Make firewall convert scripts more robust.

The converter scripts procude a lot of error, when they get executed on a system with
a previously installed version of the New Firewall or they get run twice.

In this case the scripts will detect that their input files are missing and will exit with
an error message. The scripts now also check if the input files are empty (no corresponding
rules created) and will exit with an nothing to do message.

diff --git a/config/firewall/convert-dmz b/config/firewall/convert-dmz
index fbcc4cf9cdc742c93efbf5755d3ffb441abaa3a4..7b7704548cbddd078d72f6f306e5cc606d516400 100755 (executable)
--- a/config/firewall/convert-dmz
+++ b/config/firewall/convert-dmz
@@ -55,6 +55,15 @@ my $field29 = 'ALL';
 my $field30 = '';
 my $field31 = 'dnat';
 
 my $field30 = '';
 my $field31 = 'dnat';
 

+if (! -e "$dmzconfig") {
+       print "DMZ config file not found. Exiting!\n";
+       exit(1);
+}
+
+if (! -s "$dmzconfig") {
+       print "Empty DMZ configuration file. Nothing to do. Exiting...\n";
+       exit(0);
+}

 
 open(FILE, $dmzconfig) or die 'Unable to open config file.';
 my @current = <FILE>;
 
 open(FILE, $dmzconfig) or die 'Unable to open config file.';
 my @current = <FILE>;

diff --git a/config/firewall/convert-outgoingfw b/config/firewall/convert-outgoingfw
index 4f8bcdc9ec061a0d3766f3b41669b67e3a2af75e..ea493752e15e3d59192b30f932598498186dbad6 100755 (executable)
--- a/config/firewall/convert-outgoingfw
+++ b/config/firewall/convert-outgoingfw
@@ -48,8 +48,8 @@ my $ccdconfig         = "${General::swroot}/ovpn/ccd.conf";
 my $fwdfwconfig                = "${General::swroot}/firewall/config";
 my $outfwconfig                = "${General::swroot}/firewall/outgoing";
 my $fwdfwsettings      = "${General::swroot}/firewall/settings";
 my $fwdfwconfig                = "${General::swroot}/firewall/config";
 my $outfwconfig                = "${General::swroot}/firewall/outgoing";
 my $fwdfwsettings      = "${General::swroot}/firewall/settings";

-my @ipgroups = qx(ls $ipgrouppath);
-my @macgroups = qx(ls $macgrouppath);
+my @ipgroups = qx(ls $ipgrouppath 2>/dev/null);
+my @macgroups = qx(ls $macgrouppath 2>/dev/null);

 my @hostarray=();
 my %outsettings=();
 my %hosts=();
 my @hostarray=();
 my %outsettings=();
 my %hosts=();


@@ -65,16 +65,36 @@ my %ownnet=();
 my %ovpnSettings = ();
 my @active= ('Aktiv', 'aktiv', 'Active', 'Activo', 'Actif', 'Actief', 'Aktywne', 'Активен', 'Aktif');
 &General::readhash("${General::swroot}/ovpn/settings", \%ovpnSettings);
 my %ovpnSettings = ();
 my @active= ('Aktiv', 'aktiv', 'Active', 'Activo', 'Actif', 'Actief', 'Aktywne', 'Активен', 'Aktif');
 &General::readhash("${General::swroot}/ovpn/settings", \%ovpnSettings);

-&General::readhash($outfwsettings,\%outsettings);

 &General::readhash("${General::swroot}/ethernet/settings", \%ownnet);
 
 &General::readhash("${General::swroot}/ethernet/settings", \%ownnet);
 

+if (-e "$outfwsettings") {
+       &General::readhash($outfwsettings,\%outsettings);
+}
+else
+{
+       print "Config file for outgoing-firewall not found. Exiting!\n";
+       exit(1);
+}
+
+if (! -s "$outfwsettings") {
+        print "Empty DMZ configuration file. Nothing to do. Exiting...\n";
+        exit(0);
+}
+

 #ONLY RUN if /var/ipfire/outgoing exists
 if ( -d "/var/ipfire/outgoing"){
        &process_groups;
        &process_rules;
        &process_p2p;
 }
 #ONLY RUN if /var/ipfire/outgoing exists
 if ( -d "/var/ipfire/outgoing"){
        &process_groups;
        &process_rules;
        &process_p2p;
 }

+else
+{
+       print "/var/ipfire/outgoing not found. Exiting!\n";
+       exit 1
+}
+

 system("/usr/local/bin/firewallctrl");
 system("/usr/local/bin/firewallctrl");

+

 sub process_groups
 {
        if(! -d "/var/log/converters"){ mkdir("/var/log/converters");}
 sub process_groups
 {
        if(! -d "/var/log/converters"){ mkdir("/var/log/converters");}


@@ -111,7 +131,7 @@ sub process_groups
        foreach my $group (@macgroups){
                chomp $group;
                print LOG "\nProcessing MAC-GROUP: $group...\n";
        foreach my $group (@macgroups){
                chomp $group;
                print LOG "\nProcessing MAC-GROUP: $group...\n";

-               open (DATEI, "<$macgrouppath/$group");
+               open (DATEI, "<$macgrouppath/$group") or die 'Unable to open config file.';

                my @zeilen = <DATEI>;
                foreach my $mac (@zeilen){
                        chomp($mac);
                my @zeilen = <DATEI>;
                foreach my $mac (@zeilen){
                        chomp($mac);

diff --git a/config/firewall/convert-portfw b/config/firewall/convert-portfw
index 447ef90a760784689fb142ed8835f1957f01450e..fedddeeb3d5c5fccd7dd19229e85d31a8fbdcb6e 100755 (executable)
--- a/config/firewall/convert-portfw
+++ b/config/firewall/convert-portfw
@@ -36,6 +36,17 @@ my ($key,$flag,$prot,$ipfireport,$target,$targetport,$active,$alias,$source,$rem
 my ($key1,$flag1,$prot1,$ipfireport1,$target1,$targetport1,$active1,$alias1,$source1,$remark1);
 my $count=0;
 my $jump;
 my ($key1,$flag1,$prot1,$ipfireport1,$target1,$targetport1,$active1,$alias1,$source1,$remark1);
 my $count=0;
 my $jump;

+
+if (! -e "$portfwconfig") {
+        print "Config file for portforward not found. Exiting!\n";
+        exit(1);
+}
+
+if (! -s "$portfwconfig") {
+        print "Empty portforward configuration file. Nothing to do. Exiting...\n";
+        exit(0);
+}
+

 if(! -d "/var/log/converters"){ mkdir("/var/log/converters");}
 open(FILE, $portfwconfig) or die 'Unable to open config file.';
 my @current = <FILE>;
 if(! -d "/var/log/converters"){ mkdir("/var/log/converters");}
 open(FILE, $portfwconfig) or die 'Unable to open config file.';
 my @current = <FILE>;

diff --git a/config/firewall/convert-xtaccess b/config/firewall/convert-xtaccess
index 363af7af737867df9b4417646973eee57a9b9ac9..d11e09c7c6622fa7d982ba6b2aca625a67eaa61f 100755 (executable)
--- a/config/firewall/convert-xtaccess
+++ b/config/firewall/convert-xtaccess
@@ -49,6 +49,17 @@ my $field28 = '';
 my $field29 = 'ALL';
 my $field30 = '';
 my $field31 = 'dnat';
 my $field29 = 'ALL';
 my $field30 = '';
 my $field31 = 'dnat';

+
+if (! -e "$xtaccessconfig") {
+        print "Config file for external access not found. Exiting!\n";
+        exit(1);
+}
+
+if (! -s "$xtaccessconfig") {
+        print "Empty external access configuration file. Nothing to do. Exiting...\n";
+        exit(0);
+}
+

 open(FILE, $xtaccessconfig) or die 'Unable to open config file.';
 my @current = <FILE>;
 close(FILE);
 open(FILE, $xtaccessconfig) or die 'Unable to open config file.';
 my @current = <FILE>;
 close(FILE);