]> git.ipfire.org Git - people/teissler/ipfire-2.x.git/blobdiff - html/cgi-bin/forwardfw.cgi
projects / people / teissler / ipfire-2.x.git / blobdiff
? search:
summary | shortlog | log | commit | commitdiff | tree
raw | inline | side by side
Forward Firewall: savepoint 1. Trying to add OUTGOING to the firewall.
[people/teissler/ipfire-2.x.git] / html / cgi-bin / forwardfw.cgi
diff --git a/html/cgi-bin/forwardfw.cgi b/html/cgi-bin/forwardfw.cgi
index 1ecdd6264136c5f7d387d17732b9b8824b89bdb4..fc1d2b55c0b3d47d883e8273b5c7a4798e9acc38 100755 (executable)
--- a/html/cgi-bin/forwardfw.cgi
+++ b/html/cgi-bin/forwardfw.cgi
@@ -27,7 +27,7 @@
 # Now that the ccd extension is ready i am able to develop the main request.  #
 # Any feedback is appreciated.                                                                                           #
 #                                                                                                                                                        #
-#                                                                                                                                                        #
+#Copymaster                                                                                                                                      #
 ###############################################################################
 
 use strict;
@@ -45,6 +45,7 @@ unless (-d "${General::swroot}/forward")                      { system("mkdir ${General::swroot}/f
 unless (-e "${General::swroot}/forward/settings")   { system("touch ${General::swroot}/forward/settings"); }
 unless (-e "${General::swroot}/forward/config")        { system("touch ${General::swroot}/forward/config"); }
 unless (-e "${General::swroot}/forward/input")         { system("touch ${General::swroot}/forward/input"); }
+unless (-e "${General::swroot}/forward/outgoing")      { system("touch ${General::swroot}/forward/outgoing"); }
 
 my %fwdfwsettings=();
 my %selected=() ;
@@ -60,6 +61,7 @@ my %customnetwork=();
 my %ccdhost=();
 my %configfwdfw=();
 my %configinputfw=();
+my %configoutgoingfw=();
 my %ipsecconf=();
 my %color=();
 my %mainsettings=();
@@ -69,6 +71,7 @@ my %ovpnsettings=();
 my %ipsecsettings=();
 my %aliases=();
 my @p2ps = ();
+
 my $color;
 my $confignet          = "${General::swroot}/fwhosts/customnetworks";
 my $confighost         = "${General::swroot}/fwhosts/customhosts";
@@ -81,6 +84,7 @@ my $configipsec               = "${General::swroot}/vpn/config";
 my $configipsecrw      = "${General::swroot}/vpn/settings";
 my $configfwdfw                = "${General::swroot}/forward/config";
 my $configinput                = "${General::swroot}/forward/input";
+my $configoutgoing     = "${General::swroot}/forward/outgoing";
 my $configovpn         = "${General::swroot}/ovpn/settings";
 my $p2pfile                    = "${General::swroot}/forward/p2protocols";
 my $errormessage='';
@@ -110,29 +114,42 @@ if ($fwdfwsettings{'ACTION'} eq 'saverule')
 {
        &General::readhasharray("$configfwdfw", \%configfwdfw);
        &General::readhasharray("$configinput", \%configinputfw);
+       &General::readhasharray("$configinput", \%configoutgoingfw);
        $errormessage=&checksource;
        if(!$errormessage){&checktarget;}
        if(!$errormessage){&checkrule;}
+
        #check if we change an forward rule to an external access
        if(     $fwdfwsettings{'grp2'} eq 'ipfire' && $fwdfwsettings{'oldgrp2a'} ne 'ipfire' && $fwdfwsettings{'updatefwrule'} eq 'on'){
-               $fwdfwsettings{'updatefwrule'}='';
-               $fwdfwsettings{'config'}=$configfwdfw;
-               $fwdfwsettings{'nobase'}='on';
-               &deleterule;
-               &checkcounter(0,0,$fwdfwsettings{'grp1'},$fwdfwsettings{$fwdfwsettings{'grp1'}});
-               &checkcounter(0,0,$fwdfwsettings{'grp3'},$fwdfwsettings{$fwdfwsettings{'grp3'}});
+               &changerule($configfwdfw);
+       }
+       #check if we change an forward rule to an outgoing
+       if(     $fwdfwsettings{$fwdfwsettings{'grp1'}} eq 'IPFire' && $fwdfwsettings{'oldgrp1b'} ne 'IPFire' && $fwdfwsettings{'updatefwrule'} eq 'on'){
+               &changerule($configfwdfw);
        }
-       #check if we change an external access rule to an forward
+       #check if we change an external access rule to a forward
        if(     $fwdfwsettings{'grp2'} ne 'ipfire' && $fwdfwsettings{'oldgrp2a'} eq 'ipfire' && $fwdfwsettings{'updatefwrule'} eq 'on'){
-               $fwdfwsettings{'updatefwrule'}='';
-               $fwdfwsettings{'config'}=$configinput;
-               $fwdfwsettings{'nobase'}='on';
-               &deleterule;
-               &checkcounter(0,0,$fwdfwsettings{'grp1'},$fwdfwsettings{$fwdfwsettings{'grp1'}});
-               &checkcounter(0,0,$fwdfwsettings{'grp3'},$fwdfwsettings{$fwdfwsettings{'grp3'}});
-       }       
+               &changerule($configinput);
+       }
+       #check if we change an external access rule to a outgoing
+       if(     $fwdfwsettings{$fwdfwsettings{'grp1'}} eq 'IPFire' &&  $fwdfwsettings{'grp2'} ne 'ipfire' && $fwdfwsettings{'oldgrp2a'} eq 'ipfire' && $fwdfwsettings{'updatefwrule'} eq 'on'){
+               &changerule($configinput);
+       }
+       #check if we change an outgoing rule to a forward
+       if(     $fwdfwsettings{$fwdfwsettings{'grp1'}} ne 'IPFire' && $fwdfwsettings{'oldgrp1b'} eq 'IPFire' && $fwdfwsettings{'grp2'} ne 'ipfire' &&$fwdfwsettings{'updatefwrule'} eq 'on'){
+               &changerule($configoutgoing);
+       }
+       #check if we change an outgoing rule to a external access
+       if(     $fwdfwsettings{$fwdfwsettings{'grp1'}} ne 'IPFire' && $fwdfwsettings{'oldgrp1b'} eq 'IPFire' && $fwdfwsettings{'grp2'} eq 'ipfire' &&  $fwdfwsettings{'updatefwrule'} eq 'on'){
+               &changerule($configoutgoing);
+       }
+       #check if we try to break rules
+       if(     $fwdfwsettings{$fwdfwsettings{'grp1'}} eq 'IPFire' && $fwdfwsettings{'grp2'} eq 'ipfire'){
+               $errormessage.=$Lang::tr{'fwdfw err same'};
+       }
        #INPUT part
        if($fwdfwsettings{'grp2'} eq 'ipfire'){
+               $fwdfwsettings{'config'}=$configinput;
                $fwdfwsettings{'chain'} = 'INPUTFW';
                my $maxkey=&General::findhasharraykey(\%configinputfw);
                #check if we have an identical rule already
@@ -204,8 +221,62 @@ if ($fwdfwsettings{'ACTION'} eq 'saverule')
                #print"ALT: $fwdfwsettings{'oldgrp2a'} $fwdfwsettings{'oldgrp2b'}       NEU:    $fwdfwsettings{'grp2'} $fwdfwsettings{$fwdfwsettings{'grp2'}}<br>";
                #print"ALT: $fwdfwsettings{'oldgrp3a'} $fwdfwsettings{'oldgrp3b'}       NEU:    $fwdfwsettings{'grp3'} $fwdfwsettings{$fwdfwsettings{'grp3'}}<br>";
                #print"DIENSTE Checkalt:$fwdfwsettings{'oldusesrv'}  DIENSTE Checkneu:$fwdfwsettings{'USESRV'}    DIENST ALT:$fwdfwsettings{'oldgrp3a'},$fwdfwsettings{'oldgrp3b'}   DIENST NEU:$fwdfwsettings{'grp3'},$fwdfwsettings{$fwdfwsettings{'grp3'}}<br>";
+       }elsif($fwdfwsettings{$fwdfwsettings{'grp1'}} eq 'IPFire'){
+               $fwdfwsettings{'config'}=$configoutgoing;
+               $fwdfwsettings{'chain'} = 'OUTGOINGFW';
+               my $maxkey=&General::findhasharraykey(\%configoutgoingfw);
+               if($fwdfwsettings{'oldrulenumber'} eq $fwdfwsettings{'rulepos'}){
+                       foreach my $key (sort keys %configoutgoingfw){
+                               if ("$fwdfwsettings{'RULE_ACTION'},$fwdfwsettings{'ACTIVE'},$fwdfwsettings{'grp1'},$fwdfwsettings{$fwdfwsettings{'grp1'}},$fwdfwsettings{'grp2'},$fwdfwsettings{$fwdfwsettings{'grp2'}},$fwdfwsettings{'USE_SRC_PORT'},$fwdfwsettings{'PROT'},$fwdfwsettings{'ICMP_TYPES'},$fwdfwsettings{'SRC_PORT'},$fwdfwsettings{'USESRV'},$fwdfwsettings{'TGT_PROT'},$fwdfwsettings{'ICMP_TGT'},$fwdfwsettings{'grp3'},$fwdfwsettings{$fwdfwsettings{'grp3'}},$fwdfwsettings{'LOG'},$fwdfwsettings{'TIME'},$fwdfwsettings{'TIME_MON'},$fwdfwsettings{'TIME_TUE'},$fwdfwsettings{'TIME_WED'},$fwdfwsettings{'TIME_THU'},$fwdfwsettings{'TIME_FRI'},$fwdfwsettings{'TIME_SAT'},$fwdfwsettings{'TIME_SUN'},$fwdfwsettings{'TIME_FROM'},$fwdfwsettings{'TIME_TO'}"
+                                       eq "$configoutgoingfw{$key}[0],$configoutgoingfw{$key}[2],$configoutgoingfw{$key}[3],$configoutgoingfw{$key}[4],$configoutgoingfw{$key}[5],$configoutgoingfw{$key}[6],$configoutgoingfw{$key}[7],$configoutgoingfw{$key}[8],$configoutgoingfw{$key}[9],$configoutgoingfw{$key}[10],$configoutgoingfw{$key}[11],$configoutgoingfw{$key}[12],$configoutgoingfw{$key}[13],$configoutgoingfw{$key}[14],$configoutgoingfw{$key}[15],$configoutgoingfw{$key}[17],$configoutgoingfw{$key}[18],$configoutgoingfw{$key}[19],$configoutgoingfw{$key}[20],$configoutgoingfw{$key}[21],$configoutgoingfw{$key}[22],$configoutgoingfw{$key}[23],$configoutgoingfw{$key}[24],$configoutgoingfw{$key}[25],$configoutgoingfw{$key}[26],$configoutgoingfw{$key}[27]"){
+                                               $errormessage.=$Lang::tr{'fwdfw err ruleexists'};
+                                               if ($fwdfwsettings{'oldruleremark'} ne $fwdfwsettings{'ruleremark'} && $fwdfwsettings{'updatefwrule'} eq 'on' && &validremark($fwdfwsettings{'ruleremark'})){
+                                                       $errormessage='';
+                                               }elsif($fwdfwsettings{'oldruleremark'} ne $fwdfwsettings{'ruleremark'} && $fwdfwsettings{'updatefwrule'} eq 'on' && !&validremark($fwdfwsettings{'ruleremark'})){
+                                                       $errormessage=$Lang::tr{'fwdfw err remark'}."<br>";
+                                               }
+                                               if ($fwdfwsettings{'oldruleremark'} eq $fwdfwsettings{'ruleremark'}){
+                                                       $fwdfwsettings{'nosave'} = 'on';
+                                               }
+                               }
+                       }
+               }
+               #check Rulepos on new Rule
+               if($fwdfwsettings{'rulepos'} > 0 && !$fwdfwsettings{'oldrulenumber'}){
+                       $fwdfwsettings{'oldrulenumber'}=$maxkey;
+                       foreach my $key (sort keys %configoutgoingfw){
+                               if ("$fwdfwsettings{'RULE_ACTION'},$fwdfwsettings{'ACTIVE'},$fwdfwsettings{'grp1'},$fwdfwsettings{$fwdfwsettings{'grp1'}},$fwdfwsettings{'grp2'},$fwdfwsettings{$fwdfwsettings{'grp2'}},$fwdfwsettings{'USE_SRC_PORT'},$fwdfwsettings{'PROT'},$fwdfwsettings{'ICMP_TYPES'},$fwdfwsettings{'SRC_PORT'},$fwdfwsettings{'USESRV'},$fwdfwsettings{'TGT_PROT'},$fwdfwsettings{'ICMP_TGT'},$fwdfwsettings{'grp3'},$fwdfwsettings{$fwdfwsettings{'grp3'}},$fwdfwsettings{'LOG'},$fwdfwsettings{'TIME'},$fwdfwsettings{'TIME_MON'},$fwdfwsettings{'TIME_TUE'},$fwdfwsettings{'TIME_WED'},$fwdfwsettings{'TIME_THU'},$fwdfwsettings{'TIME_FRI'},$fwdfwsettings{'TIME_SAT'},$fwdfwsettings{'TIME_SUN'},$fwdfwsettings{'TIME_FROM'},$fwdfwsettings{'TIME_TO'}"
+                                       eq "$configoutgoingfw{$key}[0],$configoutgoingfw{$key}[2],$configoutgoingfw{$key}[3],$configoutgoingfw{$key}[4],$configoutgoingfw{$key}[5],$configoutgoingfw{$key}[6],$configoutgoingfw{$key}[7],$configoutgoingfw{$key}[8],$configoutgoingfw{$key}[9],$configoutgoingfw{$key}[10],$configoutgoingfw{$key}[11],$configoutgoingfw{$key}[12],$configoutgoingfw{$key}[13],$configoutgoingfw{$key}[14],$configoutgoingfw{$key}[15],$configoutgoingfw{$key}[17],$configoutgoingfw{$key}[18],$configoutgoingfw{$key}[19],$configoutgoingfw{$key}[20],$configoutgoingfw{$key}[21],$configoutgoingfw{$key}[22],$configoutgoingfw{$key}[23],$configoutgoingfw{$key}[24],$configoutgoingfw{$key}[25],$configoutgoingfw{$key}[26],$configoutgoingfw{$key}[27]"){
+                                               $errormessage.=$Lang::tr{'fwdfw err ruleexists'};
+                               }
+                       }
+               }
+               #check if we just close a rule
+               if( $fwdfwsettings{'oldgrp1a'} eq  $fwdfwsettings{'grp1'} && $fwdfwsettings{'oldgrp1b'} eq $fwdfwsettings{$fwdfwsettings{'grp1'}} && $fwdfwsettings{'oldgrp2a'} eq  $fwdfwsettings{'grp2'} && $fwdfwsettings{'oldgrp2b'} eq $fwdfwsettings{$fwdfwsettings{'grp2'}} &&  $fwdfwsettings{'oldgrp3a'} eq $fwdfwsettings{'grp3'} && $fwdfwsettings{'oldgrp3b'} eq  $fwdfwsettings{$fwdfwsettings{'grp3'}} && $fwdfwsettings{'oldusesrv'} eq $fwdfwsettings{'USESRV'} && $fwdfwsettings{'oldruleremark'} eq $fwdfwsettings{'ruleremark'} ) {
+                       if($fwdfwsettings{'nosave'} eq 'on' && $fwdfwsettings{'updatefwrule'} eq 'on'){
+                               $fwdfwsettings{'nosave2'} = 'on';
+                               $errormessage='';
+                       }
+               }
+               #increase counters
+               &checkcounter($fwdfwsettings{'oldgrp1a'},$fwdfwsettings{'oldgrp1b'},$fwdfwsettings{'grp1'},$fwdfwsettings{$fwdfwsettings{'grp1'}});
+               &checkcounter($fwdfwsettings{'oldgrp2a'},$fwdfwsettings{'oldgrp2b'},$fwdfwsettings{'grp2'},$fwdfwsettings{$fwdfwsettings{'grp2'}});
+               if($fwdfwsettings{'oldusesrv'} eq '' &&  $fwdfwsettings{'USESRV'} eq 'ON'){
+                       &checkcounter(0,0,$fwdfwsettings{'grp3'},$fwdfwsettings{$fwdfwsettings{'grp3'}});
+               }elsif ($fwdfwsettings{'USESRV'} eq '' && $fwdfwsettings{'oldusesrv'} eq 'ON') {
+                       &checkcounter($fwdfwsettings{'oldgrp3a'},$fwdfwsettings{'oldgrp3b'},0,0);
+               }elsif ($fwdfwsettings{'oldusesrv'} eq $fwdfwsettings{'USESRV'} && $fwdfwsettings{'oldgrp3b'} ne $fwdfwsettings{$fwdfwsettings{'grp3'}} && $fwdfwsettings{'updatefwrule'} eq 'on'){
+                       &checkcounter($fwdfwsettings{'oldgrp3a'},$fwdfwsettings{'oldgrp3b'},$fwdfwsettings{'grp3'},$fwdfwsettings{$fwdfwsettings{'grp3'}});
+               }
+               if ($fwdfwsettings{'nobase'} eq 'on'){
+                       &checkcounter(0,0,$fwdfwsettings{'grp3'},$fwdfwsettings{$fwdfwsettings{'grp3'}});
+               }
+               if ($fwdfwsettings{'nosave2'} ne 'on'){
+                       &saverule(\%configoutgoingfw,$configoutgoing);
+               }
        }else{
                #FORWARD PART
+               $fwdfwsettings{'config'}=$configfwdfw;
                $fwdfwsettings{'chain'} = 'FORWARDFW';
                my $maxkey=&General::findhasharraykey(\%configfwdfw);
                if($fwdfwsettings{'oldrulenumber'} eq $fwdfwsettings{'rulepos'}){
@@ -403,6 +474,18 @@ if ($fwdfwsettings{'ACTION'} eq '')
        &base;
 }
 ###  Functions  ####
+sub changerule
+{
+       my $oldchain=shift;
+       $fwdfwsettings{'updatefwrule'}='';
+       $fwdfwsettings{'config'}=$oldchain;
+       $fwdfwsettings{'nobase'}='on';
+       &deleterule;
+       &checkcounter(0,0,$fwdfwsettings{'grp1'},$fwdfwsettings{$fwdfwsettings{'grp1'}});
+       &checkcounter(0,0,$fwdfwsettings{'grp3'},$fwdfwsettings{$fwdfwsettings{'grp3'}});
+}
+
+
 sub pos_up
 {
        my %uphash=();
@@ -531,7 +614,7 @@ print <<END;
                <tr><td colspan='3'>$Lang::tr{'fwdfw pol text'}</td></tr>
                
                <tr><td colspan='3'><hr /></td></tr>
-               <tr><td width='10%' align='left'>       <select name='POLICY' style="width: 85px">
+               <tr><td width='15%' align='left'>       <select name='POLICY' style="width: 100px">
                <option value='MODE1' $selected{'POLICY'}{'MODE1'}>$Lang::tr{'fwdfw pol block'}</option>
                <option value='MODE2' $selected{'POLICY'}{'MODE2'}>$Lang::tr{'fwdfw pol allow'}</option></select>
            <td width='45%' align='left'><input type='submit' name='ACTION' value=$Lang::tr{'save'} />
@@ -550,7 +633,7 @@ sub addrule
        print "<table border='0'>";
        print "<tr><td><input type='submit' name='ACTION' value='$Lang::tr{'fwdfw newrule'}'></td>";
        if (-f "${General::swroot}/forward/reread"){
-               print "<td><input type='submit' name='ACTION' value='$Lang::tr{'fwdfw reread'}'></td>";
+               print "<td><input type='submit' name='ACTION' value='$Lang::tr{'fwdfw reread'}' style='font-face: Comic Sans MS; color: red; font-weight: bold;'>$Lang::tr{'fwhost reread'}</td>";
        }
                print"</tr></table></form><hr>";        
 
@@ -733,12 +816,12 @@ sub checktarget
                $ip=&General::ip2dec($ip);
                $ip=&General::dec2ip($ip);
 
-               #check if net or broadcast
-               my @tmp= split (/\./,$ip);
-               if ($tmp[3] eq "0" || ($tmp[3] eq "255"))
-               {
-                       $errormessage=$Lang::tr{'fwhost err hostip'}."<br>";
-               }
+               ##check if net or broadcast
+               #my @tmp= split (/\./,$ip);
+               #if ($tmp[3] eq "0" || ($tmp[3] eq "255"))
+               #{
+                       #$errormessage=$Lang::tr{'fwhost err hostip'}."<br>";
+               #}
                $fwdfwsettings{'tgt_addr'}="$ip/$subnet";
                                
                if(!&General::validipandmask($fwdfwsettings{'tgt_addr'})){
@@ -1231,6 +1314,7 @@ END
 END
                foreach my $network (sort keys %defaultNetworks)
                {
+                       next if($defaultNetworks{$network}{'NAME'} eq "IPFire");
                        print "<option value='$defaultNetworks{$network}{'NAME'}'";
                        print " selected='selected'" if ($fwdfwsettings{$fwdfwsettings{'grp2'}} eq $defaultNetworks{$network}{'NAME'});
                        print ">$network</option>";
@@ -1544,7 +1628,7 @@ sub saverule
                        }
                }
                &General::writehasharray("$config", $hash);
-               if($fwdfwsettings{'oldrulenumber'} gt $fwdfwsettings{'rulepos'}){
+               if($fwdfwsettings{'oldrulenumber'} > $fwdfwsettings{'rulepos'}){
                        my %tmp=();
                        my $val=$fwdfwsettings{'oldrulenumber'}-$fwdfwsettings{'rulepos'};
                        for (my $z=0;$z<$val;$z++){
@@ -1571,7 +1655,7 @@ sub saverule
                        }
                        &General::writehasharray("$config", $hash);
                        &rules;
-               }elsif($fwdfwsettings{'rulepos'} gt $fwdfwsettings{'oldrulenumber'}){
+               }elsif($fwdfwsettings{'rulepos'} > $fwdfwsettings{'oldrulenumber'}){
                        my %tmp=();
                        my $val=$fwdfwsettings{'rulepos'}-$fwdfwsettings{'oldrulenumber'};
                                for (my $z=0;$z<$val;$z++){
@@ -1640,7 +1724,7 @@ sub validremark
        if (length ($remark) < 1 || length ($remark) > 255) {
                return 0;}
        # Only valid characters are a-z, A-Z, 0-9 and -
-       if ($remark !~ /^[a-zäöüA-ZÖÄÜ0-9-.:_\/\s]*$/) {
+       if ($remark !~ /^[a-zäöüA-ZÖÄÜ0-9-.:;_\/\s]*$/) {
                return 0;}
        # First character can only be a letter or a digit
        if (substr ($remark, 0, 1) !~ /^[a-zäöüA-ZÖÄÜ0-9]*$/) {
@@ -1703,16 +1787,20 @@ sub get_serviceports
                                $protocols=$customservice{$key}[2];
                        }
                }
-               
        }elsif($type eq 'group'){
                foreach my $key (sort { uc($customservicegrp{$a}[0]) cmp uc($customservicegrp{$b}[0]) } keys %customservicegrp){
                        if ($customservicegrp{$key}[0] eq $name){
-                               if($customservicegrp{$key}[4] eq 'TCP'){$tcp='TCP';}else{$udp='UDP';}
+                               foreach my $key1 (sort { uc($customservice{$a}[0]) cmp uc($customservice{$b}[0]) } keys %customservice){
+                                       if ($customservice{$key1}[0] eq $customservicegrp{$key}[2]){
+                                               if($customservice{$key1}[2] eq 'TCP'){$tcp='TCP';}else{$udp='UDP';}
+                                       }
+                               }
                        }
                }
        }
-       if($tcp){$protocols.="TCP";}
-       if($udp){$protocols.=",UDP";}
+       if($tcp && $udp){$protocols="TCP,UDP";
+       }elsif($tcp){$protocols.="TCP";
+       }elsif($udp){$protocols.="UDP";}
        return $protocols;
 }
 sub viewtablerule
@@ -1722,6 +1810,7 @@ sub viewtablerule
        &viewtablenew(\%configfwdfw,$configfwdfw,'',"DMZ" );
        &viewtablenew(\%configfwdfw,$configfwdfw,'',"WLAN" );
        &viewtablenew(\%configinputfw,$configinput,"",$Lang::tr{'external access'} );
+       &viewtablenew(\%configoutgoingfw,$configoutgoing,"","Outgoing" );
 }
 sub viewtablenew
 {
Timo's tree of IPFire 2.x