";
&Header::closebox();
}
sub addrule
{
&error;
+ if (-f "${General::swroot}/forward/reread"){
+ print "
";
+ }
&Header::openbox('100%', 'left', $Lang::tr{'fwdfw addrule'});
-
print "";
-
+ print"";
&Header::closebox();
&viewtablerule;
}
@@ -564,7 +678,7 @@ sub disable_rule
sub checksource
{
my ($ip,$subnet);
-
+
#check ip-address if manual
if ($fwdfwsettings{'src_addr'} eq $fwdfwsettings{$fwdfwsettings{'grp1'}} && $fwdfwsettings{'src_addr'} ne ''){
#check if ip with subnet
@@ -579,7 +693,7 @@ sub checksource
$subnet = '32';
$fwdfwsettings{'isip'}='on';
}
-
+
if ($fwdfwsettings{'isip'} ne 'on'){
if (&General::validmac($fwdfwsettings{'src_addr'})){$fwdfwsettings{'ismac'}='on';}
}
@@ -594,7 +708,7 @@ sub checksource
$errormessage=$Lang::tr{'fwhost err hostip'}." ";
}
$fwdfwsettings{'src_addr'}="$ip/$subnet";
-
+
if(!&General::validipandmask($fwdfwsettings{'src_addr'})){
$errormessage.=$Lang::tr{'fwdfw err src_addr'}." ";
}
@@ -624,6 +738,9 @@ sub checksource
}elsif($fwdfwsettings{'USE_SRC_PORT'} eq 'ON' && $fwdfwsettings{'PROT'} eq 'ESP'){
$fwdfwsettings{'SRC_PORT'}='';
$fwdfwsettings{'ICMP_TYPES'}='';
+ }elsif($fwdfwsettings{'USE_SRC_PORT'} eq 'ON' && $fwdfwsettings{'PROT'} eq 'AH'){
+ $fwdfwsettings{'SRC_PORT'}='';
+ $fwdfwsettings{'ICMP_TYPES'}='';
}elsif($fwdfwsettings{'USE_SRC_PORT'} eq 'ON' && $fwdfwsettings{'PROT'} ne 'ICMP'){
$fwdfwsettings{'ICMP_TYPES'}='';
}else{
@@ -632,23 +749,42 @@ sub checksource
$fwdfwsettings{'PROT'}='';
}
- if($fwdfwsettings{'USE_SRC_PORT'} eq 'ON' && $fwdfwsettings{'PROT'} ne 'ICMP' && $fwdfwsettings{'SRC_PORT'} ne ''){
- #change dashes with :
- $fwdfwsettings{'SRC_PORT'}=~ tr/-/:/;
-
- if ($fwdfwsettings{'SRC_PORT'} eq "*") {
- $fwdfwsettings{'SRC_PORT'} = "1:65535";
- }
- if ($fwdfwsettings{'SRC_PORT'} =~ /^(\D)\:(\d+)$/) {
- $fwdfwsettings{'SRC_PORT'} = "1:$2";
- }
- if ($fwdfwsettings{'SRC_PORT'} =~ /^(\d+)\:(\D)$/) {
- $fwdfwsettings{'SRC_PORT'} = "$1:65535";
+ if($fwdfwsettings{'USE_SRC_PORT'} eq 'ON' && ($fwdfwsettings{'PROT'} eq 'TCP' || $fwdfwsettings{'PROT'} eq 'UDP') && $fwdfwsettings{'SRC_PORT'} ne ''){
+ my @parts=split(",",$fwdfwsettings{'SRC_PORT'});
+ my @values=();
+ foreach (@parts){
+ chomp($_);
+ if ($_ =~ /^(\d+)\:(\d+)$/) {
+ my $check;
+ #change dashes with :
+ $_=~ tr/-/:/;
+ if ($_ eq "*") {
+ push(@values,"1:65535");
+ $check='on';
+ }
+ if ($_ =~ /^(\D)\:(\d+)$/) {
+ push(@values,"1:$2");
+ $check='on';
+ }
+ if ($_ =~ /^(\d+)\:(\D)$/) {
+ push(@values,"$1:65535");
+ $check='on'
+ }
+ $errormessage .= &General::validportrange($_, 'destination');
+ if(!$check){
+ push (@values,$_);
+ }
+ }else{
+ if (&General::validport($_)){
+ push (@values,$_);
+ }else{
+
+ }
+ }
}
-
- $errormessage.=&General::validportrange($fwdfwsettings{'SRC_PORT'},'src');
+ $fwdfwsettings{'SRC_PORT'}=join("|",@values);
+ return $errormessage;
}
- return $errormessage;
}
sub checktarget
{
@@ -668,13 +804,13 @@ sub checktarget
#check and form valid IP
$ip=&General::ip2dec($ip);
$ip=&General::dec2ip($ip);
-
- #check if net or broadcast
- my @tmp= split (/\./,$ip);
- if (($tmp[3] eq "0") || ($tmp[3] eq "255"))
- {
- $errormessage=$Lang::tr{'fwhost err hostip'}." ";
- }
+
+ ##check if net or broadcast
+ #my @tmp= split (/\./,$ip);
+ #if ($tmp[3] eq "0" || ($tmp[3] eq "255"))
+ #{
+ #$errormessage=$Lang::tr{'fwhost err hostip'}." ";
+ #}
$fwdfwsettings{'tgt_addr'}="$ip/$subnet";
if(!&General::validipandmask($fwdfwsettings{'tgt_addr'})){
@@ -704,28 +840,56 @@ sub checktarget
}
}
if ($fwdfwsettings{'grp3'} eq 'TGT_PORT'){
- if ($fwdfwsettings{'TGT_PROT'} ne 'ICMP' && $fwdfwsettings{'TGT_PROT'} ne 'GRE'){
+ if ($fwdfwsettings{'TGT_PROT'} eq 'TCP' || $fwdfwsettings{'TGT_PROT'} eq 'UDP'){
if ($fwdfwsettings{'TGT_PORT'} ne ''){
- #change dashes with :
- $fwdfwsettings{'TGT_PORT'}=~ tr/-/:/;
- if ($fwdfwsettings{'TGT_PORT'} eq "*") {
- $fwdfwsettings{'TGT_PORT'} = "1:65535";
- }
- if ($fwdfwsettings{'TGT_PORT'} =~ /^(\D)\:(\d+)$/) {
- $fwdfwsettings{'TGT_PORT'} = "1:$2";
- }
- if ($fwdfwsettings{'TGT_PORT'} =~ /^(\d+)\:(\D)$/) {
- $fwdfwsettings{'TGT_PORT'} = "$1:65535";
+ my @parts=split(",",$fwdfwsettings{'TGT_PORT'});
+ my @values=();
+ foreach (@parts){
+ chomp($_);
+ if ($_ =~ /^(\d+)\:(\d+)$/) {
+ my $check;
+ #change dashes with :
+ $_=~ tr/-/:/;
+ if ($_ eq "*") {
+ push(@values,"1:65535");
+ $check='on';
+ }
+ if ($_ =~ /^(\D)\:(\d+)$/) {
+ push(@values,"1:$2");
+ $check='on';
+ }
+ if ($_ =~ /^(\d+)\:(\D)$/) {
+ push(@values,"$1:65535");
+ $check='on'
+ }
+ $errormessage .= &General::validportrange($_, 'destination');
+ if(!$check){
+ push (@values,$_);
+ }
+ }else{
+ if (&General::validport($_)){
+ push (@values,$_);
+ }else{
+
+ }
+ }
}
- $errormessage .= &General::validportrange($fwdfwsettings{'TGT_PORT'}, 'destination');
+ $fwdfwsettings{'TGT_PORT'}=join("|",@values);
}
}elsif ($fwdfwsettings{'TGT_PROT'} eq 'GRE'){
+ $fwdfwsettings{$fwdfwsettings{'grp3'}} = '';
$fwdfwsettings{'TGT_PORT'} = '';
$fwdfwsettings{'ICMP_TGT'} = '';
- }elsif($fwdfwsettings{'TGT_PORT'} eq 'ESP'){
- $fwdfwsettings{'TGT_PORT'}='';
+ }elsif($fwdfwsettings{'TGT_PROT'} eq 'ESP'){
+ $fwdfwsettings{$fwdfwsettings{'grp3'}} = '';
+ $fwdfwsettings{'TGT_PORT'} = '';
+ $fwdfwsettings{'ICMP_TGT'}='';
+ }elsif($fwdfwsettings{'TGT_PROT'} eq 'AH'){
+ $fwdfwsettings{$fwdfwsettings{'grp3'}} = '';
+ $fwdfwsettings{'TGT_PORT'} = '';
$fwdfwsettings{'ICMP_TGT'}='';
}elsif ($fwdfwsettings{'TGT_PROT'} eq 'ICMP'){
+ $fwdfwsettings{$fwdfwsettings{'grp3'}} = '';
$fwdfwsettings{'TGT_PORT'} = '';
&General::readhasharray("${General::swroot}/fwhosts/icmp-types", \%icmptypes);
foreach my $key (keys %icmptypes){
@@ -760,7 +924,7 @@ sub checkrule
$errormessage.=$Lang::tr{'fwdfw err remark'}." ";
}
#check if source and target identical
- if ($fwdfwsettings{$fwdfwsettings{'grp1'}} eq $fwdfwsettings{$fwdfwsettings{'grp2'}}){
+ if ($fwdfwsettings{$fwdfwsettings{'grp1'}} eq $fwdfwsettings{$fwdfwsettings{'grp2'}} && $fwdfwsettings{$fwdfwsettings{'grp1'}} ne 'ALL'){
$errormessage.=$Lang::tr{'fwdfw err same'};
return $errormessage;
}
@@ -775,7 +939,7 @@ sub checkrule
my $networkip1=&General::getnetworkip($sip,$scidr);
my $networkip2=&General::getnetworkip($tip,$tcidr);
if ($scidr gt $tcidr){
- if ( &General::IpInSubnet($networkip1,$tip,&General::iporsubtodec($tcidr)) ){
+ if ( &General::IpInSubnet($networkip1,$tip,&General::iporsubtodec($tcidr))){
$errormessage.=$Lang::tr{'fwdfw err samesub'};
}
}elsif($scidr eq $tcidr && $scidr eq '32'){
@@ -794,7 +958,7 @@ sub checkrule
#check source and destination protocol if manual
if( $fwdfwsettings{'USE_SRC_PORT'} eq 'ON' && $fwdfwsettings{'USESRV'} eq 'ON'){
- if($fwdfwsettings{'PROT'} ne $fwdfwsettings{'TGT_PROT'} && $fwdfwsettings{'grp3'} eq 'TGT_PORT'){
+ if($fwdfwsettings{'PROT'} ne $fwdfwsettings{'TGT_PROT'} && $fwdfwsettings{'grp3'} eq 'TGT_PORT'){
$errormessage.=$Lang::tr{'fwdfw err prot'};
}
#check source and destination protocol if source manual and dest servicegrp
@@ -905,7 +1069,7 @@ sub newrule
foreach my $key (sort keys %hash){
$sum++;
if ($key eq $fwdfwsettings{'key'}){
- $fwdfwsettings{'oldrulenumber'} = $key;
+ $fwdfwsettings{'oldrulenumber'} = $fwdfwsettings{'key'};
$fwdfwsettings{'RULE_ACTION'} = $hash{$key}[0];
$fwdfwsettings{'ACTIVE'} = $hash{$key}[2];
$fwdfwsettings{'grp1'} = $hash{$key}[3];
@@ -975,24 +1139,27 @@ print <$_";
+ if($fwdfwsettings{'updatefwrule'} eq 'on'){
+ print"";
}else{
- print"";
+ if($fwdfwsettings{'POLICY'} eq 'MODE2'){
+ $fwdfwsettings{'RULE_ACTION'} = 'DROP';
+ }
+
+ if ($_ eq $fwdfwsettings{'RULE_ACTION'})
+ {
+ print"";
+ }else{
+ print"";
+ }
}
}
print"";
-
&Header::closebox();
&Header::openbox('100%', 'left', $Lang::tr{'fwdfw source'});
-
-
#------SOURCE-------------------------------------------------------
print<
@@ -1088,7 +1255,7 @@ END
$Lang::tr{'fwdfw use srcport'}
$Lang::tr{'fwdfw man port'}
-
$Lang::tr{'fwhost icmptype'}
+
$Lang::tr{'fwhost icmptype'}
+
END
&Header::closebox();
@@ -1135,6 +1303,7 @@ END
END
foreach my $network (sort keys %defaultNetworks)
{
+ next if($defaultNetworks{$network}{'NAME'} eq "IPFire");
print "";
@@ -1226,7 +1395,7 @@ END
}
print<
-
$Lang::tr{'fwhost cust srvgrp'}:
";
+ }else{
+ print "
$Lang::tr{'fwdfw rulepos'}:
";
}
print<
$Lang::tr{'fwdfw rule activate'}
$Lang::tr{'fwdfw log rule'}
-
+
END
&Header::closebox();
#---ADD TIMEFRAME-----------------------------------------------
@@ -1313,7 +1486,7 @@ END
-
+
END
@@ -1339,16 +1512,17 @@ END
}
print<
-
+
END
- &Header::closebox();
+
#---ACTION------------------------------------------------------
if($fwdfwsettings{'updatefwrule'} ne 'on'){
print<
-
+
+
END
}else{
@@ -1364,6 +1538,7 @@ END
+
END
@@ -1376,6 +1551,30 @@ sub saverule
my $config=shift;
&General::readhasharray("$config", $hash);
if (!$errormessage){
+ #check if we change an forward rule to an external access
+ if( $fwdfwsettings{'grp2'} eq 'ipfire' && $fwdfwsettings{'oldgrp2a'} ne 'ipfire' && $fwdfwsettings{'updatefwrule'} eq 'on'){
+ &changerule($configfwdfw);
+ }
+ #check if we change an forward rule to an outgoing
+ if( $fwdfwsettings{$fwdfwsettings{'grp1'}} eq 'IPFire' && $fwdfwsettings{'oldgrp1b'} ne 'IPFire' && $fwdfwsettings{'updatefwrule'} eq 'on'){
+ &changerule($configfwdfw);
+ }
+ #check if we change an external access rule to a forward
+ if( $fwdfwsettings{'grp2'} ne 'ipfire' && $fwdfwsettings{'oldgrp2a'} eq 'ipfire' && $fwdfwsettings{'updatefwrule'} eq 'on'){
+ &changerule($configinput);
+ }
+ #check if we change an external access rule to a outgoing
+ if( $fwdfwsettings{$fwdfwsettings{'grp1'}} eq 'IPFire' && $fwdfwsettings{'grp2'} ne 'ipfire' && $fwdfwsettings{'oldgrp2a'} eq 'ipfire' && $fwdfwsettings{'updatefwrule'} eq 'on'){
+ &changerule($configinput);
+ }
+ #check if we change an outgoing rule to a forward
+ if( $fwdfwsettings{$fwdfwsettings{'grp1'}} ne 'IPFire' && $fwdfwsettings{'oldgrp1b'} eq 'IPFire' && $fwdfwsettings{'grp2'} ne 'ipfire' &&$fwdfwsettings{'updatefwrule'} eq 'on'){
+ &changerule($configoutgoing);
+ }
+ #check if we change an outgoing rule to a external access
+ if( $fwdfwsettings{$fwdfwsettings{'grp1'}} ne 'IPFire' && $fwdfwsettings{'oldgrp1b'} eq 'IPFire' && $fwdfwsettings{'grp2'} eq 'ipfire' && $fwdfwsettings{'updatefwrule'} eq 'on'){
+ &changerule($configoutgoing);
+ }
if ($fwdfwsettings{'updatefwrule'} ne 'on'){
my $key = &General::findhasharraykey ($hash);
$$hash{$key}[0] = $fwdfwsettings{'RULE_ACTION'};
@@ -1443,7 +1642,7 @@ sub saverule
}
}
&General::writehasharray("$config", $hash);
- if($fwdfwsettings{'oldrulenumber'} gt $fwdfwsettings{'rulepos'}){
+ if($fwdfwsettings{'oldrulenumber'} > $fwdfwsettings{'rulepos'}){
my %tmp=();
my $val=$fwdfwsettings{'oldrulenumber'}-$fwdfwsettings{'rulepos'};
for (my $z=0;$z<$val;$z++){
@@ -1470,7 +1669,7 @@ sub saverule
}
&General::writehasharray("$config", $hash);
&rules;
- }elsif($fwdfwsettings{'rulepos'} gt $fwdfwsettings{'oldrulenumber'}){
+ }elsif($fwdfwsettings{'rulepos'} > $fwdfwsettings{'oldrulenumber'}){
my %tmp=();
my $val=$fwdfwsettings{'rulepos'}-$fwdfwsettings{'oldrulenumber'};
for (my $z=0;$z<$val;$z++){
@@ -1539,13 +1738,13 @@ sub validremark
if (length ($remark) < 1 || length ($remark) > 255) {
return 0;}
# Only valid characters are a-z, A-Z, 0-9 and -
- if ($remark !~ /^[a-zäöüA-ZÃÃÃ0-9-.:_\/\s]*$/) {
+ if ($remark !~ /^[a-zäöüA-ZÃÃÃ0-9-.:;\|_()\/\s]*$/) {
return 0;}
# First character can only be a letter or a digit
if (substr ($remark, 0, 1) !~ /^[a-zäöüA-ZÃÃÃ0-9]*$/) {
return 0;}
# Last character can only be a letter or a digit
- if (substr ($remark, -1, 1) !~ /^[a-zöäüA-ZÃÃÃ0-9.]*$/) {
+ if (substr ($remark, -1, 1) !~ /^[a-zöäüA-ZÃÃÃ0-9.:;_)]*$/) {
return 0;}
return 1;
}
@@ -1553,10 +1752,11 @@ sub getsrcport
{
my %hash=%{(shift)};
my $key=shift;
- if($hash{$key}[7] eq 'ON' && $hash{$key}[8] ne 'ICMP'){
- print" : ($hash{$key}[8]) $hash{$key}[10]";
+ if($hash{$key}[7] eq 'ON' && $hash{$key}[8] ne '' && $hash{$key}[10]){
+ $hash{$key}[10]=~ s/\|/,/g;
+ print": $hash{$key}[10]";
}elsif($hash{$key}[7] eq 'ON' && $hash{$key}[8] eq 'ICMP'){
- print" : ($hash{$key}[8]) $hash{$key}[9]";
+ print": $hash{$key}[9] ";
}
}
sub gettgtport
@@ -1565,40 +1765,64 @@ sub gettgtport
my $key=shift;
my $service;
my $prot;
-
if($hash{$key}[11] eq 'ON' && $hash{$key}[12] ne 'ICMP'){
if($hash{$key}[14] eq 'cust_srv'){
&General::readhasharray("$configsrv", \%customservice);
foreach my $i (sort keys %customservice){
- #print "HHUHU: $customservice{$i}[0] und $hash{$key}[15] ";
if($customservice{$i}[0] eq $hash{$key}[15]){
- $prot = $hash{$key}[12];
$service = $customservice{$i}[0];
}
}
}elsif($hash{$key}[14] eq 'cust_srvgrp'){
-
$service=$hash{$key}[15];
}elsif($hash{$key}[14] eq 'TGT_PORT'){
+ $hash{$key}[15]=~ s/\|/,/g;
$service=$hash{$key}[15];
- $prot=$hash{$key}[12];
+ }
+ if($service){
+ print": $service";
}
}elsif($hash{$key}[11] eq 'ON' && $hash{$key}[12] eq 'ICMP'){
- print" : ($hash{$key}[12]) $hash{$key}[13]";
+ print": $hash{$key}[13]";
}
-
- if ($prot ne '' || $service ne ''){
- print" :";
- if ($prot ne ''){
- print"($prot) ";
+}
+sub get_serviceports
+{
+ my $type=shift;
+ my $name=shift;
+ &General::readhasharray("$configsrv", \%customservice);
+ &General::readhasharray("$configsrvgrp", \%customservicegrp);
+ my $protocols;
+ my $tcp;
+ my $udp;
+ if($type eq 'service'){
+ foreach my $key (sort { uc($customservice{$a}[0]) cmp uc($customservice{$b}[0]) } keys %customservice){
+ if ($customservice{$key}[0] eq $name){
+ $protocols=$customservice{$key}[2];
+ }
+ }
+ }elsif($type eq 'group'){
+ foreach my $key (sort { uc($customservicegrp{$a}[0]) cmp uc($customservicegrp{$b}[0]) } keys %customservicegrp){
+ if ($customservicegrp{$key}[0] eq $name){
+ foreach my $key1 (sort { uc($customservice{$a}[0]) cmp uc($customservice{$b}[0]) } keys %customservice){
+ if ($customservice{$key1}[0] eq $customservicegrp{$key}[2]){
+ if($customservice{$key1}[2] eq 'TCP'){$tcp='TCP';}else{$udp='UDP';}
+ }
+ }
+ }
}
- print" $service";
}
+ if($tcp && $udp){$protocols="TCP,UDP";
+ }elsif($tcp){$protocols.="TCP";
+ }elsif($udp){$protocols.="UDP";}
+ return $protocols;
}
sub viewtablerule
{
+ &General::readhash("/var/ipfire/ethernet/settings", \%netsettings);
&viewtablenew(\%configfwdfw,$configfwdfw,$Lang::tr{'fwdfw rules'},"Forward" );
&viewtablenew(\%configinputfw,$configinput,"",$Lang::tr{'external access'} );
+ &viewtablenew(\%configoutgoingfw,$configoutgoing,"","Outgoing" );
}
sub viewtablenew
{
@@ -1606,8 +1830,12 @@ sub viewtablenew
my $config=shift;
my $title=shift;
my $title1=shift;
-
- if ( ! -z "$config"){
+ my $go='';
+ &General::get_aliases(\%aliases);
+ &General::readhasharray("$confighost", \%customhost);
+ &General::readhasharray("$config", $hash);
+ if( ! -z $config){
+ if ($title1 eq $Lang::tr{'external access'} || $title1 eq 'Outgoing'){print"
";}
&Header::openbox('100%', 'left',$title);
my $count=0;
my ($gif,$log);
@@ -1616,11 +1844,11 @@ sub viewtablenew
my $tooltip;
my @tmpsrc=();
my $coloryellow='';
- &General::readhasharray("$config", $hash);
print"$title1 ";
- print"
";
- print"
#
$Lang::tr{'fwdfw source'}
Log
$Lang::tr{'fwdfw target'}
$Lang::tr{'remark'}
$Lang::tr{'fwdfw action'}
";
+ print"
";
+ print"
#
$Lang::tr{'fwdfw source'}
Log
$Lang::tr{'fwdfw target'}
$Lang::tr{'protocol'}
$Lang::tr{'fwdfw time'}
$Lang::tr{'fwdfw action'}
";
foreach my $key (sort {$a <=> $b} keys %$hash){
+ $tdcolor='';
@tmpsrc=();
#check if vpn hosts/nets have been deleted
if($$hash{$key}[3] =~ /ipsec/i || $$hash{$key}[3] =~ /ovpn/i){
@@ -1655,8 +1883,8 @@ sub viewtablenew
$$hash{$key}[2]='';
}
}
- $$hash{$key}[3]='';
- $$hash{$key}[5]='';
+ #$$hash{$key}[3]='';
+ #$$hash{$key}[5]='';
}
$$hash{'ACTIVE'}=$$hash{$key}[2];
$count++;
@@ -1665,14 +1893,15 @@ sub viewtablenew
$coloryellow='';
}elsif($coloryellow eq ''){
if ($count % 2){
- print"
";
+ $color="$color{'color22'}";
}
else{
- print"
";
+ $color="$color{'color20'}";
}
}
+ print"
";
print<$key
+
$key
END
if ($$hash{$key}[0] eq 'ACCEPT'){
$ruletype='A';
@@ -1687,13 +1916,15 @@ END
$tooltip='REJECT';
$rulecolor=$color{'color16'};
}
- print"
";
}
- #if timeframe set, print new line in table
- if ($$hash{$key}[18] eq 'ON'){
- my @days=();
- if($$hash{$key}[19] ne ''){push (@days,$Lang::tr{'fwdfw wd_mon'});}
- if($$hash{$key}[20] ne ''){push (@days,$Lang::tr{'fwdfw wd_tue'});}
- if($$hash{$key}[21] ne ''){push (@days,$Lang::tr{'fwdfw wd_wed'});}
- if($$hash{$key}[22] ne ''){push (@days,$Lang::tr{'fwdfw wd_thu'});}
- if($$hash{$key}[23] ne ''){push (@days,$Lang::tr{'fwdfw wd_fri'});}
- if($$hash{$key}[24] ne ''){push (@days,$Lang::tr{'fwdfw wd_sat'});}
- if($$hash{$key}[25] ne ''){push (@days,$Lang::tr{'fwdfw wd_sun'});}
- my $weekdays=join(",",@days);
- if (@days){
- print"