X-Git-Url: http://git.ipfire.org/?p=people%2Fteissler%2Fipfire-2.x.git;a=blobdiff_plain;f=html%2Fcgi-bin%2Ffirewall.cgi;h=cf94c8f8bccccefe6692c56b5af0aa8530f9e237;hp=7bcb07964e6efabbce88246cb60feafacc4f7389;hb=1be052f99558509e6cd808290ee77b63524ff938;hpb=323923d912cb86fd2e89326aa61bad06bf05d6dd diff --git a/html/cgi-bin/firewall.cgi b/html/cgi-bin/firewall.cgi index 7bcb07964..cf94c8f8b 100644 --- a/html/cgi-bin/firewall.cgi +++ b/html/cgi-bin/firewall.cgi @@ -101,7 +101,7 @@ my @protocols; &General::readhasharray("$configipsec", \%ipsecconf); &Header::showhttpheaders(); &Header::getcgihash(\%fwdfwsettings); -&Header::openpage($Lang::tr{'fwdfw menu'}, 1, ''); +&Header::openpage($Lang::tr{'firewall rules'}, 1, ''); &Header::openbigbox('100%', 'center',$errormessage); #### JAVA SCRIPT #### print<"; - return $errormessage; + if ($fwdfwsettings{'grp2'} ne 'ipfire'){ + $errormessage=$Lang::tr{'fwdfw dnat error'}."
"; + return $errormessage; + } } } if ($fwdfwsettings{'tgt_addr'} eq $fwdfwsettings{$fwdfwsettings{'grp2'}} && $fwdfwsettings{'tgt_addr'} ne ''){ @@ -989,6 +991,12 @@ sub deleterule &base; } } +sub del_double +{ + my %all=(); + @all{@_}=1; + return (keys %all); +} sub disable_rule { my $key1=shift; @@ -1252,10 +1260,8 @@ sub get_serviceports my $name=shift; &General::readhasharray("$configsrv", \%customservice); &General::readhasharray("$configsrvgrp", \%customservicegrp); - my $tcp; - my $udp; - my $icmp; @protocols=(); + my @specprot=("IPIP","IPV6","IGMP","GRE","AH","ESP"); if($type eq 'service'){ foreach my $key (sort { ncmp($customservice{$a}[0],$customservice{$b}[0]) } keys %customservice){ if ($customservice{$key}[0] eq $name){ @@ -1265,33 +1271,23 @@ sub get_serviceports }elsif($type eq 'group'){ foreach my $key (sort { ncmp($customservicegrp{$a}[0],$customservicegrp{$b}[0]) } keys %customservicegrp){ if ($customservicegrp{$key}[0] eq $name){ - foreach my $key1 (sort { ncmp($customservice{$a}[0],$customservice{$b}[0]) } keys %customservice){ - if ($customservice{$key1}[0] eq $customservicegrp{$key}[2]){ - if($customservice{$key1}[2] eq 'TCP'){ - $tcp='TCP'; - }elsif($customservice{$key1}[2] eq 'ICMP'){ - $icmp='ICMP'; - }elsif($customservice{$key1}[2] eq 'UDP'){ - $udp='UDP'; + if ($customservicegrp{$key}[2] ~~ @specprot){ + push (@protocols," ".$customservicegrp{$key}[2]); + }else{ + foreach my $key1 (sort { ncmp($customservice{$a}[0],$customservice{$b}[0]) } keys %customservice){ + if ($customservice{$key1}[0] eq $customservicegrp{$key}[2]){ + if (!grep(/$customservice{$key1}[2]/, @protocols)){ + push (@protocols,$customservice{$key1}[2]);} } } } } } } - if($tcp && $udp && $icmp){ - push (@protocols,"TCP,UDP,
ICMP"); - return @protocols; - } - if($tcp){ - push (@protocols,"TCP"); - } - if($udp){ - push (@protocols,"UDP"); - } - if($icmp){ - push (@protocols,"ICMP"); - } + + # Sort protocols alphabetically. + @protocols = sort(@protocols); + return @protocols; } sub getcolor @@ -1338,7 +1334,7 @@ sub getcolor return; }elsif($val =~ /^(.*?)\/(.*?)$/){ my ($sip,$scidr) = split ("/",$val); - if ( &General::IpInSubnet($sip,$netsettings{'ORANGE_ADDRESS'},$netsettings{'ORANGE_NETMASK'})){ + if ( &Header::orange_used() && &General::IpInSubnet($sip,$netsettings{'ORANGE_ADDRESS'},$netsettings{'ORANGE_NETMASK'})){ $tdcolor="style='background-color: $Header::colourorange;color:white;'"; return; } @@ -1346,7 +1342,7 @@ sub getcolor $tdcolor="style='background-color: $Header::colourgreen;color:white;'"; return; } - if ( &General::IpInSubnet($sip,$netsettings{'BLUE_ADDRESS'},$netsettings{'BLUE_NETMASK'})){ + if ( &Header::blue_used() && &General::IpInSubnet($sip,$netsettings{'BLUE_ADDRESS'},$netsettings{'BLUE_NETMASK'})){ $tdcolor="style='background-color: $Header::colourblue;color:white;'"; return; } @@ -1393,11 +1389,13 @@ sub getcolor } #Check if IP is part of a IPsec N2N network foreach my $key (sort keys %ipsecconf){ - my ($a,$b) = split("/",$ipsecconf{$key}[11]); - $b=&General::iporsubtodec($b); - if (&General::IpInSubnet($c,$a,$b)){ - $tdcolor="style='background-color: $Header::colourvpn;color:white;'"; - return; + if ($ipsecconf{$key}[11]){ + my ($a,$b) = split("/",$ipsecconf{$key}[11]); + $b=&General::iporsubtodec($b); + if (&General::IpInSubnet($c,$a,$b)){ + $tdcolor="style='background-color: $Header::colourvpn;color:white;'"; + return; + } } } } @@ -1540,6 +1538,8 @@ sub newrule $selected{'TIME_TO'}{$fwdfwsettings{'TIME_TO'}} = 'selected'; $selected{'ipfire'}{$fwdfwsettings{$fwdfwsettings{'grp2'}}} ='selected'; $selected{'ipfire_src'}{$fwdfwsettings{$fwdfwsettings{'grp1'}}} ='selected'; + $selected{'dnat'}{$fwdfwsettings{'dnat'}} ='selected'; + $selected{'snat'}{$fwdfwsettings{'snat'}} ='selected'; } } $fwdfwsettings{'oldgrp1a'}=$fwdfwsettings{'grp1'}; @@ -1602,7 +1602,7 @@ END if (! -z "${General::swroot}/ethernet/aliases"){ foreach my $alias (sort keys %aliases) { - print ""; + print ""; } } print< END - if (%aliases) { - print <$Lang::tr{'dnat address'}: "; - } else { - print < - - -END } + #DNAT Dropdown + foreach my $network (sort keys %defaultNetworks) + { + if ($defaultNetworks{$network}{'NAME'} eq 'BLUE'||$defaultNetworks{$network}{'NAME'} eq 'GREEN' ||$defaultNetworks{$network}{'NAME'} eq 'ORANGE'){ + print ""; + } + } + print ""; print ""; #SNAT @@ -1671,19 +1674,14 @@ END foreach my $alias (sort keys %aliases) { print ""; } - - # XXX this is composed in a very ugly fashion + # SNAT Dropdown foreach my $network (sort keys %defaultNetworks) { - next if($defaultNetworks{$network}{'NAME'} eq "IPFire"); - next if($defaultNetworks{$network}{'NAME'} eq "ALL"); - next if($defaultNetworks{$network}{'NAME'} =~ /OpenVPN/i); - next if($defaultNetworks{$network}{'NAME'} =~ /IPsec/i); - - print ""; + if ($defaultNetworks{$network}{'NAME'} eq 'BLUE'||$defaultNetworks{$network}{'NAME'} eq 'GREEN' ||$defaultNetworks{$network}{'NAME'} eq 'ORANGE'){ + print ""; + } } - print < @@ -2302,8 +2300,8 @@ sub viewtablerule &General::readhash("/var/ipfire/ethernet/settings", \%netsettings); &viewtablenew(\%configfwdfw, $configfwdfw, $Lang::tr{'firewall rules'}); - &viewtablenew(\%configinputfw, $configinput, $Lang::tr{'external access'}); - &viewtablenew(\%configoutgoingfw, $configoutgoing, $Lang::tr{'outgoing firewall'}); + &viewtablenew(\%configinputfw, $configinput, $Lang::tr{'incoming firewall access'}); + &viewtablenew(\%configoutgoingfw, $configoutgoing, $Lang::tr{'outgoing firewall access'}); } sub viewtablenew { @@ -2375,26 +2373,18 @@ END if($$hash{$key}[3] eq 'ipsec_net_src'){ if(&fwlib::get_ipsec_net_ip($host,11) eq ''){ $coloryellow='on'; - &disable_rule($key); - $$hash{$key}[2]=''; } }elsif($$hash{$key}[3] eq 'ovpn_net_src'){ if(&fwlib::get_ovpn_net_ip($host,1) eq ''){ $coloryellow='on'; - &disable_rule($key); - $$hash{$key}[2]=''; } }elsif($$hash{$key}[3] eq 'ovpn_n2n_src'){ if(&fwlib::get_ovpn_n2n_ip($host,27) eq ''){ $coloryellow='on'; - &disable_rule($key); - $$hash{$key}[2]=''; } }elsif($$hash{$key}[3] eq 'ovpn_host_src'){ if(&fwlib::get_ovpn_host_ip($host,33) eq ''){ $coloryellow='on'; - &disable_rule($key); - $$hash{$key}[2]=''; } } } @@ -2402,26 +2392,18 @@ END if($$hash{$key}[5] eq 'ipsec_net_tgt'){ if(&fwlib::get_ipsec_net_ip($host,11) eq ''){ $coloryellow='on'; - &disable_rule($key); - $$hash{$key}[2]=''; } }elsif($$hash{$key}[5] eq 'ovpn_net_tgt'){ if(&fwlib::get_ovpn_net_ip($host,1) eq ''){ $coloryellow='on'; - &disable_rule($key); - $$hash{$key}[2]=''; } }elsif($$hash{$key}[5] eq 'ovpn_n2n_tgt'){ if(&fwlib::get_ovpn_n2n_ip($host,27) eq ''){ $coloryellow='on'; - &disable_rule($key); - $$hash{$key}[2]=''; } }elsif($$hash{$key}[5] eq 'ovpn_host_tgt'){ if(&fwlib::get_ovpn_host_ip($host,33) eq ''){ $coloryellow='on'; - &disable_rule($key); - $$hash{$key}[2]=''; } } } @@ -2429,15 +2411,11 @@ END foreach my $netgroup (sort keys %customgrp){ if(($$hash{$key}[4] eq $customgrp{$netgroup}[0] || $$hash{$key}[6] eq $customgrp{$netgroup}[0]) && $customgrp{$netgroup}[2] eq 'none'){ $coloryellow='on'; - &disable_rule($key); - $$hash{$key}[2]=''; } } foreach my $srvgroup (sort keys %customservicegrp){ if($$hash{$key}[15] eq $customservicegrp{$srvgroup}[0] && $customservicegrp{$srvgroup}[2] eq 'none'){ $coloryellow='on'; - &disable_rule($key); - $$hash{$key}[2]=''; } } $$hash{'ACTIVE'}=$$hash{$key}[2]; @@ -2497,7 +2475,7 @@ END push (@protocols,$Lang::tr{'all'}); } - my $protz=join(",",@protocols); + my $protz=join(", ",@protocols); if($protz eq 'ICMP' && $$hash{$key}[9] ne 'All ICMP-Types' && $$hash{$key}[14] ne 'cust_srvgrp'){ &General::readhasharray("${General::swroot}/fwhosts/icmp-types", \%icmptypes); foreach my $keyicmp (sort { ncmp($icmptypes{$a}[0],$icmptypes{$b}[0]) }keys %icmptypes){ @@ -2506,6 +2484,8 @@ END last; } } + }elsif($#protocols gt '3'){ + print"$Lang::tr{'fwdfw many'}"; }else{ print"$protz"; } @@ -2572,8 +2552,21 @@ END END #Is this a DNAT rule? + my $natstring; if ($$hash{$key}[31] eq 'dnat' && $$hash{$key}[28] eq 'ON'){ - print "Firewall ($$hash{$key}[29])"; + if ($$hash{$key}[29] eq 'Default IP'){$$hash{$key}[29]=$Lang::tr{'red1'};} + if ($$hash{$key}[29] eq 'AUTO'){ + my @src_addresses=&fwlib::get_addresses(\%$hash,$key,'src'); + my @nat_ifaces; + foreach my $val (@src_addresses){ + push (@nat_ifaces,&fwlib::get_nat_address($$hash{$key}[29],$val)); + } + @nat_ifaces=&del_double(@nat_ifaces); + $natstring = ""; + }else{ + $natstring = "($$hash{$key}[29])"; + } + print "$Lang::tr{'firewall'} $natstring"; if($$hash{$key}[30] ne ''){ $$hash{$key}[30]=~ tr/|/,/; print": $$hash{$key}[30]";