X-Git-Url: http://git.ipfire.org/?p=people%2Fteissler%2Fipfire-2.x.git;a=blobdiff_plain;f=config%2Fforwardfw%2Frules.pl;h=b3be47da03506e0bfbcfd673408bff389a113808;hp=07f3abd1eaa6d02ebc915f97c3f61b198de1cfaa;hb=f0befbc3782b2a68fa96bb2e6534f0f6fa6af7f3;hpb=93c2de1c663566438a15cfeae0c03028201b8690 diff --git a/config/forwardfw/rules.pl b/config/forwardfw/rules.pl index 07f3abd1e..b3be47da0 100755 --- a/config/forwardfw/rules.pl +++ b/config/forwardfw/rules.pl @@ -2,7 +2,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2012 # +# Copyright (C) 2013 Alexander Marx # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -18,11 +18,6 @@ # along with this program. If not, see . # # # ############################################################################### -# # -# Hi folks! I hope this code is useful for all. I needed something to handle # -# my VPN Connections in a comfortable way. # -# This script builds firewallrules from the webinterface # -############################################################################### use strict; use Time::Local; @@ -58,16 +53,17 @@ my $configoutgoing = "${General::swroot}/forward/outgoing"; my $p2pfile = "${General::swroot}/forward/p2protocols"; my $configgrp = "${General::swroot}/fwhosts/customgroups"; my $netsettings = "${General::swroot}/ethernet/settings"; -my $errormessage=''; -my $orange; -my $green; -my $blue; +my $errormessage = ''; +my $orange = ''; +my $green = ''; +my $blue = ''; my ($TYPE,$PROT,$SPROT,$DPROT,$SPORT,$DPORT,$TIME,$TIMEFROM,$TIMETILL,$SRC_TGT); -my $CHAIN="FORWARDFW"; -my $conexists='off'; -my $command = 'iptables -A'; -my $dnat=''; -my $snat=''; +my $CHAIN = "FORWARDFW"; +my $conexists = 'off'; +my $command = 'iptables -A'; +my $dnat =''; +my $snat =''; + &General::readhash("${General::swroot}/forward/settings", \%fwdfwsettings); &General::readhash("$netsettings", \%defaultNetworks); &General::readhasharray($configfwdfw, \%configfwdfw); @@ -86,13 +82,13 @@ if (-f "/var/ipfire/red/active"){ open (CONN1,"/var/ipfire/red/local-ipaddress"); my $redip = ; close(CONN1); -################################ -# DEBUG/TEST # -################################ -my $MODE=1; # 0 - normal operation - # 1 - print configline and rules to console - # -################################ +################# +# DEBUG/TEST # +################# +my $MODE=0; # 0 - normal operation + # 1 - print configline and rules to console + # +################# my $param=shift; if($param eq 'flush'){ @@ -112,7 +108,7 @@ if($param eq 'flush'){ if($MODE eq '0'){ if ($fwdfwsettings{'POLICY'} eq 'MODE1'){ &p2pblock; - system ("/usr/sbin/firewall-policy"); + system ("/usr/sbin/firewall-policy"); }elsif($fwdfwsettings{'POLICY'} eq 'MODE2'){ &p2pblock; system ("iptables -A $CHAIN -m conntrack --ctstate NEW -j ACCEPT"); @@ -128,7 +124,7 @@ sub flush system ("iptables -F OUTGOINGFW"); system ("iptables -t nat -F NAT_DESTINATION"); system ("iptables -t nat -F NAT_SOURCE"); -} +} sub preparerules { if (! -z "${General::swroot}/forward/config"){ @@ -151,8 +147,10 @@ sub buildrules my $nat; my $fwaccessdport; my $natchain; + my $icmptype; foreach my $key (sort {$a <=> $b} keys %$hash){ next if (($$hash{$key}[6] eq 'RED' || $$hash{$key}[6] eq 'RED1') && $conexists eq 'off' ); + $command="iptables -A"; if ($$hash{$key}[28] eq 'ON'){ $command='iptables -t nat -A'; $natip=&get_nat_ip($$hash{$key}[29],$$hash{$key}[31]); @@ -216,14 +214,13 @@ sub buildrules } ##get source prot and port $SRC_TGT='SRC'; - $SPROT = &get_prot($hash,$key); $SPORT = &get_port($hash,$key); $SRC_TGT=''; ##get target prot and port $DPROT=&get_prot($hash,$key); - if ($DPROT eq ''){$DPROT=' ';} + if ($DPROT eq ''){$DPROT=' ';} @DPROT=split(",",$DPROT); #get time if defined @@ -240,12 +237,12 @@ sub buildrules if($$hash{$key}[24] ne ''){push (@timeframe,"Sat");} if($$hash{$key}[25] ne ''){push (@timeframe,"Sun");} $TIME=join(",",@timeframe); - + $TIMEFROM="--timestart $time1 "; $TIMETILL="--timestop $time2 "; $TIME="-m time --weekdays $TIME $TIMEFROM $TIMETILL"; } - if ($MODE eq '1'){ + if ($MODE eq '1'){ print "NR:$key "; foreach my $i (0 .. $#{$$hash{$key}}){ print "$i: $$hash{$key}[$i] "; @@ -255,20 +252,25 @@ sub buildrules #print rules to console foreach my $DPROT (@DPROT){ $DPORT = &get_port($hash,$key,$DPROT); - if ($SPROT ne ''){$PROT=$SPROT;}else{$PROT=$DPROT;} + $PROT=$DPROT; $PROT="-p $PROT" if ($PROT ne '' && $PROT ne ' '); foreach my $a (sort keys %sourcehash){ foreach my $b (sort keys %targethash){ if ($sourcehash{$a}[0] ne $targethash{$b}[0] && $targethash{$b}[0] ne 'none' || $sourcehash{$a}[0] eq '0.0.0.0/0.0.0.0'){ - if($SPROT eq '' || $SPROT eq $DPROT || $DPROT eq ' '){ + if($DPROT ne ''){ if(substr($sourcehash{$a}[0], 3, 3) ne 'mac' && $sourcehash{$a}[0] ne ''){ $STAG="-s";} if(substr($DPORT, 2, 4) eq 'icmp'){ my @icmprule= split(",",substr($DPORT, 12,)); foreach (@icmprule){ + $icmptype="--icmp-type "; + if ($_ eq "BLANK") { + $icmptype=""; + $_=""; + } if ($$hash{$key}[17] eq 'ON'){ - print "$command $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] --icmp-type $_ $TIME -j LOG\n"; + print "$command $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $icmptype $_ $TIME -j LOG\n"; } - print "$command $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] --icmp-type $_ $TIME -j $$hash{$key}[0]\n"; + print "$command $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $icmptype $_ $TIME -j $$hash{$key}[0]\n"; } }elsif($$hash{$key}[28] eq 'ON' && $$hash{$key}[31] eq 'dnat'){ $natchain='NAT_DESTINATION'; @@ -276,16 +278,22 @@ sub buildrules print "$command $natchain $PROT $STAG $sourcehash{$a}[0] $fireport $TIME -j LOG --log-prefix 'DNAT' \n"; } my ($ip,$sub) =split("/",$targethash{$b}[0]); - print "$command $natchain $PROT $STAG $sourcehash{$a}[0] $SPORT $natip $fireport $TIME -j $nat --to $ip$DPORT\n"; - $DPORT =~ s/\-/:/g; - if ($DPORT){ - $fwaccessdport="--dport ".substr($DPORT,1,); - }elsif(! $DPORT && $$hash{$key}[30] ne ''){ - if ($$hash{$key}[30]=~m/|/i){ - $$hash{$key}[30] =~ s/\|/,/g; - $fwaccessdport="-m multiport --dport $$hash{$key}[30]"; - }else{ - $fwaccessdport="--dport $$hash{$key}[30]"; + #Process NAT with servicegroup used + if ($$hash{$key}[28] eq 'ON' && $$hash{$key}[31] eq 'dnat' && $$hash{$key}[14] eq 'cust_srvgrp'){ + print "$command $natchain $PROT $STAG $sourcehash{$a}[0] $SPORT $natip $fireport $TIME -j $nat --to $ip $DPORT\n"; + $fwaccessdport=$DPORT; + }else{ + print "$command $natchain $PROT $STAG $sourcehash{$a}[0] $SPORT $natip $fireport $TIME -j $nat --to $ip$DPORT\n"; + $DPORT =~ s/\-/:/g; + if ($DPORT){ + $fwaccessdport="--dport ".substr($DPORT,1,); + }elsif(! $DPORT && $$hash{$key}[30] ne ''){ + if ($$hash{$key}[30]=~m/|/i){ + $$hash{$key}[30] =~ s/\|/,/g; + $fwaccessdport="-m multiport --dport $$hash{$key}[30]"; + }else{ + $fwaccessdport="--dport $$hash{$key}[30]"; + } } } print "iptables -A FORWARDFW $PROT -i $con $STAG $sourcehash{$a}[0] -d $ip $fwaccessdport $TIME -j $$hash{$key}[0]\n"; @@ -294,13 +302,16 @@ sub buildrules $natchain='NAT_SOURCE'; print "$command $natchain $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j $nat --to $natip\n"; } - if ($$hash{$key}[17] eq 'ON'){ + if ($$hash{$key}[17] eq 'ON' ){ print "$command $natchain $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j LOG\n"; } if ($PROT ne '-p ICMP'){ print "iptables -A $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j $$hash{$key}[0]\n"; } - } + if ($PROT eq '-p ICMP' && $$hash{$key}[9] eq 'All ICMP-Types'){ + print "iptables -A $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j $$hash{$key}[0]\n"; + } + } } } } @@ -309,21 +320,26 @@ sub buildrules }elsif($MODE eq '0'){ foreach my $DPROT (@DPROT){ $DPORT = &get_port($hash,$key,$DPROT); - if ($SPROT ne ''){$PROT=$SPROT;}else{$PROT=$DPROT;} + $PROT=$DPROT; $PROT="-p $PROT" if ($PROT ne '' && $PROT ne ' '); foreach my $a (sort keys %sourcehash){ foreach my $b (sort keys %targethash){ if ($sourcehash{$a}[0] ne $targethash{$b}[0] && $targethash{$b}[0] ne 'none' || $sourcehash{$a}[0] eq '0.0.0.0/0.0.0.0'){ - if($SPROT eq '' || $SPROT eq $DPROT || $DPROT eq ' '){ + if($DPROT ne ''){ if(substr($sourcehash{$a}[0], 3, 3) ne 'mac' && $sourcehash{$a}[0] ne ''){ $STAG="-s";} #Process ICMP RULE if(substr($DPORT, 2, 4) eq 'icmp'){ my @icmprule= split(",",substr($DPORT, 12,)); foreach (@icmprule){ + $icmptype="--icmp-type "; + if ($_ eq "BLANK") { + $icmptype=""; + $_=""; + } if ($$hash{$key}[17] eq 'ON'){ - system ("$command $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] -- icmp-type $_ $TIME -j LOG"); + system ("$command $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $icmptype $_ $TIME -j LOG"); } - system ("$command $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] --icmp-type $_ $TIME -j $$hash{$key}[0]"); + system ("$command $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $icmptype $_ $TIME -j $$hash{$key}[0]"); } #PROCESS DNAT RULE (Portforward) }elsif($$hash{$key}[28] eq 'ON' && $$hash{$key}[31] eq 'dnat'){ @@ -332,16 +348,22 @@ sub buildrules system "$command $natchain $PROT $STAG $sourcehash{$a}[0] $fireport $TIME -j LOG --log-prefix 'DNAT' \n"; } my ($ip,$sub) =split("/",$targethash{$b}[0]); - system "$command $natchain $PROT $STAG $sourcehash{$a}[0] $SPORT $natip $fireport $TIME -j $nat --to $ip$DPORT\n"; - $DPORT =~ s/\-/:/g; - if ($DPORT){ - $fwaccessdport="--dport ".substr($DPORT,1,); - }elsif(! $DPORT && $$hash{$key}[30] ne ''){ - if ($$hash{$key}[30]=~m/|/i){ - $$hash{$key}[30] =~ s/\|/,/g; - $fwaccessdport="-m multiport --dport $$hash{$key}[30]"; - }else{ - $fwaccessdport="--dport $$hash{$key}[30]"; + #Process NAT with servicegroup used + if ($$hash{$key}[28] eq 'ON' && $$hash{$key}[31] eq 'dnat' && $$hash{$key}[14] eq 'cust_srvgrp'){ + system "$command $natchain $PROT $STAG $sourcehash{$a}[0] $SPORT $natip $fireport $TIME -j $nat --to $ip $DPORT\n"; + $fwaccessdport=$DPORT; + }else{ + system "$command $natchain $PROT $STAG $sourcehash{$a}[0] $SPORT $natip $fireport $TIME -j $nat --to $ip$DPORT\n"; + $DPORT =~ s/\-/:/g; + if ($DPORT){ + $fwaccessdport="--dport ".substr($DPORT,1,); + }elsif(! $DPORT && $$hash{$key}[30] ne ''){ + if ($$hash{$key}[30]=~m/|/i){ + $$hash{$key}[30] =~ s/\|/,/g; + $fwaccessdport="-m multiport --dport $$hash{$key}[30]"; + }else{ + $fwaccessdport="--dport $$hash{$key}[30]"; + } } } system "iptables -A FORWARDFW $PROT -i $con $STAG $sourcehash{$a}[0] -d $ip $fwaccessdport $TIME -j $$hash{$key}[0]\n"; @@ -351,14 +373,18 @@ sub buildrules $natchain='NAT_SOURCE'; system "$command $natchain $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j $nat --to $natip\n"; } - if ($$hash{$key}[17] eq 'ON'){ + if ($$hash{$key}[17] eq 'ON' && substr($DPORT, 2, 4) ne 'icmp'){ system "$command $natchain $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j LOG\n"; } #PROCESS EVERY OTHER RULE (If NOT ICMP, else the rule would be applied double) if ($PROT ne '-p ICMP'){ system "iptables -A $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j $$hash{$key}[0]\n"; } - } + #PROCESS Prot ICMP and type = All ICMP-Types + if ($PROT eq '-p ICMP' && $$hash{$key}[9] eq 'All ICMP-Types'){ + system "iptables -A $$hash{$key}[1] $PROT $STAG $sourcehash{$a}[0] $SPORT -d $targethash{$b}[0] $DPORT $TIME -j $$hash{$key}[0]\n"; + } + } } } } @@ -466,7 +492,7 @@ sub get_address my $type=shift; #src or tgt my $hash; if ($type eq 'src'){ - $hash=\%sourcehash; + $hash=\%sourcehash; }else{ $hash=\%targethash; } @@ -521,33 +547,29 @@ sub get_prot { my $hash=shift; my $key=shift; - if ($$hash{$key}[7] eq 'ON' && $SRC_TGT eq 'SRC'){ - if ($$hash{$key}[10] ne ''){ - return"$$hash{$key}[8]"; - }elsif($$hash{$key}[9] ne ''){ - return"$$hash{$key}[8]"; - }else{ - return "$$hash{$key}[8]"; - } - }elsif($$hash{$key}[11] eq 'ON' && $SRC_TGT eq ''){ - if ($$hash{$key}[14] eq 'TGT_PORT'){ - if ($$hash{$key}[15] ne ''){ - return "$$hash{$key}[12]"; - }elsif($$hash{$key}[13] ne ''){ - return "$$hash{$key}[12]"; - }else{ - return "$$hash{$key}[12]"; - } - }elsif($$hash{$key}[14] eq 'cust_srv'){ + #check AH,GRE,ESP or ICMP + if ($$hash{$key}[7] ne 'ON' && $$hash{$key}[11] ne 'ON'){ + return "$$hash{$key}[8]"; + } + if ($$hash{$key}[7] eq 'ON' || $$hash{$key}[11] eq 'ON'){ + #check if servicegroup or service + if($$hash{$key}[14] eq 'cust_srv'){ return &fwlib::get_srv_prot($$hash{$key}[15]); - }elsif($$hash{$key}[14] eq 'cust_srvgrp'){ return &fwlib::get_srvgrp_prot($$hash{$key}[15]); + }elsif (($$hash{$key}[10] ne '' || $$hash{$key}[15] ne '') && $$hash{$key}[8] eq ''){ #when ports are used and prot set to "all" + return "TCP,UDP"; + }elsif (($$hash{$key}[10] ne '' || $$hash{$key}[15] ne '') && ($$hash{$key}[8] eq 'TCP' || $$hash{$key}[8] eq 'UDP')){ #when ports are used and prot set to "tcp" or "udp" + return "$$hash{$key}[8]"; + }elsif (($$hash{$key}[10] eq '' && $$hash{$key}[15] eq '') && $$hash{$key}[8] ne 'ICMP'){ #when ports are NOT used and prot NOT set to "ICMP" + return "$$hash{$key}[8]"; + }else{ + return "$$hash{$key}[8]"; } } #DNAT if ($SRC_TGT eq '' && $$hash{$key}[31] eq 'dnat' && $$hash{$key}[11] eq '' && $$hash{$key}[12] ne ''){ - return "$$hash{$key}[12]"; + return "$$hash{$key}[8]"; } } sub get_port @@ -567,10 +589,6 @@ sub get_port return ":$$hash{$key}[10]"; } } - }elsif($$hash{$key}[9] ne '' && $$hash{$key}[9] ne 'All ICMP-Types'){ - return "--icmp-type $$hash{$key}[9] "; - }elsif($$hash{$key}[9] eq 'All ICMP-Types'){ - return; } }elsif($$hash{$key}[11] eq 'ON' && $SRC_TGT eq ''){ if($$hash{$key}[14] eq 'TGT_PORT'){ @@ -586,10 +604,6 @@ sub get_port return ":$$hash{$key}[15]"; } } - }elsif($$hash{$key}[13] ne '' && $$hash{$key}[13] ne 'All ICMP-Types'){ - return "--icmp-type $$hash{$key}[13] "; - }elsif($$hash{$key}[13] ne '' && $$hash{$key}[13] eq 'All ICMP-Types'){ - return; } }elsif($$hash{$key}[14] eq 'cust_srv'){ if ($prot ne 'ICMP'){ @@ -598,10 +612,8 @@ sub get_port }else{ return "--dport ".&fwlib::get_srv_port($$hash{$key}[15],1,$prot); } - }elsif($prot eq 'ICMP' && $$hash{$key}[15] ne 'All ICMP-Types'){ + }elsif($prot eq 'ICMP' && $$hash{$key}[11] eq 'ON'){ #When PROT is ICMP and "use targetport is checked, this is an icmp-service return "--icmp-type ".&fwlib::get_srv_port($$hash{$key}[15],3,$prot); - }elsif($prot eq 'ICMP' && $$hash{$key}[15] eq 'All ICMP-Types'){ - return; } }elsif($$hash{$key}[14] eq 'cust_srvgrp'){ if ($prot ne 'ICMP'){ @@ -612,4 +624,12 @@ sub get_port } } } + #CHECK ICMP + if ($$hash{$key}[7] ne 'ON' && $$hash{$key}[11] ne 'ON' && $SRC_TGT eq ''){ + if($$hash{$key}[9] ne '' && $$hash{$key}[9] ne 'All ICMP-Types'){ + return "--icmp-type $$hash{$key}[9] "; + }elsif($$hash{$key}[9] eq 'All ICMP-Types'){ + return; + } + } }