| $Lang::tr{'fwdfw sourceip'} |
|
- | $Lang::tr{'fwhost stdnet'} | | | $Lang::tr{'fwhost ccdnet'} | |
- | $Lang::tr{'fwhost cust net'} | | | $Lang::tr{'fwhost ccdhost'} | |
- | $Lang::tr{'fwhost cust addr'} | | | $Lang::tr{'fwhost ovpn_n2n'} | |
-
- | $Lang::tr{'fwhost cust grp'} | |
- | $Lang::tr{'fwhost ipsec net'} | |
+
END
-
-# | $Lang::tr{'fwhost ipsec host'} | |
+
|
END
-
-# | $Lang::tr{'fwhost ipsec host'} | |
-
|
-
+
END
- &Header::closebox();
#---ACTION------------------------------------------------------
if($fwdfwsettings{'updatefwrule'} ne 'on'){
print<
|
- |
+
+
END
}else{
@@ -1344,22 +1721,152 @@ END
-
+
+
+
+
END
}
&Header::closebox();
}
+sub pos_up
+{
+ my %uphash=();
+ my %tmp=();
+ &General::readhasharray($fwdfwsettings{'config'}, \%uphash);
+ foreach my $key (sort keys %uphash){
+ if ($key eq $fwdfwsettings{'key'}) {
+ my $last = $key -1;
+ if (exists $uphash{$last}){
+ #save rule last
+ foreach my $y (0 .. $#{$uphash{$last}}) {
+ $tmp{0}[$y] = $uphash{$last}[$y];
+ }
+ #copy active rule to last
+ foreach my $i (0 .. $#{$uphash{$last}}) {
+ $uphash{$last}[$i] = $uphash{$key}[$i];
+ }
+ #copy saved rule to actual position
+ foreach my $x (0 .. $#{$tmp{0}}) {
+ $uphash{$key}[$x] = $tmp{0}[$x];
+ }
+ }
+ }
+ }
+ &General::writehasharray($fwdfwsettings{'config'}, \%uphash);
+ &rules;
+}
+sub pos_down
+{
+ my %downhash=();
+ my %tmp=();
+ &General::readhasharray($fwdfwsettings{'config'}, \%downhash);
+ foreach my $key (sort keys %downhash){
+ if ($key eq $fwdfwsettings{'key'}) {
+ my $next = $key + 1;
+ if (exists $downhash{$next}){
+ #save rule next
+ foreach my $y (0 .. $#{$downhash{$next}}) {
+ $tmp{0}[$y] = $downhash{$next}[$y];
+ }
+ #copy active rule to next
+ foreach my $i (0 .. $#{$downhash{$next}}) {
+ $downhash{$next}[$i] = $downhash{$key}[$i];
+ }
+ #copy saved rule to actual position
+ foreach my $x (0 .. $#{$tmp{0}}) {
+ $downhash{$key}[$x] = $tmp{0}[$x];
+ }
+ }
+ }
+ }
+ &General::writehasharray($fwdfwsettings{'config'}, \%downhash);
+ &rules;
+}
+sub rules
+{
+ if (!-f "${General::swroot}/forward/reread"){
+ system("touch ${General::swroot}/forward/reread");
+ system("touch ${General::swroot}/fwhosts/reread");
+ }
+}
+sub reread_rules
+{
+ system("/usr/local/bin/forwardfwctrl");
+ if ( -f "${General::swroot}/forward/reread"){
+ system("rm ${General::swroot}/forward/reread");
+ system("rm ${General::swroot}/fwhosts/reread");
+ }
+}
sub saverule
{
-
my $hash=shift;
my $config=shift;
&General::readhasharray("$config", $hash);
if (!$errormessage){
- if ($fwdfwsettings{'updatefwrule'} ne 'on' ){
+ #check if we change a DMZ to an outgoing
+ if( ($fwdfwsettings{'oldgrp1b'} eq 'ORANGE' || $fwdfwsettings{'oldorange'} eq 'on') && $fwdfwsettings{$fwdfwsettings{'grp1'}} eq 'IPFire' && $fwdfwsettings{'updatefwrule'} eq 'on'){
+ &changerule($configdmz);
+ #print"1";
+ }
+ #check if we change a DMZ to an external access
+ elsif( $fwdfwsettings{'oldgrp1b'} eq 'ORANGE' && $fwdfwsettings{$fwdfwsettings{'grp1'}} ne 'ORANGE' && $fwdfwsettings{'grp2'} eq 'ipfire' && $fwdfwsettings{'updatefwrule'} eq 'on'){
+ &changerule($configdmz);
+ #print"2";
+ }
+ #check if we change an external access rule to a outgoing
+ elsif( $fwdfwsettings{$fwdfwsettings{'grp1'}} eq 'IPFire' && $fwdfwsettings{'oldgrp1b'} ne 'IPFire' && $fwdfwsettings{'grp2'} ne 'ipfire' && $fwdfwsettings{'oldgrp2a'} eq 'ipfire' && $fwdfwsettings{'updatefwrule'} eq 'on'){
+ &changerule($configinput);
+ #print"3";
+ }
+ #check if we change an external access rule to a DMZ
+ elsif( $fwdfwsettings{$fwdfwsettings{'grp1'}} eq 'ORANGE' && $fwdfwsettings{'grp2'} ne 'ipfire' && $fwdfwsettings{'oldgrp2a'} eq 'ipfire' && $fwdfwsettings{'updatefwrule'} eq 'on'){
+ &changerule($configinput);
+ #print"4";
+ }
+ #check if we change an outgoing rule to a external access
+ if( $fwdfwsettings{$fwdfwsettings{'grp1'}} ne 'IPFire' && $fwdfwsettings{'oldgrp1b'} eq 'IPFire' && $fwdfwsettings{'grp2'} eq 'ipfire' && $fwdfwsettings{'oldgrp2a'} ne 'ipfire' && $fwdfwsettings{'updatefwrule'} eq 'on'){
+ &changerule($configoutgoing);
+ #print"5";
+ }
+ #check if we change an outgoing rule to a DMZ
+ if( ($fwdfwsettings{$fwdfwsettings{'grp1'}} eq 'ORANGE' || $checkorange eq 'on') && $fwdfwsettings{'oldgrp1b'} eq 'IPFire' && $fwdfwsettings{'updatefwrule'} eq 'on'){
+ &changerule($configoutgoing);
+ #print"6";
+ }
+ #check if we change an forward rule to an external access
+ elsif( $fwdfwsettings{'grp2'} eq 'ipfire' && $fwdfwsettings{'oldgrp2a'} ne 'ipfire' && $fwdfwsettings{'updatefwrule'} eq 'on'){
+ &changerule($configfwdfw);
+ #print"7";
+ }
+ #check if we change an forward rule to an DMZ
+ if( ($fwdfwsettings{$fwdfwsettings{'grp1'}} eq 'ORANGE' || $checkorange eq 'on') && ($fwdfwsettings{'oldgrp1b'} ne 'ORANGE' && $fwdfwsettings{'oldorange'} ne 'on') && $fwdfwsettings{'updatefwrule'} eq 'on'){
+ &changerule($configfwdfw);
+ #print"8";
+ }
+ #check if we change an forward rule to an outgoing
+ elsif( $fwdfwsettings{$fwdfwsettings{'grp1'}} eq 'IPFire' && $fwdfwsettings{'oldgrp1b'} ne 'IPFire' && $fwdfwsettings{'updatefwrule'} eq 'on'){
+ &changerule($configfwdfw);
+ #print"9";
+ }
+ #check if we change a DMZ to a forward
+ elsif( ($fwdfwsettings{'oldgrp1b'} eq 'ORANGE' || $fwdfwsettings{'oldorange'} eq 'on') && ($fwdfwsettings{$fwdfwsettings{'grp1'}} ne 'ORANGE' && $checkorange ne 'on') && $fwdfwsettings{'updatefwrule'} eq 'on'){
+ &changerule($configdmz);
+ #print"10";
+ }
+ #check if we change an external access rule to a forward
+ elsif( $fwdfwsettings{'grp2'} ne 'ipfire' && $fwdfwsettings{'oldgrp2a'} eq 'ipfire' && $fwdfwsettings{'updatefwrule'} eq 'on'){
+ &changerule($configinput);
+ #print"11";
+ }
+ #check if we change an outgoing rule to a forward
+ elsif( $fwdfwsettings{$fwdfwsettings{'grp1'}} ne 'IPFire' && $fwdfwsettings{'oldgrp1b'} eq 'IPFire' && $fwdfwsettings{'grp2'} ne 'ipfire' && $fwdfwsettings{'updatefwrule'} eq 'on'){
+ &changerule($configoutgoing);
+ #print"12";
+ }
+ if ($fwdfwsettings{'updatefwrule'} ne 'on'){
my $key = &General::findhasharraykey ($hash);
$$hash{$key}[0] = $fwdfwsettings{'RULE_ACTION'};
$$hash{$key}[1] = $fwdfwsettings{'chain'};
@@ -1391,7 +1898,7 @@ sub saverule
$$hash{$key}[27] = $fwdfwsettings{'TIME_TO'};
&General::writehasharray("$config", $hash);
}else{
- foreach my $key (sort keys %$hash){
+ foreach my $key (sort {$a <=> $b} keys %$hash){
if($key eq $fwdfwsettings{'key'}){
$$hash{$key}[0] = $fwdfwsettings{'RULE_ACTION'};
$$hash{$key}[1] = $fwdfwsettings{'chain'};
@@ -1424,39 +1931,65 @@ sub saverule
last;
}
}
+ }
+ &General::writehasharray("$config", $hash);
+ if($fwdfwsettings{'oldrulenumber'} > $fwdfwsettings{'rulepos'}){
+ my %tmp=();
+ my $val=$fwdfwsettings{'oldrulenumber'}-$fwdfwsettings{'rulepos'};
+ for (my $z=0;$z<$val;$z++){
+ foreach my $key (sort {$a <=> $b} keys %$hash){
+ if ($key eq $fwdfwsettings{'oldrulenumber'}) {
+ my $last = $key -1;
+ if (exists $$hash{$last}){
+ #save rule last
+ foreach my $y (0 .. $#{$$hash{$last}}) {
+ $tmp{0}[$y] = $$hash{$last}[$y];
+ }
+ #copy active rule to last
+ foreach my $i (0 .. $#{$$hash{$last}}) {
+ $$hash{$last}[$i] = $$hash{$key}[$i];
+ }
+ #copy saved rule to actual position
+ foreach my $x (0 .. $#{$tmp{0}}) {
+ $$hash{$key}[$x] = $tmp{0}[$x];
+ }
+ }
+ }
+ }
+ $fwdfwsettings{'oldrulenumber'}--;
+ }
+ &General::writehasharray("$config", $hash);
+ &rules;
+ }elsif($fwdfwsettings{'rulepos'} > $fwdfwsettings{'oldrulenumber'}){
+ my %tmp=();
+ my $val=$fwdfwsettings{'rulepos'}-$fwdfwsettings{'oldrulenumber'};
+ for (my $z=0;$z<$val;$z++){
+ foreach my $key (sort {$a <=> $b} keys %$hash){
+ if ($key eq $fwdfwsettings{'oldrulenumber'}) {
+ my $next = $key + 1;
+ if (exists $$hash{$next}){
+ #save rule next
+ foreach my $y (0 .. $#{$$hash{$next}}) {
+ $tmp{0}[$y] = $$hash{$next}[$y];
+ }
+ #copy active rule to next
+ foreach my $i (0 .. $#{$$hash{$next}}) {
+ $$hash{$next}[$i] = $$hash{$key}[$i];
+ }
+ #copy saved rule to actual position
+ foreach my $x (0 .. $#{$tmp{0}}) {
+ $$hash{$key}[$x] = $tmp{0}[$x];
+ }
+ }
+ }
+ }
+ $fwdfwsettings{'oldrulenumber'}++;
+ }
&General::writehasharray("$config", $hash);
+ &rules;
}
}
}
-sub error
-{
- if ($errormessage) {
- &Header::openbox('100%', 'left', $Lang::tr{'error messages'});
- print "$errormessage\n";
- print " \n";
- &Header::closebox();
- print"
";
- }
-}
-sub hint
-{
- if ($hint) {
- &Header::openbox('100%', 'left', $Lang::tr{'fwhost hint'});
- print "$hint\n";
- print " \n";
- &Header::closebox();
- print"
";
- }
-}
-sub get_name
-{
- my $val=shift;
- &General::setup_default_networks(\%defaultNetworks);
- foreach my $network (sort keys %defaultNetworks)
- {
- return "$network" if ($val eq $defaultNetworks{$network}{'NAME'});
- }
-}
sub validremark
{
# Checks a hostname against RFC1035
@@ -1467,66 +2000,23 @@ sub validremark
if (length ($remark) < 1 || length ($remark) > 255) {
return 0;}
# Only valid characters are a-z, A-Z, 0-9 and -
- if ($remark !~ /^[a-zäöüA-ZÃÃÃ0-9-\s]*$/) {
+ if ($remark !~ /^[a-zäöüA-ZÃÃÃ0-9-.:;\|_()\/\s]*$/) {
return 0;}
# First character can only be a letter or a digit
if (substr ($remark, 0, 1) !~ /^[a-zäöüA-ZÃÃÃ0-9]*$/) {
return 0;}
# Last character can only be a letter or a digit
- if (substr ($remark, -1, 1) !~ /^[a-zöäüA-ZÃÃÃ0-9]*$/) {
+ if (substr ($remark, -1, 1) !~ /^[a-zöäüA-ZÃÃÃ0-9.:;_)]*$/) {
return 0;}
return 1;
}
-sub getsrcport
-{
- my %hash=%{(shift)};
- my $key=shift;
- if($hash{$key}[7] eq 'ON' && $hash{$key}[8] ne 'ICMP'){
- print" : ($hash{$key}[8]) $hash{$key}[10]";
- }elsif($hash{$key}[7] eq 'ON' && $hash{$key}[8] eq 'ICMP'){
- print" : ($hash{$key}[8])
$hash{$key}[9]";
- }
-}
-sub gettgtport
-{
- my %hash=%{(shift)};
- my $key=shift;
- my $service;
- my $prot;
-
- if($hash{$key}[11] eq 'ON' && $hash{$key}[12] ne 'ICMP'){
- if($hash{$key}[14] eq 'cust_srv'){
- &General::readhasharray("$configsrv", \%customservice);
- foreach my $i (sort keys %customservice){
- #print "HHUHU: $customservice{$i}[0] und $hash{$key}[15]
";
- if($customservice{$i}[0] eq $hash{$key}[15]){
- $prot = $hash{$key}[12];
- $service = $customservice{$i}[0];
- }
- }
- }elsif($hash{$key}[14] eq 'cust_srvgrp'){
-
- $service=$hash{$key}[15];
- }elsif($hash{$key}[14] eq 'TGT_PORT'){
- $service=$hash{$key}[15];
- $prot=$hash{$key}[12];
- }
- }elsif($hash{$key}[11] eq 'ON' && $hash{$key}[12] eq 'ICMP'){
- print" : ($hash{$key}[12])
$hash{$key}[13]";
- }
-
- if ($prot ne '' || $service ne ''){
- print" :";
- if ($prot ne ''){
- print"($prot) ";
- }
- print" $service";
- }
-}
sub viewtablerule
{
- &viewtablenew(\%configfwdfw,$configfwdfw,$Lang::tr{'fwdfw rules'},"Forward" );
+ &General::readhash("/var/ipfire/ethernet/settings", \%netsettings);
+ &viewtablenew(\%configdmzfw,$configdmz,$Lang::tr{'fwdfw rules'},"DMZ" );
+ &viewtablenew(\%configfwdfw,$configfwdfw,"","Forward" );
&viewtablenew(\%configinputfw,$configinput,"",$Lang::tr{'external access'} );
+ &viewtablenew(\%configoutgoingfw,$configoutgoing,"","Outgoing" );
}
sub viewtablenew
{
@@ -1534,8 +2024,11 @@ sub viewtablenew
my $config=shift;
my $title=shift;
my $title1=shift;
-
- if ( ! -z "$config"){
+ my $go='';
+ &General::get_aliases(\%aliases);
+ &General::readhasharray("$confighost", \%customhost);
+ &General::readhasharray("$config", $hash);
+ if( ! -z $config){
&Header::openbox('100%', 'left',$title);
my $count=0;
my ($gif,$log);
@@ -1544,11 +2037,11 @@ sub viewtablenew
my $tooltip;
my @tmpsrc=();
my $coloryellow='';
- &General::readhasharray("$config", $hash);
print"$title1
";
- print"";
- print"| # | | $Lang::tr{'fwdfw source'} | Log | $Lang::tr{'fwdfw target'} | $Lang::tr{'remark'} | $Lang::tr{'fwdfw action'} |
";
- foreach my $key (sort keys %$hash){
+ print"";
+ print"| # | | $Lang::tr{'fwdfw source'} | Log | $Lang::tr{'fwdfw target'} | $Lang::tr{'protocol'} | $Lang::tr{'fwdfw time'} | $Lang::tr{'fwdfw action'} |
";
+ foreach my $key (sort {$a <=> $b} keys %$hash){
+ $tdcolor='';
@tmpsrc=();
#check if vpn hosts/nets have been deleted
if($$hash{$key}[3] =~ /ipsec/i || $$hash{$key}[3] =~ /ovpn/i){
@@ -1557,14 +2050,12 @@ sub viewtablenew
if($$hash{$key}[5] =~ /ipsec/i || $$hash{$key}[5] =~ /ovpn/i){
push (@tmpsrc,$$hash{$key}[6]);
}
-
foreach my $host (@tmpsrc){
if($$hash{$key}[3] eq 'ipsec_net_src' || $$hash{$key}[5] eq 'ipsec_net_tgt'){
- if(&fwlib::get_ipsec_net_ip($host,11) eq ''){
+ if(&fwlib::get_ipsec_net_ip($host,11) eq ''){
$coloryellow='on';
&disable_rule($key);
$$hash{$key}[2]='';
-
}
}elsif($$hash{$key}[3] eq 'ovpn_net_src' || $$hash{$key}[5] eq 'ovpn_net_tgt'){
if(&fwlib::get_ovpn_net_ip($host,1) eq ''){
@@ -1585,27 +2076,23 @@ sub viewtablenew
$$hash{$key}[2]='';
}
}
- $$hash{$key}[3]='';
- $$hash{$key}[5]='';
}
-
$$hash{'ACTIVE'}=$$hash{$key}[2];
$count++;
-
if($coloryellow eq 'on'){
print"";
$coloryellow='';
}elsif($coloryellow eq ''){
if ($count % 2){
- print"
";
+ $color="$color{'color22'}";
}
else{
- print"
";
+ $color="$color{'color20'}";
}
}
-
+ print"
";
print<$key
+ | $key |
END
if ($$hash{$key}[0] eq 'ACCEPT'){
$ruletype='A';
@@ -1620,13 +2107,15 @@ END
$tooltip='REJECT';
$rulecolor=$color{'color16'};
}
- print"$ruletype | ";
- print"";
+ print" | $ruletype | ";
+ &getcolor($$hash{$key}[3],$$hash{$key}[4],\%customhost);
+ print"";
if ($$hash{$key}[3] eq 'std_net_src'){
print &get_name($$hash{$key}[4]);
}else{
print $$hash{$key}[4];
}
+ $tdcolor='';
&getsrcport(\%$hash,$key);
if ($$hash{$key}[17] eq 'ON'){
$log="/images/on.gif";
@@ -1635,59 +2124,84 @@ END
}
print<
-
END
-
+ &getcolor($$hash{$key}[5],$$hash{$key}[6],\%customhost);
print<
+ |
END
if ($$hash{$key}[5] eq 'std_net_tgt'){
print &get_name($$hash{$key}[6]);
}else{
print $$hash{$key}[6];
}
+ $tdcolor='';
&gettgtport(\%$hash,$key);
- ################################################################################
- print" | $$hash{$key}[16] | ";
-
+ print" | ";
+ #Get Protocol
+ my $prot;
+ if ($$hash{$key}[12]){ #target prot if manual
+ push (@protocols,$$hash{$key}[12]);
+ }elsif($$hash{$key}[8]){ #source prot if manual
+ push (@protocols,$$hash{$key}[8]);
+ }elsif($$hash{$key}[14] eq 'cust_srv'){
+ &get_serviceports("service",$$hash{$key}[15]);
+ }elsif($$hash{$key}[14] eq 'cust_srvgrp'){
+ &get_serviceports("group",$$hash{$key}[15]);
+ }else{
+ push (@protocols,$Lang::tr{'all'});
+ }
+ my $protz=join(",",@protocols);
+ print"$protz | ";
+ @protocols=();
+ if ($$hash{$key}[18] eq 'ON'){
+ my @days=();
+ if($$hash{$key}[19] ne ''){push (@days,$Lang::tr{'fwdfw wd_mon'});}
+ if($$hash{$key}[20] ne ''){push (@days,$Lang::tr{'fwdfw wd_tue'});}
+ if($$hash{$key}[21] ne ''){push (@days,$Lang::tr{'fwdfw wd_wed'});}
+ if($$hash{$key}[22] ne ''){push (@days,$Lang::tr{'fwdfw wd_thu'});}
+ if($$hash{$key}[23] ne ''){push (@days,$Lang::tr{'fwdfw wd_fri'});}
+ if($$hash{$key}[24] ne ''){push (@days,$Lang::tr{'fwdfw wd_sat'});}
+ if($$hash{$key}[25] ne ''){push (@days,$Lang::tr{'fwdfw wd_sun'});}
+ my $weekdays=join(",",@days);
+ if (@days){
+ print"$weekdays $$hash{$key}[26] - $$hash{$key}[27] | ";
+ }
+ }else{
+ print"24/7 | ";
+ }
if($$hash{$key}[2] eq 'ON'){
$gif="/images/on.gif"
}else{
$gif="/images/off.gif"
-
}
print<
-
+ |
|
-
-
-
-
END
}else{
- print" | ";
+ print" | ";
}
- #if timeframe set, print new line in table
- if ($$hash{$key}[18] eq 'ON'){
- my @days=();
- if($$hash{$key}[19] ne ''){push (@days,$Lang::tr{'fwdfw wd_mon'});}
- if($$hash{$key}[20] ne ''){push (@days,$Lang::tr{'fwdfw wd_tue'});}
- if($$hash{$key}[21] ne ''){push (@days,$Lang::tr{'fwdfw wd_wed'});}
- if($$hash{$key}[22] ne ''){push (@days,$Lang::tr{'fwdfw wd_thu'});}
- if($$hash{$key}[23] ne ''){push (@days,$Lang::tr{'fwdfw wd_fri'});}
- if($$hash{$key}[24] ne ''){push (@days,$Lang::tr{'fwdfw wd_sat'});}
- if($$hash{$key}[25] ne ''){push (@days,$Lang::tr{'fwdfw wd_sun'});}
-
- my $weekdays=join(",",@days);
-
- if (@days){
- print"| $Lang::tr{'fwdfw time'} ";
- print"$weekdays";
- print " $Lang::tr{'fwdfw from'} $$hash{$key}[26] $Lang::tr{'fwdfw till'} $$hash{$key}[27] | |
";
- }
+ #REMARK
+ if ($optionsfw{'SHOWREMARK'} eq 'on'){
+ print"";
+ print"| | | $$hash{$key}[16] |
";
}
+ print" | | |
";
}
print"
";
&Header::closebox();
- }
-
-}
-sub fillselect
-{
- my %hash=%{(shift)};
- my $val=shift;
- my $key;
- foreach my $key (sort { uc($hash{$a}[0]) cmp uc($hash{$b}[0]) } keys %hash)
- {
- if($hash{$key}[0] eq $val){
- print"";
- }else{
- print"";
- }
+ print "
";
+ print "
";
+ }else{
+ if ($optionsfw{'SHOWTABLES'} eq 'on'){
+ print "$title1
";
+ print"| $Lang::tr{'fwhost empty'} |
";
}
-}
-sub rules
-{
- if (!-f "${General::swroot}/forward/reread"){
- system("touch ${General::swroot}/forward/reread");
}
}
-sub reread_rules
-{
- system("/usr/local/bin/forwardfwctrl");
- system("rm ${General::swroot}/forward/reread");
-}
+
+
&Header::closebigbox();
&Header::closepage();