diff --git a/config/forwardfw/rules.pl b/config/forwardfw/rules.pl index 1ac1bb345..152558b64 100755 --- a/config/forwardfw/rules.pl +++ b/config/forwardfw/rules.pl @@ -24,7 +24,6 @@ # This script builds firewallrules from the webinterface # ############################################################################### - use strict; no warnings 'uninitialized'; @@ -45,12 +44,14 @@ my @timeframe=(); my %configinputfw=(); my %aliases=(); my @DPROT=(); +my @p2ps=(); require '/var/ipfire/general-functions.pl'; require "${General::swroot}/lang.pl"; require "${General::swroot}/forward/bin/firewall-lib.pl"; my $configfwdfw = "${General::swroot}/forward/config"; my $configinput = "${General::swroot}/forward/input"; +my $p2pfile = "${General::swroot}/forward/p2protocols"; my $configgrp = "${General::swroot}/fwhosts/customgroups"; my $errormessage=''; my ($TYPE,$PROT,$SPROT,$DPROT,$SPORT,$DPORT,$TIME,$TIMEFROM,$TIMETILL,$SRC_TGT); @@ -106,6 +107,7 @@ sub preparerules { if (! -z "${General::swroot}/forward/config"){ &buildrules(\%configfwdfw); + &p2pblock; } if (! -z "${General::swroot}/forward/input"){ &buildrules(\%configinputfw); @@ -163,7 +165,6 @@ sub buildrules if ($DPROT eq ''){$DPROT=' ';} @DPROT=split(",",$DPROT); - #get time if defined if($$hash{$key}[18] eq 'ON'){ if($$hash{$key}[19] ne ''){push (@timeframe,"Mon");} @@ -178,7 +179,6 @@ sub buildrules $TIMETILL="--timestop $$hash{$key}[27] "; $TIME="-m time --weekdays $TIME $TIMEFROM $TIMETILL"; } - if ($MODE eq '1'){ print "NR:$key "; foreach my $i (0 .. $#{$$hash{$key}}){ @@ -235,6 +235,39 @@ sub buildrules undef $TIMETILL; } } +sub p2pblock +{ + my $P2PSTRING; + my $DO; + open( FILE, "< $p2pfile" ) or die "Unable to read $p2pfile"; + @p2ps = ; + close FILE; + my $CMD = "-m ipp2p"; + foreach my $p2pentry (sort @p2ps) { + my @p2pline = split( /\;/, $p2pentry ); + if ( $fwdfwsettings{'POLICY'} eq 'MODE2' ) { + $DO = "DROP"; + if ("$p2pline[2]" eq "off") { + $P2PSTRING = "$P2PSTRING --$p2pline[1]"; + } + } else { + $DO = "RETURN"; + if ("$p2pline[2]" eq "on") { + $P2PSTRING = "$P2PSTRING --$p2pline[1]"; + } + } + } + if ($MODE eq 1){ + if($P2PSTRING){ + print"/sbin/iptables -A FORWARDFW $CMD $P2PSTRING -j $DO\n"; + } + }else{ + if($P2PSTRING){ + system("/sbin/iptables -A FORWARDFW $CMD $P2PSTRING -j $DO"); + } + } +} + sub get_address { my $base=shift; #source of checking ($configfwdfw{$key}[x] or groupkey @@ -336,8 +369,6 @@ sub get_port elsif($prot eq 'ICMP'){ return &fwlib::get_srvgrp_port($$hash{$key}[15],$prot); } - - } } } diff --git a/html/cgi-bin/forwardfw.cgi b/html/cgi-bin/forwardfw.cgi index 37ba41d0b..8d70bfb3e 100755 --- a/html/cgi-bin/forwardfw.cgi +++ b/html/cgi-bin/forwardfw.cgi @@ -68,6 +68,7 @@ my %icmptypes=(); my %ovpnsettings=(); my %ipsecsettings=(); my %aliases=(); +my @p2ps = (); my $color; my $confignet = "${General::swroot}/fwhosts/customnetworks"; my $confighost = "${General::swroot}/fwhosts/customhosts"; @@ -81,7 +82,7 @@ my $configipsecrw = "${General::swroot}/vpn/settings"; my $configfwdfw = "${General::swroot}/forward/config"; my $configinput = "${General::swroot}/forward/input"; my $configovpn = "${General::swroot}/ovpn/settings"; - +my $p2pfile = "${General::swroot}/forward/p2protocols"; my $errormessage=''; my $hint=''; my $ipgrp="${General::swroot}/outgoing/groups"; @@ -345,6 +346,29 @@ if ($fwdfwsettings{'ACTION'} eq 'copyrule') #$fwdfwsettings{'updatefwrule'}='on'; &newrule; } +if ($fwdfwsettings{'ACTION'} eq 'togglep2p') +{ + #$errormessage="Toggle $fwdfwsettings{'P2PROT'}
"; + open( FILE, "< $p2pfile" ) or die "Unable to read $p2pfile"; + @p2ps = ; + close FILE; + open( FILE, "> $p2pfile" ) or die "Unable to write $p2pfile"; + foreach my $p2pentry (sort @p2ps) + { + my @p2pline = split( /\;/, $p2pentry ); + if ($p2pline[1] eq $fwdfwsettings{'P2PROT'}) { + if($p2pline[2] eq 'on'){ + $p2pline[2]='off'; + }else{ + $p2pline[2]='on'; + } + } + print FILE "$p2pline[0];$p2pline[1];$p2pline[2];\n"; + } + close FILE; + &rules; + &base; +} if ($fwdfwsettings{'ACTION'} eq '') { &base; @@ -481,6 +505,9 @@ sub base #print"$_"; #} #print""; + if ($fwdfwsettings{'POLICY'} eq 'MODE1' || $fwdfwsettings{'POLICY'} eq 'MODE2' ) { + &p2pblock; + } &Header::openbox('100%', 'center', 'Policy'); print < @@ -490,13 +517,13 @@ print <$Lang::tr{'mode'} 2:$Lang::tr{'outgoing firewall mode2'}
- - + + END if ($fwdfwsettings{'POLICY'} ne 'MODE0'&& $fwdfwsettings{'POLICY'} ne '' ) { print "$Lang::tr{'outgoing firewall reset'}: "; } -print ""; + print ""; &Header::closebox(); } sub addrule @@ -564,7 +591,7 @@ sub disable_rule sub checksource { my ($ip,$subnet); - + #check ip-address if manual if ($fwdfwsettings{'src_addr'} eq $fwdfwsettings{$fwdfwsettings{'grp1'}} && $fwdfwsettings{'src_addr'} ne ''){ #check if ip with subnet @@ -579,7 +606,7 @@ sub checksource $subnet = '32'; $fwdfwsettings{'isip'}='on'; } - + if ($fwdfwsettings{'isip'} ne 'on'){ if (&General::validmac($fwdfwsettings{'src_addr'})){$fwdfwsettings{'ismac'}='on';} } @@ -594,7 +621,7 @@ sub checksource $errormessage=$Lang::tr{'fwhost err hostip'}."
"; } $fwdfwsettings{'src_addr'}="$ip/$subnet"; - + if(!&General::validipandmask($fwdfwsettings{'src_addr'})){ $errormessage.=$Lang::tr{'fwdfw err src_addr'}."
"; } @@ -671,7 +698,7 @@ sub checktarget #check and form valid IP $ip=&General::ip2dec($ip); $ip=&General::dec2ip($ip); - + #check if net or broadcast my @tmp= split (/\./,$ip); if (($tmp[3] eq "0") || ($tmp[3] eq "255")) @@ -994,11 +1021,9 @@ END } print"
"; - &Header::closebox(); &Header::openbox('100%', 'left', $Lang::tr{'fwdfw source'}); - #------SOURCE------------------------------------------------------- print< @@ -1806,6 +1831,35 @@ END &Header::closebox(); } } +sub p2pblock +{ + my $gif; + open( FILE, "< $p2pfile" ) or die "Unable to read $p2pfile"; + @p2ps = ; + close FILE; + &Header::openbox('100%', 'center', 'P2P-Block'); + print < + $Lang::tr{'protocol'}$Lang::tr{'status'} +END + foreach my $p2pentry (sort @p2ps) + { + my @p2pline = split( /\;/, $p2pentry ); + if($p2pline[2] eq 'on'){ + $gif="/images/on.gif" + }else{ + $gif="/images/off.gif" + } + print < + + $p2pline[0]: +END + } + print"$Lang::tr{'outgoing firewall p2p deny'}"; + print"$Lang::tr{'outgoing firewall p2p allow'}"; + &Header::closebox(); +} sub fillselect { my %hash=%{(shift)};