';
}elsif ($fwdfwsettings{'TGT_PROT'} eq 'ICMP'){
+ $fwdfwsettings{$fwdfwsettings{'grp3'}} = '';
$fwdfwsettings{'TGT_PORT'} = '';
&General::readhasharray("${General::swroot}/fwhosts/icmp-types", \%icmptypes);
foreach my $key (keys %icmptypes){
$errormessage.=$Lang::tr{'fwdfw err remark'}."<br>";
}
#check if source and target identical
- if ($fwdfwsettings{$fwdfwsettings{'grp1'}} eq $fwdfwsettings{$fwdfwsettings{'grp2'}}){
+ if ($fwdfwsettings{$fwdfwsettings{'grp1'}} eq $fwdfwsettings{$fwdfwsettings{'grp2'}} && $fwdfwsettings{$fwdfwsettings{'grp1'}} ne 'ALL'){
$errormessage.=$Lang::tr{'fwdfw err same'};
return $errormessage;
}
#check source and destination protocol if manual
if( $fwdfwsettings{'USE_SRC_PORT'} eq 'ON' && $fwdfwsettings{'USESRV'} eq 'ON'){
+
+
if($fwdfwsettings{'PROT'} ne $fwdfwsettings{'TGT_PROT'} && $fwdfwsettings{'grp3'} eq 'TGT_PORT'){
$errormessage.=$Lang::tr{'fwdfw err prot'};
}
$fwdfwsettings{'oldgrp3a'}=$fwdfwsettings{'grp3'};
$fwdfwsettings{'oldgrp3b'}=$fwdfwsettings{$fwdfwsettings{'grp3'}};
$fwdfwsettings{'oldusesrv'}=$fwdfwsettings{'USESRV'};
+ $fwdfwsettings{'oldruleremark'}=$fwdfwsettings{'ruleremark'};
}else{
$fwdfwsettings{'ACTIVE'}='ON';
$checked{'ACTIVE'}{$fwdfwsettings{'ACTIVE'}} = 'CHECKED';
END
foreach ("ACCEPT","DROP","REJECT")
{
- if($fwdfwsettings{'POLICY'} eq 'MODE2'){
- $fwdfwsettings{'RULE_ACTION'} = 'DROP';
- }
-
- if ($_ eq $fwdfwsettings{'RULE_ACTION'})
- {
- print"<option selected>$_</option>";
+ if($fwdfwsettings{'updatefwrule'} eq 'on'){
+ print"<option ";
+ print "selected='selected'" if ($fwdfwsettings{'RULE_ACTION'} eq $_);
+ print">$_</option>";
}else{
- print"<option>$_</option>";
+ if($fwdfwsettings{'POLICY'} eq 'MODE2'){
+ $fwdfwsettings{'RULE_ACTION'} = 'DROP';
+ }
+
+ if ($_ eq $fwdfwsettings{'RULE_ACTION'})
+ {
+ print"<option selected>$_</option>";
+ }else{
+ print"<option>$_</option>";
+ }
}
}
print"</select></td></tr></table><hr>";
-
&Header::closebox();
&Header::openbox('100%', 'left', $Lang::tr{'fwdfw source'});
-
#------SOURCE-------------------------------------------------------
print<<END;
<table width='100%' border='0'>
<tr><td width='1%'><input type='checkbox' name='USE_SRC_PORT' value='ON' $checked{'USE_SRC_PORT'}{'ON'}></td><td width='51%' colspan='3'>$Lang::tr{'fwdfw use srcport'}</td>
<td width='15%' nowrap='nowrap'>$Lang::tr{'fwdfw man port'}</td><td><select name='PROT'>
END
- foreach ("TCP","UDP","GRE","ESP","ICMP")
+ foreach ("TCP","UDP","GRE","ESP","AH","ICMP")
{
if ($_ eq $fwdfwsettings{'PROT'})
{
print"<option>$_</option>";
}
}
+ $fwdfwsettings{'SRC_PORT'}=~ s/\|/,/g;
print<<END;
- </select></td><td align='right'><input type='text' name='SRC_PORT' value='$fwdfwsettings{'SRC_PORT'}' maxlength='11' size='9' ></td></tr>
+ </select></td><td align='right'><input type='text' name='SRC_PORT' value='$fwdfwsettings{'SRC_PORT'}' maxlength='20' size='18' ></td></tr>
<tr><td></td><td></td><td></td><td></td><td nowrap='nowrap'>$Lang::tr{'fwhost icmptype'}</td><td colspan='2'><select name='ICMP_TYPES'>
END
&General::readhasharray("${General::swroot}/fwhosts/icmp-types", \%icmptypes);
</select></td></tr>
<tr><td colspan='2'></td><td><input type='radio' name='grp3' value='TGT_PORT' $checked{'grp3'}{'TGT_PORT'}></td><td>$Lang::tr{'fwdfw man port'}</td><td><select name='TGT_PROT'>
END
- foreach ("TCP","UDP","GRE","ESP","ICMP")
+ foreach ("TCP","UDP","GRE","ESP","AH","ICMP")
{
if ($_ eq $fwdfwsettings{'TGT_PROT'})
{
print"<option>$_</option>";
}
}
+ $fwdfwsettings{'TGT_PORT'} =~ s/\|/,/g;
print<<END;
- </select></td><td align='right'><input type='text' name='TGT_PORT' value='$fwdfwsettings{'TGT_PORT'}' maxlength='11' size='9' ></td></tr>
+ </select></td><td align='right'><input type='text' name='TGT_PORT' value='$fwdfwsettings{'TGT_PORT'}' maxlength='20' size='18' ></td></tr>
<tr><td colspan='2'></td><td></td><td>$Lang::tr{'fwhost icmptype'}</td><td colspan='2'><select name='ICMP_TGT'>
END
&General::readhasharray("${General::swroot}/fwhosts/icmp-types", \%icmptypes);
<input type='checkbox' name='TIME_THU' value='on' $checked{'TIME_THU'}{'on'} />
<input type='checkbox' name='TIME_FRI' value='on' $checked{'TIME_FRI'}{'on'} />
<input type='checkbox' name='TIME_SAT' value='on' $checked{'TIME_SAT'}{'on'} />
- <input type='checkbox' name='TIME_SUN' value='on' $checked{'TIME_SUN'}{$Lang::tr{'fwdfw wd_sun'}} />
+ <input type='checkbox' name='TIME_SUN' value='on' $checked{'TIME_SUN'}{'on'} />
</td>
<td><select name='TIME_FROM'>
END
<input type='hidden' name='oldusesrv' value='$fwdfwsettings{'oldusesrv'}' />
<input type='hidden' name='oldrulenumber' value='$fwdfwsettings{'oldrulenumber'}' />
<input type='hidden' name='rulenumber' value='$fwdfwsettings{'rulepos'}' />
+ <input type='hidden' name='oldruleremark' value='$fwdfwsettings{'oldruleremark'}' />
<input type='hidden' name='ACTION' value='saverule' ></form><form method='post' style='display:inline'><input type='submit' value='$Lang::tr{'fwhost back'}' style='min-width:100px;'><input type='hidden' name='ACTION' value'reset'></td></td>
</table></form>
END
$$hash{$key}[27] = $fwdfwsettings{'TIME_TO'};
&General::writehasharray("$config", $hash);
}else{
- #ruleposition check
- if($fwdfwsettings{'oldrulenumber'} gt $fwdfwsettings{'rulepos'}){
- my %tmp=();
- my $val=$fwdfwsettings{'oldrulenumber'}-$fwdfwsettings{'rulepos'};
- for ($a=0;$a<$val;$a++){
- $fwdfwsettings{'oldrulenumber'}=$fwdfwsettings{'oldrulenumber'}-$a;
- foreach my $key (sort {$a <=> $b} keys %$hash){
- if ($key eq $fwdfwsettings{'oldrulenumber'}) {
- my $last = $key -1;
- if (exists $$hash{$last}){
- #save rule last
- foreach my $y (0 .. $#{$$hash{$last}}) {
- $tmp{0}[$y] = $$hash{$last}[$y];
- }
- #copy active rule to last
- foreach my $i (0 .. $#{$$hash{$last}}) {
- $$hash{$last}[$i] = $$hash{$key}[$i];
- }
- #copy saved rule to actual position
- foreach my $x (0 .. $#{$tmp{0}}) {
- $$hash{$key}[$x] = $tmp{0}[$x];
- }
+ foreach my $key (sort {$a <=> $b} keys %$hash){
+ if($key eq $fwdfwsettings{'key'}){
+ $$hash{$key}[0] = $fwdfwsettings{'RULE_ACTION'};
+ $$hash{$key}[1] = $fwdfwsettings{'chain'};
+ $$hash{$key}[2] = $fwdfwsettings{'ACTIVE'};
+ $$hash{$key}[3] = $fwdfwsettings{'grp1'};
+ $$hash{$key}[4] = $fwdfwsettings{$fwdfwsettings{'grp1'}};
+ $$hash{$key}[5] = $fwdfwsettings{'grp2'};
+ $$hash{$key}[6] = $fwdfwsettings{$fwdfwsettings{'grp2'}};
+ $$hash{$key}[7] = $fwdfwsettings{'USE_SRC_PORT'};
+ $$hash{$key}[8] = $fwdfwsettings{'PROT'};
+ $$hash{$key}[9] = $fwdfwsettings{'ICMP_TYPES'};
+ $$hash{$key}[10] = $fwdfwsettings{'SRC_PORT'};
+ $$hash{$key}[11] = $fwdfwsettings{'USESRV'};
+ $$hash{$key}[12] = $fwdfwsettings{'TGT_PROT'};
+ $$hash{$key}[13] = $fwdfwsettings{'ICMP_TGT'};
+ $$hash{$key}[14] = $fwdfwsettings{'grp3'};
+ $$hash{$key}[15] = $fwdfwsettings{$fwdfwsettings{'grp3'}};
+ $$hash{$key}[16] = $fwdfwsettings{'ruleremark'};
+ $$hash{$key}[17] = $fwdfwsettings{'LOG'};
+ $$hash{$key}[18] = $fwdfwsettings{'TIME'};
+ $$hash{$key}[19] = $fwdfwsettings{'TIME_MON'};
+ $$hash{$key}[20] = $fwdfwsettings{'TIME_TUE'};
+ $$hash{$key}[21] = $fwdfwsettings{'TIME_WED'};
+ $$hash{$key}[22] = $fwdfwsettings{'TIME_THU'};
+ $$hash{$key}[23] = $fwdfwsettings{'TIME_FRI'};
+ $$hash{$key}[24] = $fwdfwsettings{'TIME_SAT'};
+ $$hash{$key}[25] = $fwdfwsettings{'TIME_SUN'};
+ $$hash{$key}[26] = $fwdfwsettings{'TIME_FROM'};
+ $$hash{$key}[27] = $fwdfwsettings{'TIME_TO'};
+ last;
+ }
+ }
+ }
+ &General::writehasharray("$config", $hash);
+ if($fwdfwsettings{'oldrulenumber'} gt $fwdfwsettings{'rulepos'}){
+ my %tmp=();
+ my $val=$fwdfwsettings{'oldrulenumber'}-$fwdfwsettings{'rulepos'};
+ for (my $z=0;$z<$val;$z++){
+ foreach my $key (sort {$a <=> $b} keys %$hash){
+ if ($key eq $fwdfwsettings{'oldrulenumber'}) {
+ my $last = $key -1;
+ if (exists $$hash{$last}){
+ #save rule last
+ foreach my $y (0 .. $#{$$hash{$last}}) {
+ $tmp{0}[$y] = $$hash{$last}[$y];
+ }
+ #copy active rule to last
+ foreach my $i (0 .. $#{$$hash{$last}}) {
+ $$hash{$last}[$i] = $$hash{$key}[$i];
+ }
+ #copy saved rule to actual position
+ foreach my $x (0 .. $#{$tmp{0}}) {
+ $$hash{$key}[$x] = $tmp{0}[$x];
}
}
}
}
- &General::writehasharray("$config", $hash);
- &rules;
- }elsif($fwdfwsettings{'rulepos'} gt $fwdfwsettings{'oldrulenumber'}){
- my %tmp=();
- my $val=$fwdfwsettings{'rulepos'}-$fwdfwsettings{'oldrulenumber'};
- for ($a=0;$a<$val;$a++){
- $fwdfwsettings{'oldrulenumber'}=$fwdfwsettings{'oldrulenumber'}+$a;
+ $fwdfwsettings{'oldrulenumber'}--;
+ }
+ &General::writehasharray("$config", $hash);
+ &rules;
+ }elsif($fwdfwsettings{'rulepos'} gt $fwdfwsettings{'oldrulenumber'}){
+ my %tmp=();
+ my $val=$fwdfwsettings{'rulepos'}-$fwdfwsettings{'oldrulenumber'};
+ for (my $z=0;$z<$val;$z++){
foreach my $key (sort {$a <=> $b} keys %$hash){
- if ($key eq $fwdfwsettings{'oldrulenumber'}) {
- my $next = $key + 1;
- if (exists $$hash{$next}){
- #save rule next
- foreach my $y (0 .. $#{$$hash{$next}}) {
- $tmp{0}[$y] = $$hash{$next}[$y];
- }
- #copy active rule to next
- foreach my $i (0 .. $#{$$hash{$next}}) {
- $$hash{$next}[$i] = $$hash{$key}[$i];
- }
- #copy saved rule to actual position
- foreach my $x (0 .. $#{$tmp{0}}) {
- $$hash{$key}[$x] = $tmp{0}[$x];
- }
+ if ($key eq $fwdfwsettings{'oldrulenumber'}) {
+ my $next = $key + 1;
+ if (exists $$hash{$next}){
+ #save rule next
+ foreach my $y (0 .. $#{$$hash{$next}}) {
+ $tmp{0}[$y] = $$hash{$next}[$y];
+ }
+ #copy active rule to next
+ foreach my $i (0 .. $#{$$hash{$next}}) {
+ $$hash{$next}[$i] = $$hash{$key}[$i];
+ }
+ #copy saved rule to actual position
+ foreach my $x (0 .. $#{$tmp{0}}) {
+ $$hash{$key}[$x] = $tmp{0}[$x];
}
}
}
}
- &General::writehasharray("$config", $hash);
- &rules;
- }else{
- foreach my $key (sort {$a <=> $b} keys %$hash){
- if($key eq $fwdfwsettings{'key'}){
- $$hash{$key}[0] = $fwdfwsettings{'RULE_ACTION'};
- $$hash{$key}[1] = $fwdfwsettings{'chain'};
- $$hash{$key}[2] = $fwdfwsettings{'ACTIVE'};
- $$hash{$key}[3] = $fwdfwsettings{'grp1'};
- $$hash{$key}[4] = $fwdfwsettings{$fwdfwsettings{'grp1'}};
- $$hash{$key}[5] = $fwdfwsettings{'grp2'};
- $$hash{$key}[6] = $fwdfwsettings{$fwdfwsettings{'grp2'}};
- $$hash{$key}[7] = $fwdfwsettings{'USE_SRC_PORT'};
- $$hash{$key}[8] = $fwdfwsettings{'PROT'};
- $$hash{$key}[9] = $fwdfwsettings{'ICMP_TYPES'};
- $$hash{$key}[10] = $fwdfwsettings{'SRC_PORT'};
- $$hash{$key}[11] = $fwdfwsettings{'USESRV'};
- $$hash{$key}[12] = $fwdfwsettings{'TGT_PROT'};
- $$hash{$key}[13] = $fwdfwsettings{'ICMP_TGT'};
- $$hash{$key}[14] = $fwdfwsettings{'grp3'};
- $$hash{$key}[15] = $fwdfwsettings{$fwdfwsettings{'grp3'}};
- $$hash{$key}[16] = $fwdfwsettings{'ruleremark'};
- $$hash{$key}[17] = $fwdfwsettings{'LOG'};
- $$hash{$key}[18] = $fwdfwsettings{'TIME'};
- $$hash{$key}[19] = $fwdfwsettings{'TIME_MON'};
- $$hash{$key}[20] = $fwdfwsettings{'TIME_TUE'};
- $$hash{$key}[21] = $fwdfwsettings{'TIME_WED'};
- $$hash{$key}[22] = $fwdfwsettings{'TIME_THU'};
- $$hash{$key}[23] = $fwdfwsettings{'TIME_FRI'};
- $$hash{$key}[24] = $fwdfwsettings{'TIME_SAT'};
- $$hash{$key}[25] = $fwdfwsettings{'TIME_SUN'};
- $$hash{$key}[26] = $fwdfwsettings{'TIME_FROM'};
- $$hash{$key}[27] = $fwdfwsettings{'TIME_TO'};
- last;
- }
- }
+ $fwdfwsettings{'oldrulenumber'}++;
}
&General::writehasharray("$config", $hash);
+ &rules;
}
}
}
{
my %hash=%{(shift)};
my $key=shift;
- if($hash{$key}[7] eq 'ON' && $hash{$key}[8] ne 'ICMP'){
- print" : ($hash{$key}[8]) $hash{$key}[10]";
+ if($hash{$key}[7] eq 'ON' && $hash{$key}[8] ne '' && $hash{$key}[10]){
+ $hash{$key}[10]=~ s/\|/,/g;
+ print": $hash{$key}[10]";
}elsif($hash{$key}[7] eq 'ON' && $hash{$key}[8] eq 'ICMP'){
- print" : ($hash{$key}[8]) <br> $hash{$key}[9]";
+ print": <br>$hash{$key}[9] ";
}
}
sub gettgtport
my $key=shift;
my $service;
my $prot;
-
if($hash{$key}[11] eq 'ON' && $hash{$key}[12] ne 'ICMP'){
if($hash{$key}[14] eq 'cust_srv'){
&General::readhasharray("$configsrv", \%customservice);
foreach my $i (sort keys %customservice){
- #print "HHUHU: $customservice{$i}[0] und $hash{$key}[15]<br>";
if($customservice{$i}[0] eq $hash{$key}[15]){
- $prot = $hash{$key}[12];
$service = $customservice{$i}[0];
}
}
}elsif($hash{$key}[14] eq 'cust_srvgrp'){
-
$service=$hash{$key}[15];
}elsif($hash{$key}[14] eq 'TGT_PORT'){
+ $hash{$key}[15]=~ s/\|/,/g;
$service=$hash{$key}[15];
- $prot=$hash{$key}[12];
+ }
+ if($service){
+ print": $service";
}
}elsif($hash{$key}[11] eq 'ON' && $hash{$key}[12] eq 'ICMP'){
- print" : ($hash{$key}[12]) <br>$hash{$key}[13]";
+ print":<br>$hash{$key}[13]";
}
-
- if ($prot ne '' || $service ne ''){
- print" :";
- if ($prot ne ''){
- print"($prot) ";
+}
+sub get_serviceports
+{
+ my $type=shift;
+ my $name=shift;
+ &General::readhasharray("$configsrv", \%customservice);
+ &General::readhasharray("$configsrvgrp", \%customservicegrp);
+ my $protocols;
+ my $tcp;
+ my $udp;
+ if($type eq 'service'){
+ foreach my $key (sort { uc($customservice{$a}[0]) cmp uc($customservice{$b}[0]) } keys %customservice){
+ if ($customservice{$key}[0] eq $name){
+ $protocols=$customservice{$key}[2];
+ }
+ }
+
+ }elsif($type eq 'group'){
+ foreach my $key (sort { uc($customservicegrp{$a}[0]) cmp uc($customservicegrp{$b}[0]) } keys %customservicegrp){
+ if ($customservicegrp{$key}[0] eq $name){
+ if($customservicegrp{$key}[4] eq 'TCP'){$tcp='TCP';}else{$udp='UDP';}
+ }
}
- print" $service";
}
+ if($tcp){$protocols.="TCP";}
+ if($udp){$protocols.=",UDP";}
+ return $protocols;
}
sub viewtablerule
{
&General::readhasharray("$config", $hash);
print"<b>$title1</b><br>";
print"<table width='100%' border='0' cellspacing='1' style='padding-top: 0px; padding-left: 0px; padding-bottom: 0px ;padding-right: 0px ;'>";
- print"<tr><td align='center' width='1%'><b>#</td><td width='1%'></td><td align='center' width='20%'><b>$Lang::tr{'fwdfw source'}</td><td width='1%'><b>Log</td><td align='center' width='20%'><b>$Lang::tr{'fwdfw target'}</td><td align='center' width='70%'><b>$Lang::tr{'remark'}</td><td align='center' colspan='3' width='1%'><b>$Lang::tr{'fwdfw action'}</td></tr>";
+ print"<tr><td align='center' width='1%'><b>#</td><td width='1%'></td><td align='center' ><b>$Lang::tr{'fwdfw source'}</td><td width='1%'><b>Log</td><td align='center' width='20%'><b>$Lang::tr{'fwdfw target'}</td><td align='center'><b>$Lang::tr{'protocol'}</b></td><td align='center' width='70%'><b>$Lang::tr{'remark'}</td><td align='center' colspan='3' width='1%'><b>$Lang::tr{'fwdfw action'}</td></tr>";
foreach my $key (sort {$a <=> $b} keys %$hash){
@tmpsrc=();
#check if vpn hosts/nets have been deleted
$rulecolor=$color{'color16'};
}
print"<td bgcolor='$rulecolor' width='2%' align='center'><span title='$tooltip'><b>$ruletype</b></span></td>";
- print"<td align='center'>";
+ print"<td align='center' nowrap='nowrap'>";
if ($$hash{$key}[3] eq 'std_net_src'){
print &get_name($$hash{$key}[4]);
}else{
}
&gettgtport(\%$hash,$key);
################################################################################
- print"</td><td width='20%'>$$hash{$key}[16]</td>";
+ print"</td>";
+ #Get Protocol
+ my $prot;
+ if ($$hash{$key}[12]){ #target prot if manual
+ $prot=$$hash{$key}[12];
+ }elsif($$hash{$key}[8]){ #source prot if manual
+ $prot=$$hash{$key}[8];
+ }elsif($$hash{$key}[14] eq 'cust_srv'){
+ $prot=&get_serviceports("service",$$hash{$key}[15]);
+ }elsif($$hash{$key}[14] eq 'cust_srvgrp'){
+ $prot=&get_serviceports("group",$$hash{$key}[15]);
+ }else{
+ $prot=$Lang::tr{'all'};
+ }
+ print"<td align='center'>$prot</td>";
+
+ print"<td width='20%'>$$hash{$key}[16]</td>";
if($$hash{$key}[2] eq 'ON'){
$gif="/images/on.gif"
if($$hash{$key}[25] ne ''){push (@days,$Lang::tr{'fwdfw wd_sun'});}
my $weekdays=join(",",@days);
if (@days){
- print"<tr bgcolor='#FFE4B5'><td colspan='4'>$Lang::tr{'fwdfw time'} ";
+ print"<tr bgcolor='#FFE4B5'><td colspan='6'>$Lang::tr{'fwdfw time'} ";
print"$weekdays";
print "  $Lang::tr{'fwdfw from'} $$hash{$key}[26]   $Lang::tr{'fwdfw till'} $$hash{$key}[27]</td><td colspan='8'></d></tr>";
}
&Header::closebox();
}
}
+sub p2pblock
+{
+ my $gif;
+ open( FILE, "< $p2pfile" ) or die "Unable to read $p2pfile";
+ @p2ps = <FILE>;
+ close FILE;
+ &Header::openbox('100%', 'center', 'P2P-Block');
+ print <<END;
+ <table width='35%' border='0'>
+ <tr bgcolor='$color{'color22'}'><td align=center colspan='2' ><b>$Lang::tr{'protocol'}</b></td><td align='center'><b>$Lang::tr{'status'}</b></td></tr>
+END
+ foreach my $p2pentry (sort @p2ps)
+ {
+ my @p2pline = split( /\;/, $p2pentry );
+ if($p2pline[2] eq 'on'){
+ $gif="/images/on.gif"
+ }else{
+ $gif="/images/off.gif"
+ }
+ print <<END;
+ <form method='post' action='$ENV{'SCRIPT_NAME'}'>
+ <tr bgcolor='$color{'color20'}'>
+ <td align='center' colspan='2' >$p2pline[0]:</td><td align='center'><input type='hidden' name='P2PROT' value='$p2pline[1]' /><input type='image' img src='$gif' alt='$Lang::tr{'click to disable'}' title='$Lang::tr{'fwdfw toggle'}' style='padding-top: 0px; padding-left: 0px; padding-bottom: 0px ;padding-right: 0px ;display: block;' ><input type='hidden' name='ACTION' value='togglep2p'></td></tr></form>
+END
+ }
+ print"<tr><td><img src='/images/on.gif'></td><td align='left'>$Lang::tr{'outgoing firewall p2p allow'}</td></tr>";
+ print"<tr><td><img src='/images/off.gif'></td><td align='left'>$Lang::tr{'outgoing firewall p2p deny'}</td></tr></table>";
+ &Header::closebox();
+}
sub fillselect
{
my %hash=%{(shift)};