X-Git-Url: http://git.ipfire.org/?p=people%2Fteissler%2Fipfire-2.x.git;a=blobdiff_plain;f=html%2Fcgi-bin%2Ffirewall.cgi;h=dfb96973878654ce62d21fc71d19573fcd290420;hp=802b2bed34a237eafeac704c7e25930177eb89b5;hb=9c3bcb9f00fc09c86312b382bfb594c08fabc9ed;hpb=47a83092b5a6f2fa13d1c95de75b7bea4eb90da2 diff --git a/html/cgi-bin/firewall.cgi b/html/cgi-bin/firewall.cgi old mode 100755 new mode 100644 index 802b2bed3..dfb969738 --- a/html/cgi-bin/firewall.cgi +++ b/html/cgi-bin/firewall.cgi @@ -29,7 +29,7 @@ no warnings 'uninitialized'; require '/var/ipfire/general-functions.pl'; require "${General::swroot}/lang.pl"; require "${General::swroot}/header.pl"; -require "${General::swroot}/firewall/bin/firewall-lib.pl"; +require "/usr/lib/firewall/firewall-lib.pl"; unless (-d "${General::swroot}/firewall") { system("mkdir ${General::swroot}/firewall"); } unless (-e "${General::swroot}/firewall/settings") { system("touch ${General::swroot}/firewall/settings"); } @@ -136,14 +136,17 @@ print<"; } + if($fwdfwsettings{'oldruleremark'} ne $fwdfwsettings{'ruleremark'} && $fwdfwsettings{'updatefwrule'} eq 'on' && $fwdfwsettings{'ruleremark'} ne '' && &validremark($fwdfwsettings{'ruleremark'})){ + $errormessage=''; + } if ($fwdfwsettings{'oldruleremark'} eq $fwdfwsettings{'ruleremark'}){ $fwdfwsettings{'nosave'} = 'on'; } - } - } + } + } } #check Rulepos on new Rule if($fwdfwsettings{'rulepos'} > 0 && !$fwdfwsettings{'oldrulenumber'}){ @@ -251,17 +250,6 @@ if ($fwdfwsettings{'ACTION'} eq 'saverule') } } if (!$errormessage){ - &checkcounter($fwdfwsettings{'oldgrp1a'},$fwdfwsettings{'oldgrp1b'},$fwdfwsettings{'grp1'},$fwdfwsettings{$fwdfwsettings{'grp1'}}); - if ($fwdfwsettings{'nobase'} ne 'on'){ - &checkcounter($fwdfwsettings{'oldgrp2a'},$fwdfwsettings{'oldgrp2b'},$fwdfwsettings{'grp2'},$fwdfwsettings{$fwdfwsettings{'grp2'}}); - } - if($fwdfwsettings{'oldusesrv'} eq '' && $fwdfwsettings{'USESRV'} eq 'ON'){ - &checkcounter(0,0,$fwdfwsettings{'grp3'},$fwdfwsettings{$fwdfwsettings{'grp3'}}); - }elsif ($fwdfwsettings{'USESRV'} eq '' && $fwdfwsettings{'oldusesrv'} eq 'ON') { - &checkcounter($fwdfwsettings{'oldgrp3a'},$fwdfwsettings{'oldgrp3b'},0,0); - }elsif ($fwdfwsettings{'oldusesrv'} eq $fwdfwsettings{'USESRV'} && $fwdfwsettings{'oldgrp3b'} ne $fwdfwsettings{$fwdfwsettings{'grp3'}} && $fwdfwsettings{'updatefwrule'} eq 'on'){ - &checkcounter($fwdfwsettings{'oldgrp3a'},$fwdfwsettings{'oldgrp3b'},$fwdfwsettings{'grp3'},$fwdfwsettings{$fwdfwsettings{'grp3'}}); - } if($fwdfwsettings{'nosave2'} ne 'on'){ &saverule(\%configinputfw,$configinput); } @@ -276,11 +264,12 @@ if ($fwdfwsettings{'ACTION'} eq 'saverule') if ( "$fwdfwsettings{'RULE_ACTION'},$fwdfwsettings{'ACTIVE'},$fwdfwsettings{'grp1'},$fwdfwsettings{$fwdfwsettings{'grp1'}},$fwdfwsettings{'grp2'},$fwdfwsettings{$fwdfwsettings{'grp2'}},$fwdfwsettings{'USE_SRC_PORT'},$fwdfwsettings{'PROT'},$fwdfwsettings{'ICMP_TYPES'},$fwdfwsettings{'SRC_PORT'},$fwdfwsettings{'USESRV'},$fwdfwsettings{'TGT_PROT'},$fwdfwsettings{'ICMP_TGT'},$fwdfwsettings{'grp3'},$fwdfwsettings{$fwdfwsettings{'grp3'}},$fwdfwsettings{'LOG'},$fwdfwsettings{'TIME'},$fwdfwsettings{'TIME_MON'},$fwdfwsettings{'TIME_TUE'},$fwdfwsettings{'TIME_WED'},$fwdfwsettings{'TIME_THU'},$fwdfwsettings{'TIME_FRI'},$fwdfwsettings{'TIME_SAT'},$fwdfwsettings{'TIME_SUN'},$fwdfwsettings{'TIME_FROM'},$fwdfwsettings{'TIME_TO'},$fwdfwsettings{'USE_NAT'},$fwdfwsettings{$fwdfwsettings{'nat'}},$fwdfwsettings{'dnatport'},$fwdfwsettings{'nat'}" eq "$configoutgoingfw{$key}[0],$configoutgoingfw{$key}[2],$configoutgoingfw{$key}[3],$configoutgoingfw{$key}[4],$configoutgoingfw{$key}[5],$configoutgoingfw{$key}[6],$configoutgoingfw{$key}[7],$configoutgoingfw{$key}[8],$configoutgoingfw{$key}[9],$configoutgoingfw{$key}[10],$configoutgoingfw{$key}[11],$configoutgoingfw{$key}[12],$configoutgoingfw{$key}[13],$configoutgoingfw{$key}[14],$configoutgoingfw{$key}[15],$configoutgoingfw{$key}[17],$configoutgoingfw{$key}[18],$configoutgoingfw{$key}[19],$configoutgoingfw{$key}[20],$configoutgoingfw{$key}[21],$configoutgoingfw{$key}[22],$configoutgoingfw{$key}[23],$configoutgoingfw{$key}[24],$configoutgoingfw{$key}[25],$configoutgoingfw{$key}[26],$configoutgoingfw{$key}[27],$configoutgoingfw{$key}[28],$configoutgoingfw{$key}[29],$configoutgoingfw{$key}[30],$configoutgoingfw{$key}[31]"){ $errormessage.=$Lang::tr{'fwdfw err ruleexists'}; - if ($fwdfwsettings{'oldruleremark'} ne $fwdfwsettings{'ruleremark'} && $fwdfwsettings{'updatefwrule'} eq 'on'){ - $errormessage=''; - }elsif($fwdfwsettings{'oldruleremark'} ne $fwdfwsettings{'ruleremark'} && $fwdfwsettings{'updatefwrule'} eq 'on' && $fwdfwsettings{'ruleremark'} ne '' && !&validremark($fwdfwsettings{'ruleremark'})){ + if($fwdfwsettings{'oldruleremark'} ne $fwdfwsettings{'ruleremark'} && $fwdfwsettings{'updatefwrule'} eq 'on' && $fwdfwsettings{'ruleremark'} ne '' && !&validremark($fwdfwsettings{'ruleremark'})){ $errormessage=$Lang::tr{'fwdfw err remark'}."
"; } + if($fwdfwsettings{'oldruleremark'} ne $fwdfwsettings{'ruleremark'} && $fwdfwsettings{'updatefwrule'} eq 'on' && $fwdfwsettings{'ruleremark'} ne '' && &validremark($fwdfwsettings{'ruleremark'})){ + $errormessage=''; + } if ($fwdfwsettings{'oldruleremark'} eq $fwdfwsettings{'ruleremark'}){ $fwdfwsettings{'nosave'} = 'on'; } @@ -289,7 +278,6 @@ if ($fwdfwsettings{'ACTION'} eq 'saverule') } #check Rulepos on new Rule if($fwdfwsettings{'rulepos'} > 0 && !$fwdfwsettings{'oldrulenumber'}){ - print"CHECK OUTGOING DOPPELTE REGEL
"; $fwdfwsettings{'oldrulenumber'}=$maxkey; foreach my $key (sort keys %configoutgoingfw){ if ( "$fwdfwsettings{'RULE_ACTION'},$fwdfwsettings{'ACTIVE'},$fwdfwsettings{'grp1'},$fwdfwsettings{$fwdfwsettings{'grp1'}},$fwdfwsettings{'grp2'},$fwdfwsettings{$fwdfwsettings{'grp2'}},$fwdfwsettings{'USE_SRC_PORT'},$fwdfwsettings{'PROT'},$fwdfwsettings{'ICMP_TYPES'},$fwdfwsettings{'SRC_PORT'},$fwdfwsettings{'USESRV'},$fwdfwsettings{'TGT_PROT'},$fwdfwsettings{'ICMP_TGT'},$fwdfwsettings{'grp3'},$fwdfwsettings{$fwdfwsettings{'grp3'}},$fwdfwsettings{'LOG'},$fwdfwsettings{'TIME'},$fwdfwsettings{'TIME_MON'},$fwdfwsettings{'TIME_TUE'},$fwdfwsettings{'TIME_WED'},$fwdfwsettings{'TIME_THU'},$fwdfwsettings{'TIME_FRI'},$fwdfwsettings{'TIME_SAT'},$fwdfwsettings{'TIME_SUN'},$fwdfwsettings{'TIME_FROM'},$fwdfwsettings{'TIME_TO'},$fwdfwsettings{'USE_NAT'},$fwdfwsettings{$fwdfwsettings{'nat'}},$fwdfwsettings{'dnatport'},$fwdfwsettings{'nat'}" @@ -307,18 +295,6 @@ if ($fwdfwsettings{'ACTION'} eq 'saverule') } #increase counters if (!$errormessage){ - &checkcounter($fwdfwsettings{'oldgrp1a'},$fwdfwsettings{'oldgrp1b'},$fwdfwsettings{'grp1'},$fwdfwsettings{$fwdfwsettings{'grp1'}}); - &checkcounter($fwdfwsettings{'oldgrp2a'},$fwdfwsettings{'oldgrp2b'},$fwdfwsettings{'grp2'},$fwdfwsettings{$fwdfwsettings{'grp2'}}); - if($fwdfwsettings{'oldusesrv'} eq '' && $fwdfwsettings{'USESRV'} eq 'ON'){ - &checkcounter(0,0,$fwdfwsettings{'grp3'},$fwdfwsettings{$fwdfwsettings{'grp3'}}); - }elsif ($fwdfwsettings{'USESRV'} eq '' && $fwdfwsettings{'oldusesrv'} eq 'ON') { - &checkcounter($fwdfwsettings{'oldgrp3a'},$fwdfwsettings{'oldgrp3b'},0,0); - }elsif ($fwdfwsettings{'oldusesrv'} eq $fwdfwsettings{'USESRV'} && $fwdfwsettings{'oldgrp3b'} ne $fwdfwsettings{$fwdfwsettings{'grp3'}} && $fwdfwsettings{'updatefwrule'} eq 'on'){ - &checkcounter($fwdfwsettings{'oldgrp3a'},$fwdfwsettings{'oldgrp3b'},$fwdfwsettings{'grp3'},$fwdfwsettings{$fwdfwsettings{'grp3'}}); - } - if ($fwdfwsettings{'nobase'} eq 'on'){ - &checkcounter(0,0,$fwdfwsettings{'grp3'},$fwdfwsettings{$fwdfwsettings{'grp3'}}); - } if ($fwdfwsettings{'nosave2'} ne 'on'){ &saverule(\%configoutgoingfw,$configoutgoing); } @@ -334,17 +310,15 @@ if ($fwdfwsettings{'ACTION'} eq 'saverule') if ( "$fwdfwsettings{'RULE_ACTION'},$fwdfwsettings{'ACTIVE'},$fwdfwsettings{'grp1'},$fwdfwsettings{$fwdfwsettings{'grp1'}},$fwdfwsettings{'grp2'},$fwdfwsettings{$fwdfwsettings{'grp2'}},$fwdfwsettings{'USE_SRC_PORT'},$fwdfwsettings{'PROT'},$fwdfwsettings{'ICMP_TYPES'},$fwdfwsettings{'SRC_PORT'},$fwdfwsettings{'USESRV'},$fwdfwsettings{'TGT_PROT'},$fwdfwsettings{'ICMP_TGT'},$fwdfwsettings{'grp3'},$fwdfwsettings{$fwdfwsettings{'grp3'}},$fwdfwsettings{'TIME'},$fwdfwsettings{'TIME_MON'},$fwdfwsettings{'TIME_TUE'},$fwdfwsettings{'TIME_WED'},$fwdfwsettings{'TIME_THU'},$fwdfwsettings{'TIME_FRI'},$fwdfwsettings{'TIME_SAT'},$fwdfwsettings{'TIME_SUN'},$fwdfwsettings{'TIME_FROM'},$fwdfwsettings{'TIME_TO'},$fwdfwsettings{'USE_NAT'},$fwdfwsettings{$fwdfwsettings{'nat'}},$fwdfwsettings{'dnatport'},$fwdfwsettings{'nat'}" eq "$configfwdfw{$key}[0],$configfwdfw{$key}[2],$configfwdfw{$key}[3],$configfwdfw{$key}[4],$configfwdfw{$key}[5],$configfwdfw{$key}[6],$configfwdfw{$key}[7],$configfwdfw{$key}[8],$configfwdfw{$key}[9],$configfwdfw{$key}[10],$configfwdfw{$key}[11],$configfwdfw{$key}[12],$configfwdfw{$key}[13],$configfwdfw{$key}[14],$configfwdfw{$key}[15],$configfwdfw{$key}[18],$configfwdfw{$key}[19],$configfwdfw{$key}[20],$configfwdfw{$key}[21],$configfwdfw{$key}[22],$configfwdfw{$key}[23],$configfwdfw{$key}[24],$configfwdfw{$key}[25],$configfwdfw{$key}[26],$configfwdfw{$key}[27],$configfwdfw{$key}[28],$configfwdfw{$key}[29],$configfwdfw{$key}[30],$configfwdfw{$key}[31]"){ $errormessage.=$Lang::tr{'fwdfw err ruleexists'}; - if ($fwdfwsettings{'oldruleremark'} ne $fwdfwsettings{'ruleremark'} && $fwdfwsettings{'updatefwrule'} eq 'on' ){ - $errormessage=''; - }elsif($fwdfwsettings{'oldruleremark'} ne $fwdfwsettings{'ruleremark'} && $fwdfwsettings{'updatefwrule'} eq 'on' && $fwdfwsettings{'ruleremark'} ne '' && !&validremark($fwdfwsettings{'ruleremark'})){ + if($fwdfwsettings{'oldruleremark'} ne $fwdfwsettings{'ruleremark'} && $fwdfwsettings{'updatefwrule'} eq 'on' && $fwdfwsettings{'ruleremark'} ne '' && !&validremark($fwdfwsettings{'ruleremark'})){ $errormessage=$Lang::tr{'fwdfw err remark'}."
"; } if ($fwdfwsettings{'oldruleremark'} eq $fwdfwsettings{'ruleremark'}){ $fwdfwsettings{'nosave'} = 'on'; } - } + } } - } + } #check Rulepos on new Rule if($fwdfwsettings{'rulepos'} > 0 && !$fwdfwsettings{'oldrulenumber'}){ $fwdfwsettings{'oldrulenumber'}=$maxkey; @@ -352,7 +326,7 @@ if ($fwdfwsettings{'ACTION'} eq 'saverule') if ( "$fwdfwsettings{'RULE_ACTION'},$fwdfwsettings{'ACTIVE'},$fwdfwsettings{'grp1'},$fwdfwsettings{$fwdfwsettings{'grp1'}},$fwdfwsettings{'grp2'},$fwdfwsettings{$fwdfwsettings{'grp2'}},$fwdfwsettings{'USE_SRC_PORT'},$fwdfwsettings{'PROT'},$fwdfwsettings{'ICMP_TYPES'},$fwdfwsettings{'SRC_PORT'},$fwdfwsettings{'USESRV'},$fwdfwsettings{'TGT_PROT'},$fwdfwsettings{'ICMP_TGT'},$fwdfwsettings{'grp3'},$fwdfwsettings{$fwdfwsettings{'grp3'}},$fwdfwsettings{'TIME'},$fwdfwsettings{'TIME_MON'},$fwdfwsettings{'TIME_TUE'},$fwdfwsettings{'TIME_WED'},$fwdfwsettings{'TIME_THU'},$fwdfwsettings{'TIME_FRI'},$fwdfwsettings{'TIME_SAT'},$fwdfwsettings{'TIME_SUN'},$fwdfwsettings{'TIME_FROM'},$fwdfwsettings{'TIME_TO'},$fwdfwsettings{'USE_NAT'},$fwdfwsettings{$fwdfwsettings{'nat'}},$fwdfwsettings{'dnatport'},$fwdfwsettings{'nat'}" eq "$configfwdfw{$key}[0],$configfwdfw{$key}[2],$configfwdfw{$key}[3],$configfwdfw{$key}[4],$configfwdfw{$key}[5],$configfwdfw{$key}[6],$configfwdfw{$key}[7],$configfwdfw{$key}[8],$configfwdfw{$key}[9],$configfwdfw{$key}[10],$configfwdfw{$key}[11],$configfwdfw{$key}[12],$configfwdfw{$key}[13],$configfwdfw{$key}[14],$configfwdfw{$key}[15],$configfwdfw{$key}[18],$configfwdfw{$key}[19],$configfwdfw{$key}[20],$configfwdfw{$key}[21],$configfwdfw{$key}[22],$configfwdfw{$key}[23],$configfwdfw{$key}[24],$configfwdfw{$key}[25],$configfwdfw{$key}[26],$configfwdfw{$key}[27],$configfwdfw{$key}[28],$configfwdfw{$key}[29],$configfwdfw{$key}[30],$configfwdfw{$key}[31]"){ $errormessage.=$Lang::tr{'fwdfw err ruleexists'}; - } + } } } #check if we just close a rule @@ -364,18 +338,6 @@ if ($fwdfwsettings{'ACTION'} eq 'saverule') } #increase counters if (!$errormessage){ - &checkcounter($fwdfwsettings{'oldgrp1a'},$fwdfwsettings{'oldgrp1b'},$fwdfwsettings{'grp1'},$fwdfwsettings{$fwdfwsettings{'grp1'}}); - &checkcounter($fwdfwsettings{'oldgrp2a'},$fwdfwsettings{'oldgrp2b'},$fwdfwsettings{'grp2'},$fwdfwsettings{$fwdfwsettings{'grp2'}}); - if($fwdfwsettings{'oldusesrv'} eq '' && $fwdfwsettings{'USESRV'} eq 'ON'){ - &checkcounter(0,0,$fwdfwsettings{'grp3'},$fwdfwsettings{$fwdfwsettings{'grp3'}}); - }elsif ($fwdfwsettings{'USESRV'} eq '' && $fwdfwsettings{'oldusesrv'} eq 'ON') { - &checkcounter($fwdfwsettings{'oldgrp3a'},$fwdfwsettings{'oldgrp3b'},0,0); - }elsif ($fwdfwsettings{'oldusesrv'} eq $fwdfwsettings{'USESRV'} && $fwdfwsettings{'oldgrp3b'} ne $fwdfwsettings{$fwdfwsettings{'grp3'}} && $fwdfwsettings{'updatefwrule'} eq 'on'){ - &checkcounter($fwdfwsettings{'oldgrp3a'},$fwdfwsettings{'oldgrp3b'},$fwdfwsettings{'grp3'},$fwdfwsettings{$fwdfwsettings{'grp3'}}); - } - if ($fwdfwsettings{'nobase'} eq 'on'){ - &checkcounter(0,0,$fwdfwsettings{'grp3'},$fwdfwsettings{$fwdfwsettings{'grp3'}}); - } if ($fwdfwsettings{'nosave2'} ne 'on'){ &saverule(\%configfwdfw,$configfwdfw); } @@ -458,15 +420,13 @@ sub addrule { &error; - &Header::openbox('100%', 'left', $Lang::tr{'fwdfw menu'}); + &Header::openbox('100%', 'left', ""); print < - -
+ - END if (&General::firewall_needs_reload()) { @@ -481,8 +441,9 @@ END
-
+
END + &Header::closebox(); &viewtablerule; } @@ -498,8 +459,6 @@ sub changerule $fwdfwsettings{'config'}=$oldchain; $fwdfwsettings{'nobase'}='on'; &deleterule; - &checkcounter(0,0,$fwdfwsettings{'grp1'},$fwdfwsettings{$fwdfwsettings{'grp1'}}); - &checkcounter(0,0,$fwdfwsettings{'grp3'},$fwdfwsettings{$fwdfwsettings{'grp3'}}); } sub checksource { @@ -649,6 +608,19 @@ sub checktarget $errormessage.=$Lang::tr{'fwdfw err notgtip'}; return $errormessage; } + #check for mac in targetgroup + if ($fwdfwsettings{'grp2'} eq 'cust_grp_tgt'){ + &General::readhasharray("$configgrp", \%customgrp); + &General::readhasharray("$confighost", \%customhost); + foreach my $grpkey (sort keys %customgrp){ + foreach my $hostkey (sort keys %customhost){ + if ($customgrp{$grpkey}[2] eq $customhost{$hostkey}[0] && $customhost{$hostkey}[1] eq 'mac'){ + $hint=$Lang::tr{'fwdfw hint mac'}; + return $hint; + } + } + } + } #check empty fields if ($fwdfwsettings{$fwdfwsettings{'grp2'}} eq ''){ $errormessage.=$Lang::tr{'fwdfw err notgt'}."
";} #check tgt services @@ -702,6 +674,8 @@ sub checktarget if (&General::validport($_)){ push (@values,$_); }else{ + $errormessage=$Lang::tr{'fwdfw err tgt_port'}; + return $errormessage; } } } @@ -767,14 +741,32 @@ sub checkrule { #check valid port for NAT if($fwdfwsettings{'USE_NAT'} eq 'ON'){ - #if no port is given in nat area, take target host port + #RULE_ACTION must be ACCEPT if we use NAT + $fwdfwsettings{'RULE_ACTION'} = 'ACCEPT'; + + #if no dnat or snat selected errormessage + if ($fwdfwsettings{'nat'} eq ''){ + $errormessage=$Lang::tr{'fwdfw dnat nochoice'}; + return; + } + + #if using snat, the external port has to be empty + if ($fwdfwsettings{'nat'} eq 'snat' && $fwdfwsettings{'dnatport'} ne ''){ + $errormessage=$Lang::tr{'fwdfw dnat extport'}; + return; + } + #if no dest port is given in nat area, take target host port if($fwdfwsettings{'nat'} eq 'dnat' && $fwdfwsettings{'grp3'} eq 'TGT_PORT' && $fwdfwsettings{'dnatport'} eq ''){$fwdfwsettings{'dnatport'}=$fwdfwsettings{'TGT_PORT'};} + if($fwdfwsettings{'TGT_PORT'} eq '' && $fwdfwsettings{'dnatport'} ne '' && ($fwdfwsettings{'PROT'} eq 'TCP' || $fwdfwsettings{'PROT'} eq 'UDP')){ + $errormessage=$Lang::tr{'fwdfw dnat porterr2'}; + return; + } #check if port given in nat area is a single valid port or portrange if($fwdfwsettings{'nat'} eq 'dnat' && $fwdfwsettings{'TGT_PORT'} ne '' && !&check_natport($fwdfwsettings{'dnatport'})){ $errormessage=$Lang::tr{'fwdfw target'}.": ".$Lang::tr{'fwdfw dnat porterr'}."
"; }elsif($fwdfwsettings{'USESRV'} eq 'ON' && $fwdfwsettings{'grp3'} eq 'cust_srv'){ my $custsrvport; - #get servcie Protocol and Port + #get service Protocol and Port foreach my $key (sort keys %customservice){ if($fwdfwsettings{$fwdfwsettings{'grp3'}} eq $customservice{$key}[0]){ if ($customservice{$key}[2] ne 'TCP' && $customservice{$key}[2] ne 'UDP'){ @@ -821,6 +813,10 @@ sub checkrule } $fwdfwsettings{'dnatport'}=join("|",@values); } + #check if a rule with prot tcp or udp and ports is edited and now prot is "all", then delete all ports + if($fwdfwsettings{'PROT'} eq ''){ + $fwdfwsettings{'dnatport'}=''; + } } #check valid remark if ($fwdfwsettings{'ruleremark'} ne '' && !&validremark($fwdfwsettings{'ruleremark'})){ @@ -856,12 +852,7 @@ sub checkrule } } } - #When using source- or targetport, the protocol has to be TCP or UDP - if (($fwdfwsettings{'USESRV'} eq 'ON' || $fwdfwsettings{'USE_SRC_PORT'} eq 'ON') && ($fwdfwsettings{'SRC_PORT'} ne '' || $fwdfwsettings{'TGT_PORT'} ne '') && ($fwdfwsettings{'PROT'} ne 'TCP' && $fwdfwsettings{'PROT'} ne 'UDP')){ - $errormessage.=$Lang::tr{'fwdfw err prot_port1'}; - return; - } - #when icmp selected, no targetport allowed + #when icmp selected, no source and targetport allowed if (($fwdfwsettings{'PROT'} ne '' && $fwdfwsettings{'PROT'} ne 'TCP' && $fwdfwsettings{'PROT'} ne 'UDP' && $fwdfwsettings{'PROT'} ne 'template') && ($fwdfwsettings{'USESRV'} eq 'ON' || $fwdfwsettings{'USE_SRC_PORT'} eq 'ON')){ $errormessage.=$Lang::tr{'fwdfw err prot_port'}; return; @@ -931,41 +922,14 @@ sub checkrule $fwdfwsettings{'ICMP_TYPES'}=''; $fwdfwsettings{'USESRV'}=''; $fwdfwsettings{'TGT_PORT'}=''; - }elsif($fwdfwsettings{'PROT'} ne 'TCP' && $fwdfwsettings{'PROT'} ne 'UDP' && $fwdfwsettings{'PROT'} ne 'ICMP'){ + }elsif($fwdfwsettings{'PROT'} ne 'TCP' && $fwdfwsettings{'PROT'} ne 'UDP'){ $fwdfwsettings{'ICMP_TYPES'}=''; - $fwdfwsettings{'PROT'} = ''; + $fwdfwsettings{'SRC_PORT'}=''; + $fwdfwsettings{'TGT_PORT'}=''; }elsif($fwdfwsettings{'PROT'} ne 'ICMP'){ $fwdfwsettings{'ICMP_TYPES'}=''; } } -sub checkcounter -{ - my ($base1,$val1,$base2,$val2) = @_; - - if($base1 eq 'cust_net_src' || $base1 eq 'cust_net_tgt'){ - &dec_counter($confignet,\%customnetwork,$val1); - }elsif($base1 eq 'cust_host_src' || $base1 eq 'cust_host_tgt'){ - &dec_counter($confighost,\%customhost,$val1); - }elsif($base1 eq 'cust_grp_src' || $base1 eq 'cust_grp_tgt'){ - &dec_counter($configgrp,\%customgrp,$val1); - }elsif($base1 eq 'cust_srv'){ - &dec_counter($configsrv,\%customservice,$val1); - }elsif($base1 eq 'cust_srvgrp'){ - &dec_counter($configsrvgrp,\%customservicegrp,$val1); - } - - if($base2 eq 'cust_net_src' || $base2 eq 'cust_net_tgt'){ - &inc_counter($confignet,\%customnetwork,$val2); - }elsif($base2 eq 'cust_host_src' || $base2 eq 'cust_host_tgt'){ - &inc_counter($confighost,\%customhost,$val2); - }elsif($base2 eq 'cust_grp_src' || $base2 eq 'cust_grp_tgt'){ - &inc_counter($configgrp,\%customgrp,$val2); - }elsif($base2 eq 'cust_srv'){ - &inc_counter($configsrv,\%customservice,$val2); - }elsif($base2 eq 'cust_srvgrp'){ - &inc_counter($configsrvgrp,\%customservicegrp,$val2); - } -} sub checkvpn { my $ip=shift; @@ -997,15 +961,6 @@ sub deleterule my %delhash=(); &General::readhasharray($fwdfwsettings{'config'}, \%delhash); foreach my $key (sort {$a <=> $b} keys %delhash){ - if ($key == $fwdfwsettings{'key'}){ - #check hosts/net and groups - &checkcounter($delhash{$key}[3],$delhash{$key}[4],,); - &checkcounter($delhash{$key}[5],$delhash{$key}[6],,); - #check services and groups - if ($delhash{$key}[11] eq 'ON'){ - &checkcounter($delhash{$key}[14],$delhash{$key}[15],,); - } - } if ($key >= $fwdfwsettings{'key'}) { my $next = $key + 1; if (exists $delhash{$next}) { @@ -1038,21 +993,6 @@ sub disable_rule &General::writehasharray("$configfwdfw", \%configfwdfw); &General::firewall_config_changed(); } -sub dec_counter -{ - my $config=shift; - my %hash=%{(shift)}; - my $val=shift; - my $pos; - &General::readhasharray($config, \%hash); - foreach my $key (sort { uc($hash{$a}[0]) cmp uc($hash{$b}[0]) } keys %hash){ - if($hash{$key}[0] eq $val){ - $pos=$#{$hash{$key}}; - $hash{$key}[$pos] = $hash{$key}[$pos]-1; - } - } - &General::writehasharray($config, \%hash); -} sub error { if ($errormessage) { @@ -1060,7 +1000,6 @@ sub error print "$errormessage\n"; print " \n"; &Header::closebox(); - print"
"; } } sub fillselect @@ -1104,7 +1043,7 @@ sub gen_dd_block print< - +
"; } #End left table. start right table (vpn) - print"
$Lang::tr{'fwhost stdnet'}
$Lang::tr{'fwhost cust grp'}
"; + print"
"; # CCD networks if( ! -z $configccdnet || $optionsfw{'SHOWDROPDOWN'} eq 'on'){ print"";} #IPsec netze foreach my $key (sort { ncmp($ipsecconf{$a}[1],$ipsecconf{$b}[1]) } keys %ipsecconf) { - if ($ipsecconf{$key}[3] eq 'net' || $optionsfw{'SHOWDROPDOWN'} eq 'on'){ + if ($ipsecconf{$key}[3] eq 'net' || ($optionsfw{'SHOWDROPDOWN'} eq 'on' && $ipsecconf{$key}[3] ne 'host')){ print" -
$Lang::tr{'fwhost ccdnet'}
$Lang::tr{'fwhost ipsec net'}
+
+ END &gen_dd_block('src','grp1'); - print"
"; &Header::closebox(); + #---SNAT / DNAT ------------------------------------------------ &Header::openbox('100%', 'left', 'NAT'); print< - - + +END + + if (%aliases) { + print <$Lang::tr{'dnat address'}: + - END - print""; + print ""; + #SNAT - print""; - print" + + +
- + + + + "; + } else { + print < + $Lang::tr{'fwdfw dnat'}Firewall:
$Lang::tr{'fwdfw snat'}Firewall: + + $Lang::tr{'snat new source ip address'}: +
"; - print""; + + print < + + + + +END &Header::closebox(); + #---TARGET------------------------------------------------------ &Header::openbox('100%', 'left', $Lang::tr{'fwdfw target'}); print< -
+
END &gen_dd_block('tgt','grp2'); - print"
"; &Header::closebox; #---PROTOCOL------------------------------------------------------ $fwdfwsettings{'SRC_PORT'} =~ s/\|/,/g; @@ -1861,7 +1841,7 @@ END &General::readhasharray("$configsrvgrp", \%customservicegrp); my $helper; foreach my $key (sort { ncmp($customservicegrp{$a}[0],$customservicegrp{$b}[0]) } keys %customservicegrp){ - if ($helper ne $customservicegrp{$key}[0]){ + if ($helper ne $customservicegrp{$key}[0] && $customservicegrp{$key}[2] ne 'none'){ print""; @@ -1880,25 +1860,10 @@ END END &Header::closebox; - - $checked{"RULE_ACTION"} = (); - foreach ("ACCEPT", "DROP", "REJECT") { - $checked{"RULE_ACTION"}{$_} = ""; - } - - if($fwdfwsettings{'updatefwrule'} eq 'on') { - $checked{"RULE_ACTION"}{$fwdfwsettings{'RULE_ACTION'}} = "checked"; - } elsif ($fwdfwsettings{'POLICY'} eq 'MODE1') { - $checked{"RULE_ACTION"}{"ACCEPT"} = "checked"; - } elsif ($fwdfwsettings{'POLICY'} eq 'MODE2') { - $checked{"RULE_ACTION"}{"DROP"} = "checked"; - } - + $checked{"RULE_ACTION"}{$fwdfwsettings{'RULE_ACTION'}} = 'CHECKED'; print <
-
- +
 
  @@ -1935,7 +1900,6 @@ END
END - #---Activate/logging/remark------------------------------------- &Header::openbox('100%', 'left', $Lang::tr{'fwdfw additional'}); print<
-
+
END #---ACTION------------------------------------------------------ @@ -2318,7 +2282,7 @@ sub validremark if ($remark !~ /^[a-zäöüA-ZÖÄÜ0-9-.:;\|_()\/\s]*$/) { return 0;} # First character can only be a letter or a digit - if (substr ($remark, 0, 1) !~ /^[a-zäöüA-ZÖÄÜ0-9]*$/) { + if (substr ($remark, 0, 1) !~ /^[a-zäöüA-ZÖÄÜ0-9(]*$/) { return 0;} # Last character can only be a letter or a digit if (substr ($remark, -1, 1) !~ /^[a-zöäüA-ZÖÄÜ0-9.:;_)]*$/) { @@ -2328,36 +2292,43 @@ sub validremark sub viewtablerule { &General::readhash("/var/ipfire/ethernet/settings", \%netsettings); - &viewtablenew(\%configfwdfw,$configfwdfw,"","Forward" ); - &viewtablenew(\%configinputfw,$configinput,"",$Lang::tr{'fwdfw xt access'} ); - &viewtablenew(\%configoutgoingfw,$configoutgoing,"","Outgoing" ); + + &viewtablenew(\%configfwdfw, $configfwdfw, $Lang::tr{'firewall rules'}); + &viewtablenew(\%configinputfw, $configinput, $Lang::tr{'external access'}); + &viewtablenew(\%configoutgoingfw, $configoutgoing, $Lang::tr{'outgoing firewall'}); } sub viewtablenew { my $hash=shift; my $config=shift; my $title=shift; - my $title1=shift; my $go=''; + + my $show_box = (! -z $config) || ($optionsfw{'SHOWTABLES'} eq 'on'); + return if (!$show_box); + &General::get_aliases(\%aliases); &General::readhasharray("$confighost", \%customhost); &General::readhasharray("$config", $hash); &General::readhasharray("$configccdnet", \%ccdnet); &General::readhasharray("$configccdhost", \%ccdhost); - if( ! -z $config){ - &Header::openbox('100%', 'left',$title); + &General::readhasharray("$configgrp", \%customgrp); + &General::readhasharray("$configsrvgrp", \%customservicegrp); + + &Header::openbox('100%', 'left', $title); + print ""; + + if (! -z $config) { my $count=0; my ($gif,$log); my $ruletype; my $rulecolor; my $tooltip; my @tmpsrc=(); + my @tmptgt=(); my $coloryellow=''; - print <$title1 -
-
+ print < "; + $color="$color{'color14'}"; $coloryellow=''; }elsif($coloryellow eq ''){ if ($count % 2){ @@ -2491,9 +2505,9 @@ END #SOURCE my $ipfireiface; &getcolor($$hash{$key}[3],$$hash{$key}[4],\%customhost); - print""; } - print"
# @@ -2370,7 +2341,7 @@ sub viewtablenew $Lang::tr{'fwdfw source'} - Log + $Lang::tr{'fwdfw log'} $Lang::tr{'fwdfw target'} @@ -2384,33 +2355,61 @@ END foreach my $key (sort {$a <=> $b} keys %$hash){ $tdcolor=''; @tmpsrc=(); + @tmptgt=(); #check if vpn hosts/nets have been deleted if($$hash{$key}[3] =~ /ipsec/i || $$hash{$key}[3] =~ /ovpn/i){ push (@tmpsrc,$$hash{$key}[4]); } if($$hash{$key}[5] =~ /ipsec/i || $$hash{$key}[5] =~ /ovpn/i){ - push (@tmpsrc,$$hash{$key}[6]); + push (@tmptgt,$$hash{$key}[6]); } foreach my $host (@tmpsrc){ - if($$hash{$key}[3] eq 'ipsec_net_src' || $$hash{$key}[5] eq 'ipsec_net_tgt'){ + if($$hash{$key}[3] eq 'ipsec_net_src'){ + if(&fwlib::get_ipsec_net_ip($host,11) eq ''){ + $coloryellow='on'; + &disable_rule($key); + $$hash{$key}[2]=''; + } + }elsif($$hash{$key}[3] eq 'ovpn_net_src'){ + if(&fwlib::get_ovpn_net_ip($host,1) eq ''){ + $coloryellow='on'; + &disable_rule($key); + $$hash{$key}[2]=''; + } + }elsif($$hash{$key}[3] eq 'ovpn_n2n_src'){ + if(&fwlib::get_ovpn_n2n_ip($host,27) eq ''){ + $coloryellow='on'; + &disable_rule($key); + $$hash{$key}[2]=''; + } + }elsif($$hash{$key}[3] eq 'ovpn_host_src'){ + if(&fwlib::get_ovpn_host_ip($host,33) eq ''){ + $coloryellow='on'; + &disable_rule($key); + $$hash{$key}[2]=''; + } + } + } + foreach my $host (@tmptgt){ + if($$hash{$key}[5] eq 'ipsec_net_tgt'){ if(&fwlib::get_ipsec_net_ip($host,11) eq ''){ $coloryellow='on'; &disable_rule($key); $$hash{$key}[2]=''; } - }elsif($$hash{$key}[3] eq 'ovpn_net_src' || $$hash{$key}[5] eq 'ovpn_net_tgt'){ + }elsif($$hash{$key}[5] eq 'ovpn_net_tgt'){ if(&fwlib::get_ovpn_net_ip($host,1) eq ''){ $coloryellow='on'; &disable_rule($key); $$hash{$key}[2]=''; } - }elsif($$hash{$key}[3] eq 'ovpn_n2n_src' || $$hash{$key}[5] eq 'ovpn_n2n_tgt'){ + }elsif($$hash{$key}[5] eq 'ovpn_n2n_tgt'){ if(&fwlib::get_ovpn_n2n_ip($host,27) eq ''){ $coloryellow='on'; &disable_rule($key); $$hash{$key}[2]=''; } - }elsif($$hash{$key}[3] eq 'ovpn_host_src' || $$hash{$key}[5] eq 'ovpn_host_tgt'){ + }elsif($$hash{$key}[5] eq 'ovpn_host_tgt'){ if(&fwlib::get_ovpn_host_ip($host,33) eq ''){ $coloryellow='on'; &disable_rule($key); @@ -2418,10 +2417,25 @@ END } } } + #check if networkgroups or servicegroups are empty + foreach my $netgroup (sort keys %customgrp){ + if(($$hash{$key}[4] eq $customgrp{$netgroup}[0] || $$hash{$key}[6] eq $customgrp{$netgroup}[0]) && $customgrp{$netgroup}[2] eq 'none'){ + $coloryellow='on'; + &disable_rule($key); + $$hash{$key}[2]=''; + } + } + foreach my $srvgroup (sort keys %customservicegrp){ + if($$hash{$key}[15] eq $customservicegrp{$srvgroup}[0] && $customservicegrp{$srvgroup}[2] eq 'none'){ + $coloryellow='on'; + &disable_rule($key); + $$hash{$key}[2]=''; + } + } $$hash{'ACTIVE'}=$$hash{$key}[2]; $count++; if($coloryellow eq 'on'){ - print"
"; + print""; if ($$hash{$key}[3] eq 'ipfire_src'){ - $ipfireiface='Interface '; + $ipfireiface=$Lang::tr{'fwdfw iface'}; } if ($$hash{$key}[3] eq 'std_net_src'){ print &get_name($$hash{$key}[4]); @@ -2506,8 +2520,14 @@ END } }elsif ($$hash{$key}[4] eq 'RED1'){ print "$ipfireiface $Lang::tr{'fwdfw red'}"; + }elsif ($$hash{$key}[4] eq 'ALL'){ + print "$ipfireiface $Lang::tr{'all'}"; }else{ - print "$$hash{$key}[4]"; + if ($$hash{$key}[4] eq 'GREEN' || $$hash{$key}[4] eq 'ORANGE' || $$hash{$key}[4] eq 'BLUE' || $$hash{$key}[4] eq 'RED'){ + print "$ipfireiface $Lang::tr{lc($$hash{$key}[4])}"; + }else{ + print "$ipfireiface $$hash{$key}[4]"; + } } $tdcolor=''; #SOURCEPORT @@ -2552,15 +2572,12 @@ END } print"
->"; } - if ($$hash{$key}[5] eq 'ipfire'){ - $ipfireiface='Interface'; - } - if ($$hash{$key}[5] eq 'std_net_tgt' || $$hash{$key}[5] eq 'ipfire' || $$hash{$key}[6] eq 'RED1' || $$hash{$key}[6] eq 'GREEN' || $$hash{$key}[6] eq 'ORANGE' || $$hash{$key}[6] eq 'BLUE' ){ + if ($$hash{$key}[5] eq 'std_net_tgt' || $$hash{$key}[5] eq 'ipfire'){ if ($$hash{$key}[6] eq 'RED1'){ - print "$ipfireiface $Lang::tr{'red1'}"; - }elsif ($$hash{$key}[6] eq 'GREEN' || $$hash{$key}[6] eq 'ORANGE' || $$hash{$key}[6] eq 'BLUE'|| $$hash{$key}[6] eq 'ALL') + print "$Lang::tr{'red1'}"; + }elsif ($$hash{$key}[6] eq 'GREEN' || $$hash{$key}[6] eq 'ORANGE' || $$hash{$key}[6] eq 'BLUE'|| $$hash{$key}[6] eq 'ALL' || $$hash{$key}[6] eq 'RED') { - print "$ipfireiface ".&get_name($$hash{$key}[6]); + print &get_name($$hash{$key}[6]); }else{ print $$hash{$key}[6]; } @@ -2682,97 +2699,154 @@ END } print"
"; - #SHOW FINAL RULE - print ""; - my $col; - if ($config eq '/var/ipfire/firewall/config'){ - my $pol='fwdfw '.$fwdfwsettings{'POLICY'}; - if ($fwdfwsettings{'POLICY'} eq 'MODE1'){ - $col="bgcolor='darkred'"; - }else{ - $col="bgcolor='green'"; - } - &show_defaultrules($col,$pol); - }elsif ($config eq '/var/ipfire/firewall/outgoing'){ - if ($fwdfwsettings{'POLICY1'} eq 'MODE1'){ - $col="bgcolor='darkred'"; - print""; - }else{ - $col="bgcolor='green'"; - print""; - } - }else{ - print""; + } elsif ($optionsfw{'SHOWTABLES'} eq 'on') { + print < + + +END + } + + #SHOW FINAL RULE + my $policy = 'fwdfw ' . $fwdfwsettings{'POLICY'}; + my $colour = "bgcolor='green'"; + if ($fwdfwsettings{'POLICY'} eq 'MODE1') { + $colour = "bgcolor='darkred'"; + } + + my $message; + if (($config eq '/var/ipfire/firewall/config') && ($fwdfwsettings{'POLICY'} ne 'MODE1')) { + print < + + + + +END } - } -} -&Header::closebigbox(); -&Header::closepage(); -sub show_defaultrules -{ - my $col=shift; - my $pol=shift; - #STANDARD RULES (From WIKI) - print"
$Lang::tr{'fwdfw final_rule'}$Lang::tr{'fwdfw pol block'}
$Lang::tr{'fwdfw final_rule'}$Lang::tr{'fwdfw pol allow'}
$Lang::tr{'fwdfw final_rule'}$Lang::tr{'fwdfw pol block'}
$Lang::tr{'fwhost empty'}
 
+ +END + + # GREEN + print < + + +END + + if (&Header::orange_used()) { + print < + $Lang::tr{'orange'} + ($Lang::tr{'fwdfw pol allow'}) + +END } - print"
+ $Lang::tr{'green'} + + $Lang::tr{'red'} + ($Lang::tr{'fwdfw pol allow'}) +
"; - print "
"; - print "

"; - &Header::closebox(); - }else{ - if ($optionsfw{'SHOWTABLES'} eq 'on'){ - print "$title1
"; - print"
$Lang::tr{'fwhost empty'}
"; - my $col; - if ($config eq '/var/ipfire/firewall/config'){ - my $pol='fwdfw '.$fwdfwsettings{'POLICY'}; - if ($fwdfwsettings{'POLICY'} eq 'MODE1'){ - $col="bgcolor='darkred'"; - }else{ - $col="bgcolor='green'"; - } - &show_defaultrules($col,$pol); - }elsif ($config eq '/var/ipfire/firewall/outgoing'){ - print ""; - my $pol='fwdfw '.$fwdfwsettings{'POLICY1'}; - if ($fwdfwsettings{'POLICY1'} eq 'MODE1'){ - $col="bgcolor='darkred'"; - print""; - }else{ - $col="bgcolor='green'"; - print""; - } - }else{ - print "
$Lang::tr{'fwdfw final_rule'}$Lang::tr{'fwdfw pol block'}
$Lang::tr{'fwdfw final_rule'}$Lang::tr{'fwdfw pol allow'}
"; - print""; - } - print"
$Lang::tr{'fwdfw final_rule'}$Lang::tr{'fwdfw pol block'}


"; + + if (&Header::blue_used()) { + print < + $Lang::tr{'blue'} + ($Lang::tr{'fwdfw pol allow'}) +
"; - if ($col eq "bgcolor='green'"){ - print "
"; - my $blue = " $Lang::tr{'blue'} ($Lang::tr{'fwdfw pol block'})" if (&Header::blue_used()); - my $orange = " $Lang::tr{'orange'} ($Lang::tr{'fwdfw pol block'})" if (&Header::orange_used()); - my $blue1 = " $Lang::tr{'blue'} ($Lang::tr{'fwdfw pol allow'})" if (&Header::blue_used()); - my $orange1 = " $Lang::tr{'orange'} ($Lang::tr{'fwdfw pol allow'})" if (&Header::orange_used()); - print""; - print"" if (&Header::orange_used()); - print"" if (&Header::blue_used()); print""; - if (&Header::orange_used()){ - print""; - print"" if (&Header::blue_used()); + + # ORANGE + if (&Header::orange_used()) { + print < + + + +END + + if (&Header::blue_used()) { + print < + $Lang::tr{'blue'} + ($Lang::tr{'fwdfw pol block'}) + +END + } + print""; } - if (&Header::blue_used()){ - print""; - print"" if (&Header::orange_used()); - print""; - print""; + + if (&Header::blue_used()) { + print < + + +END + + if (&Header::orange_used()) { + print < + $Lang::tr{'orange'} + ($Lang::tr{'fwdfw pol block'}) + +END + } + + print < + $Lang::tr{'green'} + ($Lang::tr{'fwdfw pol block'}) + + +END } - print""; - }elsif($col eq "bgcolor='darkred'"){ - print "
$Lang::tr{'green'} $Lang::tr{'red'} ($Lang::tr{'fwdfw pol allow'})$orange1$blue1
$Lang::tr{'orange'} $Lang::tr{'red'} ($Lang::tr{'fwdfw pol allow'}) $Lang::tr{'green'} ($Lang::tr{'fwdfw pol block'})$blue + $Lang::tr{'orange'} + + $Lang::tr{'red'} + ($Lang::tr{'fwdfw pol allow'}) + + $Lang::tr{'green'} + ($Lang::tr{'fwdfw pol block'}) +
$Lang::tr{'blue'} $Lang::tr{'red'} ($Lang::tr{'fwdfw pol allow'})$orange $Lang::tr{'green'} ($Lang::tr{'fwdfw pol block'})
+ $Lang::tr{'blue'} + + $Lang::tr{'red'} + ($Lang::tr{'fwdfw pol allow'}) +
$Lang::tr{'fwdfw final_rule'} $Lang::tr{'fwdfw pol allow'}
"; - print""; + + print < + + +END + + $message = $Lang::tr{'fwdfw pol allow'}; + + } elsif ($config eq '/var/ipfire/firewall/outgoing' && ($fwdfwsettings{'POLICY1'} ne 'MODE1')) { + $message = $Lang::tr{'fwdfw pol allow'}; + $colour = "bgcolor='green'"; + } else { + $message = $Lang::tr{'fwdfw pol block'}; + $colour = "bgcolor='darkred'"; + } + + if ($message) { + print < + + +END } + + print "
$Lang::tr{'fwdfw final_rule'}$Lang::tr{'fwdfw pol block'}
+ $Lang::tr{'policy'}: $message +
"; + print "
"; + + &Header::closebox(); } + +&Header::closebigbox(); +&Header::closepage();