X-Git-Url: http://git.ipfire.org/?p=people%2Fteissler%2Fipfire-2.x.git;a=blobdiff_plain;f=html%2Fcgi-bin%2Fforwardfw.cgi;h=3810b8b324a35b905b0f86e4b6fc58ab559be4b6;hp=f0efa60e6a7fb64156cf169052b269ff188f3d49;hb=a1e89f481d13a59a38854a3921f3c0d85a26f4dd;hpb=b4f94285ff8ef9b347ee6f3e6fdb53e998ef63dd diff --git a/html/cgi-bin/forwardfw.cgi b/html/cgi-bin/forwardfw.cgi index f0efa60e6..3810b8b32 100755 --- a/html/cgi-bin/forwardfw.cgi +++ b/html/cgi-bin/forwardfw.cgi @@ -63,6 +63,8 @@ my %aliases=(); my %optionsfw=(); my %ifaces=(); +my @PROTOCOLS = ("TCP", "UDP", "ICMP", "IGMP", "AH", "ESP", "GRE"); + my $color; my $confignet = "${General::swroot}/fwhosts/customnetworks"; my $confighost = "${General::swroot}/fwhosts/customhosts"; @@ -100,21 +102,62 @@ my @protocols; #### JAVA SCRIPT #### print< + var PROTOCOLS_WITH_PORTS = ["TCP", "UDP"]; + + var update_protocol = function() { + var protocol = \$("#protocol").val(); + + if (protocol === undefined) + return; + + // Check if a template is/should be used. + if (protocol === "template") { + \$("#PROTOCOL_TEMPLATE").show(); + } else { + \$("#PROTOCOL_TEMPLATE").hide(); + } + + // Check if we are dealing with a protocol, that knows ports. + if (\$.inArray(protocol, PROTOCOLS_WITH_PORTS) >= 0) { + \$("#PROTOCOL_PORTS").show(); + } else { + \$("#PROTOCOL_PORTS").hide(); + } + + // Handle ICMP. + if (protocol === "ICMP") { + \$("#PROTOCOL_ICMP_TYPES").show(); + } else { + \$("#PROTOCOL_ICMP_TYPES").hide(); + } + }; + \$(document).ready(function() { + \$("#protocol").change(update_protocol); + update_protocol(); + + // When nat not used, hide it + if (\$("#nat").attr("checked")) { + \$("#natpart").show(); + } + + // Show NAT area when "use nat" checkbox is clicked + \$("#nat").change(function() { + \$("#natpart").toggle(); + }); + // Automatically select radio buttons when corresponding // dropdown menu changes. \$("select").change(function() { var id = \$(this).attr("name"); - //When using SNAT or DNAT, check "USE NAT" Checkbox - if ( id === 'snat' || id === 'dnat') { + + // When using SNAT or DNAT, check "USE NAT" Checkbox + if (id === 'snat' || id === 'dnat') { \$('#USE_NAT').prop('checked', true); } \$('#' + id).prop("checked", true); }); }); -function checkradio(a){ - \$(a).attr('checked', true); -} END @@ -465,31 +508,6 @@ sub checksource #check empty fields if ($fwdfwsettings{$fwdfwsettings{'grp1'}} eq ''){ $errormessage.=$Lang::tr{'fwdfw err nosrc'}."
";} - #check icmp source - if ($fwdfwsettings{'USE_SRC_PORT'} eq 'ON' && $fwdfwsettings{'PROT'} eq 'ICMP'){ - $fwdfwsettings{'SRC_PORT'}=''; - &General::readhasharray("${General::swroot}/fwhosts/icmp-types", \%icmptypes); - foreach my $key (keys %icmptypes){ - if($fwdfwsettings{'ICMP_TYPES'} eq "$icmptypes{$key}[0] ($icmptypes{$key}[1])"){ - $fwdfwsettings{'ICMP_TYPES'}="$icmptypes{$key}[0]"; - } - } - }elsif($fwdfwsettings{'USE_SRC_PORT'} eq 'ON' && $fwdfwsettings{'PROT'} eq 'GRE'){ - $fwdfwsettings{'SRC_PORT'}=''; - $fwdfwsettings{'ICMP_TYPES'}=''; - }elsif($fwdfwsettings{'USE_SRC_PORT'} eq 'ON' && $fwdfwsettings{'PROT'} eq 'ESP'){ - $fwdfwsettings{'SRC_PORT'}=''; - $fwdfwsettings{'ICMP_TYPES'}=''; - }elsif($fwdfwsettings{'USE_SRC_PORT'} eq 'ON' && $fwdfwsettings{'PROT'} eq 'AH'){ - $fwdfwsettings{'SRC_PORT'}=''; - $fwdfwsettings{'ICMP_TYPES'}=''; - }elsif($fwdfwsettings{'USE_SRC_PORT'} eq 'ON' && $fwdfwsettings{'PROT'} ne 'ICMP'){ - $fwdfwsettings{'ICMP_TYPES'}=''; - }else{ - $fwdfwsettings{'ICMP_TYPES'}=''; - $fwdfwsettings{'SRC_PORT'}=''; - } - if($fwdfwsettings{'USE_SRC_PORT'} eq 'ON' && ($fwdfwsettings{'PROT'} eq 'TCP' || $fwdfwsettings{'PROT'} eq 'UDP') && $fwdfwsettings{'SRC_PORT'} ne ''){ my @parts=split(",",$fwdfwsettings{'SRC_PORT'}); my @values=(); @@ -550,11 +568,11 @@ sub checktarget } #check if Port is a single Port or portrange if ($fwdfwsettings{'nat'} eq 'dnat' && $fwdfwsettings{'grp3'} eq 'TGT_PORT'){ - if(($fwdfwsettings{'TGT_PROT'} ne 'TCP'|| $fwdfwsettings{'TGT_PROT'} ne 'UDP') && $fwdfwsettings{'TGT_PORT'} eq ''){ + if(($fwdfwsettings{'PROT'} ne 'TCP'|| $fwdfwsettings{'PROT'} ne 'UDP') && $fwdfwsettings{'TGT_PORT'} eq ''){ $errormessage=$Lang::tr{'fwdfw target'}.": ".$Lang::tr{'fwdfw dnat porterr'}."
"; return $errormessage; } - if (($fwdfwsettings{'TGT_PROT'} eq 'TCP'|| $fwdfwsettings{'TGT_PROT'} eq 'UDP') && $fwdfwsettings{'TGT_PORT'} ne '' && !&check_natport($fwdfwsettings{'TGT_PORT'})){ + if (($fwdfwsettings{'PROT'} eq 'TCP'|| $fwdfwsettings{'PROT'} eq 'UDP') && $fwdfwsettings{'TGT_PORT'} ne '' && !&check_natport($fwdfwsettings{'TGT_PORT'})){ $errormessage=$Lang::tr{'fwdfw target'}.": ".$Lang::tr{'fwdfw dnat porterr'}."
"; return $errormessage; } @@ -599,17 +617,19 @@ sub checktarget if ($fwdfwsettings{'grp3'} eq 'cust_srv'){ $fwdfwsettings{'TGT_PROT'}=''; $fwdfwsettings{'ICMP_TGT'}=''; + $fwdfwsettings{'TGT_PORT'}=''; } if ($fwdfwsettings{'grp3'} eq 'cust_srvgrp'){ $fwdfwsettings{'TGT_PROT'}=''; $fwdfwsettings{'ICMP_TGT'}=''; + $fwdfwsettings{'TGT_PORT'}=''; #check target service if($fwdfwsettings{$fwdfwsettings{'grp3'}} eq ''){ $errormessage.=$Lang::tr{'fwdfw err tgt_grp'}; } } if ($fwdfwsettings{'grp3'} eq 'TGT_PORT'){ - if ($fwdfwsettings{'TGT_PROT'} eq 'TCP' || $fwdfwsettings{'TGT_PROT'} eq 'UDP'){ + if ($fwdfwsettings{'PROT'} eq 'TCP' || $fwdfwsettings{'PROT'} eq 'UDP'){ if ($fwdfwsettings{'TGT_PORT'} ne ''){ if ($fwdfwsettings{'TGT_PORT'} =~ "," && $fwdfwsettings{'USE_NAT'} && $fwdfwsettings{'nat'} eq 'dnat') { $errormessage=$Lang::tr{'fwdfw dnat porterr'}."
"; @@ -643,34 +663,26 @@ sub checktarget if (&General::validport($_)){ push (@values,$_); }else{ - } } } $fwdfwsettings{'TGT_PORT'}=join("|",@values); } - }elsif ($fwdfwsettings{'TGT_PROT'} eq 'GRE'){ + }elsif ($fwdfwsettings{'PROT'} eq 'GRE'){ $fwdfwsettings{$fwdfwsettings{'grp3'}} = ''; $fwdfwsettings{'TGT_PORT'} = ''; $fwdfwsettings{'ICMP_TGT'} = ''; - }elsif($fwdfwsettings{'TGT_PROT'} eq 'ESP'){ + }elsif ($fwdfwsettings{'PROT'} eq 'ESP'){ $fwdfwsettings{$fwdfwsettings{'grp3'}} = ''; $fwdfwsettings{'TGT_PORT'} = ''; $fwdfwsettings{'ICMP_TGT'}=''; - }elsif($fwdfwsettings{'TGT_PROT'} eq 'AH'){ + }elsif ($fwdfwsettings{'PROT'} eq 'AH'){ $fwdfwsettings{$fwdfwsettings{'grp3'}} = ''; $fwdfwsettings{'TGT_PORT'} = ''; $fwdfwsettings{'ICMP_TGT'}=''; - }elsif ($fwdfwsettings{'TGT_PROT'} eq 'ICMP'){ + }elsif ($fwdfwsettings{'PROT'} eq 'ICMP'){ $fwdfwsettings{$fwdfwsettings{'grp3'}} = ''; $fwdfwsettings{'TGT_PORT'} = ''; - &General::readhasharray("${General::swroot}/fwhosts/icmp-types", \%icmptypes); - foreach my $key (keys %icmptypes){ - - if ("$icmptypes{$key}[0] ($icmptypes{$key}[1])" eq $fwdfwsettings{'ICMP_TGT'}){ - $fwdfwsettings{'ICMP_TGT'}=$icmptypes{$key}[0]; - } - } } } } @@ -805,29 +817,69 @@ sub checkrule } } } - #check source and destination protocol if manual - if( $fwdfwsettings{'USE_SRC_PORT'} eq 'ON' && $fwdfwsettings{'USESRV'} eq 'ON'){ - #if($fwdfwsettings{'PROT'} ne $fwdfwsettings{'TGT_PROT'} && $fwdfwsettings{'grp3'} eq 'TGT_PORT'){ - # $errormessage.=$Lang::tr{'fwdfw err prot'}; - #} - #check source and destination protocol if source manual and dest servicegrp - if ($fwdfwsettings{'grp3'} eq 'cust_srv'){ - foreach my $key (sort keys %customservice){ - if($customservice{$key}[0] eq $fwdfwsettings{$fwdfwsettings{'grp3'}}){ - if ($customservice{$key}[2] ne $fwdfwsettings{'PROT'}){ - $errormessage.=$Lang::tr{'fwdfw err prot'}; - last; - } + #When using source- or targetport, the protocol has to be TCP or UDP + if (($fwdfwsettings{'USESRV'} eq 'ON' || $fwdfwsettings{'USE_SRC_PORT'} eq 'ON') && ($fwdfwsettings{'SRC_PORT'} ne '' || $fwdfwsettings{'TGT_PORT'} ne '') && ($fwdfwsettings{'PROT'} ne 'TCP' && $fwdfwsettings{'PROT'} ne 'UDP')){ + $errormessage.=$Lang::tr{'fwdfw err prot_port1'}; + return; + } + #when icmp selected, no targetport allowed + if (($fwdfwsettings{'PROT'} ne '' && $fwdfwsettings{'PROT'} ne 'TCP' && $fwdfwsettings{'PROT'} ne 'UDP') && ($fwdfwsettings{'USESRV'} eq 'ON' || $fwdfwsettings{'USE_SRC_PORT'} eq 'ON')){ + $errormessage.=$Lang::tr{'fwdfw err prot_port'}; + return; + } + #change protocol if prot not equal dest single service + if ($fwdfwsettings{'grp3'} eq 'cust_srv'){ + foreach my $key (sort keys %customservice){ + if($customservice{$key}[0] eq $fwdfwsettings{$fwdfwsettings{'grp3'}}){ + if ($customservice{$key}[2] ne $fwdfwsettings{'PROT'}){ + $fwdfwsettings{'PROT'} = $customservice{$key}[2]; + last; } } } } - #ATTENTION: $fwdfwsetting{'TGT_PROT'} deprecated since 30.09.2013 - - if( $fwdfwsettings{'PROT'} eq $Lang::tr{'all'}){ - $fwdfwsettings{'PROT'}=''; + #check source and destination protocol if source manual and dest servicegroup + if ($fwdfwsettings{'grp3'} eq 'cust_srvgrp'){ + $fwdfwsettings{'PROT'} = ''; } + #ATTENTION: $fwdfwsetting{'TGT_PROT'} deprecated since 30.09.2013 $fwdfwsettings{'TGT_PROT'}=''; #Set field empty (deprecated) + #Check ICMP Types + if ($fwdfwsettings{'PROT'} eq 'ICMP'){ + $fwdfwsettings{'USE_SRC_PORT'}=''; + $fwdfwsettings{'SRC_PORT'}=''; + #$fwdfwsettings{'USESRV'}=''; + $fwdfwsettings{'TGT_PORT'}=''; + &General::readhasharray("${General::swroot}/fwhosts/icmp-types", \%icmptypes); + foreach my $key (keys %icmptypes){ + if($fwdfwsettings{'ICMP_TYPES'} eq "$icmptypes{$key}[0] ($icmptypes{$key}[1])"){ + $fwdfwsettings{'ICMP_TYPES'}="$icmptypes{$key}[0]"; + } + } + }elsif($fwdfwsettings{'PROT'} eq 'GRE'){ + $fwdfwsettings{'USE_SRC_PORT'}=''; + $fwdfwsettings{'SRC_PORT'}=''; + $fwdfwsettings{'ICMP_TYPES'}=''; + $fwdfwsettings{'USESRV'}=''; + $fwdfwsettings{'TGT_PORT'}=''; + }elsif($fwdfwsettings{'PROT'} eq 'ESP'){ + $fwdfwsettings{'USE_SRC_PORT'}=''; + $fwdfwsettings{'SRC_PORT'}=''; + $fwdfwsettings{'ICMP_TYPES'}=''; + $fwdfwsettings{'USESRV'}=''; + $fwdfwsettings{'TGT_PORT'}=''; + }elsif($fwdfwsettings{'PROT'} eq 'AH'){ + $fwdfwsettings{'USE_SRC_PORT'}=''; + $fwdfwsettings{'SRC_PORT'}=''; + $fwdfwsettings{'ICMP_TYPES'}=''; + $fwdfwsettings{'USESRV'}=''; + $fwdfwsettings{'TGT_PORT'}=''; + }elsif($fwdfwsettings{'PROT'} ne 'TCP' && $fwdfwsettings{'PROT'} ne 'UDP' && $fwdfwsettings{'PROT'} ne 'ICMP'){ + $fwdfwsettings{'ICMP_TYPES'}=''; + $fwdfwsettings{'PROT'} = ''; + }elsif($fwdfwsettings{'PROT'} ne 'ICMP'){ + $fwdfwsettings{'ICMP_TYPES'}=''; + } } sub checkcounter { @@ -1158,7 +1210,7 @@ sub getsrcport { my %hash=%{(shift)}; my $key=shift; - if($hash{$key}[7] eq 'ON' && $hash{$key}[8] ne '' && $hash{$key}[10]){ + if($hash{$key}[7] eq 'ON' && $hash{$key}[10]){ $hash{$key}[10]=~ s/\|/,/g; print": $hash{$key}[10]"; }elsif($hash{$key}[7] eq 'ON' && $hash{$key}[8] eq 'ICMP'){ @@ -1188,8 +1240,6 @@ sub gettgtport if($service){ print": $service"; } - }elsif($hash{$key}[11] eq 'ON' && $hash{$key}[12] eq 'ICMP'){ - print":
$hash{$key}[13]"; } } sub get_serviceports @@ -1226,7 +1276,7 @@ sub get_serviceports } } if($tcp && $udp && $icmp){ - push (@protocols,"All"); + push (@protocols,"TCP,UDP,
ICMP"); return @protocols; } if($tcp){ @@ -1527,10 +1577,10 @@ sub newrule } } &Header::openbox('100%', 'left', $Lang::tr{'fwdfw addrule'}); - print "
"; &Header::closebox(); &Header::openbox('100%', 'left', $Lang::tr{'fwdfw source'}); #------SOURCE------------------------------------------------------- + print ""; print< $Lang::tr{'fwdfw sourceip'}Firewall @@ -1551,36 +1601,16 @@ END
END - &gen_dd_block('src','grp1'); - print<
- - - -
$Lang::tr{'fwdfw use srcport'}$Lang::tr{'fwdfw man port'} -END - $fwdfwsettings{'SRC_PORT'}=~ s/\|/,/g; - print<
$Lang::tr{'fwhost icmptype'}

-END + &gen_dd_block('src','grp1'); + print"
"; &Header::closebox(); #---SNAT / DNAT ------------------------------------------------ &Header::openbox('100%', 'left', 'NAT'); print< - $Lang::tr{'fwdfw use nat'} +
+
$Lang::tr{'fwdfw use nat'}
+
+ END print"
$Lang::tr{'fwdfw dnat'}Firewall:
"; - print"
"; + print"

"; &Header::closebox(); #---TARGET------------------------------------------------------ &Header::openbox('100%', 'left', $Lang::tr{'fwdfw target'}); @@ -1636,21 +1666,123 @@ END
END &gen_dd_block('tgt','grp2'); + print"
"; + &Header::closebox; + #---PROTOCOL------------------------------------------------------ + &Header::openbox('100%', 'left', $Lang::tr{'fwhost prot'}); print<
- - + +
$Lang::tr{'fwdfw use srv'}$Lang::tr{'fwhost cust service'} + + + +
+
+ + +
+ + + + + +
$Lang::tr{'fwhost icmptype'} +
+
+END + + $fwdfwsettings{'SRC_PORT'} =~ s/\|/,/g; + $fwdfwsettings{'TGT_PORT'} =~ s/\|/,/g; + + print < + + + + + + + + + + +
+ $Lang::tr{'fwdfw man port'} + + + + $Lang::tr{'fwdfw man port'} + + +
+ + +
+ + + + - + + + + - - -
+ + $Lang::tr{'fwhost cust service'} + +
$Lang::tr{'fwhost cust srvgrp'} +
+ + $Lang::tr{'fwhost cust srvgrp'} + +
$Lang::tr{'fwdfw man port'} -END - $fwdfwsettings{'TGT_PORT'} =~ s/\|/,/g; - print<
$Lang::tr{'fwhost icmptype'}

+ +
+ +


END - &Header::closebox; - #---PROTOCOL------------------------------------------------------ - &Header::openbox('100%', 'left', $Lang::tr{'fwhost prot'}); - print< -
"; + &Header::closebox; #---Activate/logging/remark------------------------------------- &Header::openbox('100%', 'left', $Lang::tr{'fwdfw additional'}); @@ -1712,7 +1814,7 @@ END { if($fwdfwsettings{'updatefwrule'} eq 'on'){ print""; }else{ if($fwdfwsettings{'POLICY'} eq 'MODE2'){ @@ -2200,7 +2302,17 @@ END push (@protocols,$Lang::tr{'all'}); } my $protz=join(",",@protocols); - print"$protz"; + if($protz eq 'ICMP' && $$hash{$key}[9] ne 'All ICMP-Types' && $$hash{$key}[14] ne 'cust_srvgrp'){ + &General::readhasharray("${General::swroot}/fwhosts/icmp-types", \%icmptypes); + foreach my $keyicmp (sort { ncmp($icmptypes{$a}[0],$icmptypes{$b}[0]) }keys %icmptypes){ + if($$hash{$key}[9] eq "$icmptypes{$keyicmp}[0]"){ + print "$protz ($icmptypes{$keyicmp}[1])"; + last; + } + } + }else{ + print"$protz"; + } @protocols=(); #SOURCE my $ipfireiface;