openvpnctl: Flush BLOCK and SNAT chain when needed.

[people/teissler/ipfire-2.x.git] / src / misc-progs / openvpnctrl.c

diff --git a/src/misc-progs/openvpnctrl.c b/src/misc-progs/openvpnctrl.c
index e366294b572ab796e54fc6deb196e920af27365d..95027577eeb47110bccd1cb9881af9f42f78d68a 100644 (file)
--- a/src/misc-progs/openvpnctrl.c
+++ b/src/misc-progs/openvpnctrl.c
@@ -27,6 +27,7 @@ char enableorange[STRING_SIZE] = "off";
 char OVPNRED[STRING_SIZE] = "OVPN";
 char OVPNBLUE[STRING_SIZE] = "OVPN_BLUE_";
 char OVPNORANGE[STRING_SIZE] = "OVPN_ORANGE_";
+char OVPNBLOCK[STRING_SIZE] = "OVPNBLOCK";
 char OVPNNAT[STRING_SIZE] = "OVPNNAT";
 char WRAPPERVERSION[STRING_SIZE] = "ipfire-2.2.3";
 
@@ -253,10 +254,6 @@ void setChainRules(char *chain, char *interface, char *protocol, char *port)
 
        sprintf(str, "/sbin/iptables -A %sINPUT -i %s -p %s --dport %s -j ACCEPT", chain, interface, protocol, port);
        executeCommand(str);
-       sprintf(str, "/sbin/iptables -A %sINPUT -i tun+ -j ACCEPT", chain);
-       executeCommand(str);
-       sprintf(str, "/sbin/iptables -A %sFORWARD -i tun+ -j ACCEPT", chain);
-       executeCommand(str);
 }
 
 void flushChain(char *chain) {
@@ -264,9 +261,6 @@ void flushChain(char *chain) {
 
        sprintf(str, "/sbin/iptables -F %sINPUT", chain);
        executeCommand(str);
-       sprintf(str, "/sbin/iptables -F %sFORWARD", chain);
-       executeCommand(str);
-       safe_system(str);
 }
 
 void flushChainNAT(char *chain) {
@@ -281,10 +275,6 @@ void deleteChainReference(char *chain) {
 
        sprintf(str, "/sbin/iptables -D INPUT -j %sINPUT", chain);
        executeCommand(str);
-       safe_system(str);
-       sprintf(str, "/sbin/iptables -D FORWARD -j %sFORWARD", chain);
-       executeCommand(str);
-       safe_system(str);
 }
 
 void deleteChain(char *chain) {
@@ -292,8 +282,6 @@ void deleteChain(char *chain) {
 
        sprintf(str, "/sbin/iptables -X %sINPUT", chain);
        executeCommand(str);
-       sprintf(str, "/sbin/iptables -X %sFORWARD", chain);
-       executeCommand(str);
 }
 
 void deleteAllChains(void) {
@@ -307,22 +295,22 @@ void deleteAllChains(void) {
        deleteChain(OVPNRED);
        deleteChain(OVPNBLUE);
        deleteChain(OVPNORANGE);
+
+       // Only flush chains that are created by the firewall
+       flushChain(OVPNBLOCK);
+       flushChainNAT(OVPNNAT);
 }
 
 void createChainReference(char *chain) {
        char str[STRING_SIZE];
        sprintf(str, "/sbin/iptables -I INPUT %s -j %sINPUT", "14", chain);
        executeCommand(str);
-       sprintf(str, "/sbin/iptables -I FORWARD %s -j %sFORWARD", "12", chain);
-       executeCommand(str);
 }
 
 void createChain(char *chain) {
        char str[STRING_SIZE];
        sprintf(str, "/sbin/iptables -N %sINPUT", chain);
        executeCommand(str);
-       sprintf(str, "/sbin/iptables -N %sFORWARD", chain);
-       executeCommand(str);
 }
 
 void createAllChains(void) {
@@ -362,6 +350,10 @@ char* calcTransferNetAddress(const connection* conn) {
        char *subnetmask = strdup(conn->transfer_subnet);
        char *address = strsep(&subnetmask, "/");
 
+       if ((address == NULL) || (subnetmask == NULL)) {
+               goto ERROR;
+       }
+
        in_addr_t _address    = inet_addr(address);
        in_addr_t _subnetmask = inet_addr(subnetmask);
        _address &= _subnetmask;
@@ -470,6 +462,7 @@ void setFirewallRules(void) {
        flushChain(OVPNRED);
        flushChain(OVPNBLUE);
        flushChain(OVPNORANGE);
+       flushChain(OVPNBLOCK);
        flushChainNAT(OVPNNAT);
 
        // set firewall rules
@@ -493,15 +486,19 @@ void setFirewallRules(void) {
                                OVPNRED, redif, conn->proto, conn->port);
                        executeCommand(command);
 
+                       /* Block all communication from the transfer nets. */
+                       snprintf(command, STRING_SIZE, "/sbin/iptables -A %s -s %s -j DROP",
+                               OVPNBLOCK, conn->transfer_subnet);
+                       executeCommand(command);
+
                        local_subnet_address = getLocalSubnetAddress(conn);
                        transfer_subnet_address = calcTransferNetAddress(conn);
 
-                       if ((!local_subnet_address) || (!transfer_subnet_address))
-                               continue;
-
-                       snprintf(command, STRING_SIZE, "/sbin/iptables -t nat -A %s -s %s -j SNAT --to-source %s",
-                               OVPNNAT, transfer_subnet_address, local_subnet_address);
-                       executeCommand(command);
+                       if ((local_subnet_address) && (transfer_subnet_address)) {
+                               snprintf(command, STRING_SIZE, "/sbin/iptables -t nat -A %s -s %s -j SNAT --to-source %s",
+                                       OVPNNAT, transfer_subnet_address, local_subnet_address);
+                               executeCommand(command);
+                       }
                }
 
                conn = conn->next;