mirror of
https://github.com/vincentmli/bpfire.git
synced 2026-04-14 21:12:59 +02:00
Firewall: Move some functions from rules.pl to firewall-lib.pl
This commit is contained in:
Alexander Marx
committed by
Michael Tremer
Michael Tremer
parent
d7a14d01e1
commit
4e54e3c6f5
@@ -35,6 +35,8 @@ my %ipsecconf=();
|
||||
my %ipsecsettings=();
|
||||
my %netsettings=();
|
||||
my %ovpnsettings=();
|
||||
my %defaultNetworks=();
|
||||
my %aliases=();
|
||||
|
||||
require '/var/ipfire/general-functions.pl';
|
||||
|
||||
@@ -103,8 +105,6 @@ sub get_srvgrp_prot
|
||||
return $back;
|
||||
|
||||
}
|
||||
|
||||
|
||||
sub get_srv_port
|
||||
{
|
||||
my $val=shift;
|
||||
@@ -253,5 +253,269 @@ sub get_host_ip
|
||||
}
|
||||
}
|
||||
}
|
||||
# Functions used by rules.pl
|
||||
sub get_addresses {
|
||||
my $hash = shift;
|
||||
my $key = shift;
|
||||
my $type = shift;
|
||||
|
||||
my @addresses = ();
|
||||
my $addr_type;
|
||||
my $value;
|
||||
my $group_name;
|
||||
|
||||
if ($type eq "src") {
|
||||
$addr_type = $$hash{$key}[3];
|
||||
$value = $$hash{$key}[4];
|
||||
|
||||
} elsif ($type eq "tgt") {
|
||||
$addr_type = $$hash{$key}[5];
|
||||
$value = $$hash{$key}[6];
|
||||
}
|
||||
|
||||
if ($addr_type ~~ ["cust_grp_src", "cust_grp_tgt"]) {
|
||||
foreach my $grp (sort {$a <=> $b} keys %customgrp) {
|
||||
if ($customgrp{$grp}[0] eq $value) {
|
||||
my @address = &get_address($customgrp{$grp}[3], $customgrp{$grp}[2], $type);
|
||||
|
||||
if (@address) {
|
||||
push(@addresses, @address);
|
||||
}
|
||||
}
|
||||
}
|
||||
} else {
|
||||
my @address = &get_address($addr_type, $value, $type);
|
||||
|
||||
if (@address) {
|
||||
push(@addresses, @address);
|
||||
}
|
||||
}
|
||||
|
||||
return @addresses;
|
||||
}
|
||||
sub get_address {
|
||||
my $key = shift;
|
||||
my $value = shift;
|
||||
my $type = shift;
|
||||
|
||||
my @ret = ();
|
||||
|
||||
# If the user manually typed an address, we just check if it is a MAC
|
||||
# address. Otherwise, we assume that it is an IP address.
|
||||
if ($key ~~ ["src_addr", "tgt_addr"]) {
|
||||
if (&General::validmac($value)) {
|
||||
push(@ret, "-m mac --mac-source $value");
|
||||
} else {
|
||||
push(@ret, $value);
|
||||
}
|
||||
|
||||
# If a default network interface (GREEN, BLUE, etc.) is selected, we
|
||||
# try to get the corresponding address of the network.
|
||||
} elsif ($key ~~ ["std_net_src", "std_net_tgt", "Standard Network"]) {
|
||||
my $external_interface = &get_external_interface();
|
||||
|
||||
my $network_address = &get_std_net_ip($value, $external_interface);
|
||||
if ($network_address) {
|
||||
push(@ret, $network_address);
|
||||
}
|
||||
|
||||
# Custom networks.
|
||||
} elsif ($key ~~ ["cust_net_src", "cust_net_tgt", "Custom Network"]) {
|
||||
my $network_address = &get_net_ip($value);
|
||||
if ($network_address) {
|
||||
push(@ret, $network_address);
|
||||
}
|
||||
|
||||
# Custom hosts.
|
||||
} elsif ($key ~~ ["cust_host_src", "cust_host_tgt", "Custom Host"]) {
|
||||
my $host_address = &get_host_ip($value, $type);
|
||||
if ($host_address) {
|
||||
push(@ret, $host_address);
|
||||
}
|
||||
|
||||
# OpenVPN networks.
|
||||
} elsif ($key ~~ ["ovpn_net_src", "ovpn_net_tgt", "OpenVPN static network"]) {
|
||||
my $network_address = &get_ovpn_net_ip($value, 1);
|
||||
if ($network_address) {
|
||||
push(@ret, $network_address);
|
||||
}
|
||||
|
||||
# OpenVPN hosts.
|
||||
} elsif ($key ~~ ["ovpn_host_src", "ovpn_host_tgt", "OpenVPN static host"]) {
|
||||
my $host_address = &get_ovpn_host_ip($value, 33);
|
||||
if ($host_address) {
|
||||
push(@ret, $host_address);
|
||||
}
|
||||
|
||||
# OpenVPN N2N.
|
||||
} elsif ($key ~~ ["ovpn_n2n_src", "ovpn_n2n_tgt", "OpenVPN N-2-N"]) {
|
||||
my $network_address = &get_ovpn_n2n_ip($value, 11);
|
||||
if ($network_address) {
|
||||
push(@ret, $network_address);
|
||||
}
|
||||
|
||||
# IPsec networks.
|
||||
} elsif ($key ~~ ["ipsec_net_src", "ipsec_net_tgt", "IpSec Network"]) {
|
||||
my $network_address = &get_ipsec_net_ip($value, 11);
|
||||
if ($network_address) {
|
||||
push(@ret, $network_address);
|
||||
}
|
||||
|
||||
# The firewall's own IP addresses.
|
||||
} elsif ($key ~~ ["ipfire", "ipfire_src"]) {
|
||||
# ALL
|
||||
if ($value eq "ALL") {
|
||||
push(@ret, "0/0");
|
||||
|
||||
# GREEN
|
||||
} elsif ($value eq "GREEN") {
|
||||
push(@ret, $defaultNetworks{"GREEN_ADDRESS"});
|
||||
|
||||
# BLUE
|
||||
} elsif ($value eq "BLUE") {
|
||||
push(@ret, $defaultNetworks{"BLUE_ADDRESS"});
|
||||
|
||||
# ORANGE
|
||||
} elsif ($value eq "ORANGE") {
|
||||
push(@ret, $defaultNetworks{"ORANGE_ADDRESS"});
|
||||
|
||||
# RED
|
||||
} elsif ($value ~~ ["RED", "RED1"]) {
|
||||
my $address = &get_external_address();
|
||||
if ($address) {
|
||||
push(@ret, $address);
|
||||
}
|
||||
|
||||
# Aliases
|
||||
} else {
|
||||
my %alias = &get_alias($value);
|
||||
if (%alias) {
|
||||
push(@ret, $alias{"IPT"});
|
||||
}
|
||||
}
|
||||
|
||||
# If nothing was selected, we assume "any".
|
||||
} else {
|
||||
push(@ret, "0/0");
|
||||
}
|
||||
|
||||
return @ret;
|
||||
}
|
||||
sub get_external_interface() {
|
||||
open(IFACE, "/var/ipfire/red/iface") or return "";
|
||||
my $iface = <IFACE>;
|
||||
close(IFACE);
|
||||
|
||||
return $iface;
|
||||
}
|
||||
sub get_external_address() {
|
||||
open(ADDR, "/var/ipfire/red/local-ipaddress") or return "";
|
||||
my $address = <ADDR>;
|
||||
close(ADDR);
|
||||
|
||||
return $address;
|
||||
}
|
||||
sub get_alias {
|
||||
my $id = shift;
|
||||
|
||||
foreach my $alias (sort keys %aliases) {
|
||||
if ($id eq $alias) {
|
||||
return $aliases{$alias};
|
||||
}
|
||||
}
|
||||
}
|
||||
sub get_nat_address {
|
||||
my $zone = shift;
|
||||
my $source = shift;
|
||||
|
||||
# Any static address of any zone.
|
||||
if ($zone eq "AUTO") {
|
||||
if ($source) {
|
||||
my $firewall_ip = &get_internal_firewall_ip_address($source, 1);
|
||||
if ($firewall_ip) {
|
||||
return $firewall_ip;
|
||||
}
|
||||
|
||||
$firewall_ip = &get_matching_firewall_address($source, 1);
|
||||
if ($firewall_ip) {
|
||||
return $firewall_ip;
|
||||
}
|
||||
}
|
||||
|
||||
return &get_external_address();
|
||||
|
||||
} elsif ($zone eq "RED" || $zone eq "GREEN" || $zone eq "ORANGE" || $zone eq "BLUE") {
|
||||
return $defaultNetworks{$zone . "_ADDRESS"};
|
||||
|
||||
} elsif ($zone eq "Default IP") {
|
||||
return &get_external_address();
|
||||
|
||||
} else {
|
||||
return &get_alias($zone);
|
||||
}
|
||||
|
||||
print_error("Could not find NAT address");
|
||||
}
|
||||
sub get_internal_firewall_ip_addresses {
|
||||
my $use_orange = shift;
|
||||
|
||||
my @zones = ("GREEN", "BLUE");
|
||||
if ($use_orange) {
|
||||
push(@zones, "ORANGE");
|
||||
}
|
||||
|
||||
my @addresses = ();
|
||||
for my $zone (@zones) {
|
||||
next unless (exists $defaultNetworks{$zone . "_ADDRESS"});
|
||||
|
||||
my $zone_address = $defaultNetworks{$zone . "_ADDRESS"};
|
||||
push(@addresses, $zone_address);
|
||||
}
|
||||
|
||||
return @addresses;
|
||||
}
|
||||
sub get_matching_firewall_address {
|
||||
my $addr = shift;
|
||||
my $use_orange = shift;
|
||||
|
||||
my ($address, $netmask) = split("/", $addr);
|
||||
|
||||
my @zones = ("GREEN", "BLUE");
|
||||
if ($use_orange) {
|
||||
push(@zones, "ORANGE");
|
||||
}
|
||||
|
||||
foreach my $zone (@zones) {
|
||||
next unless (exists $defaultNetworks{$zone . "_ADDRESS"});
|
||||
|
||||
my $zone_subnet = $defaultNetworks{$zone . "_NETADDRESS"};
|
||||
my $zone_mask = $defaultNetworks{$zone . "_NETMASK"};
|
||||
|
||||
if (&General::IpInSubnet($address, $zone_subnet, $zone_mask)) {
|
||||
return $defaultNetworks{$zone . "_ADDRESS"};
|
||||
}
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
sub get_internal_firewall_ip_address {
|
||||
my $subnet = shift;
|
||||
my $use_orange = shift;
|
||||
|
||||
my ($net_address, $net_mask) = split("/", $subnet);
|
||||
if ((!$net_mask) || ($net_mask ~~ ["32", "255.255.255.255"])) {
|
||||
return 0;
|
||||
}
|
||||
|
||||
my @addresses = &get_internal_firewall_ip_addresses($use_orange);
|
||||
foreach my $zone_address (@addresses) {
|
||||
if (&General::IpInSubnet($zone_address, $net_address, $net_mask)) {
|
||||
return $zone_address;
|
||||
}
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
|
||||
return 1;
|
||||
|
||||
@@ -170,10 +170,10 @@ sub buildrules {
|
||||
}
|
||||
|
||||
# Collect all sources.
|
||||
my @sources = &get_addresses($hash, $key, "src");
|
||||
my @sources = &fwlib::get_addresses($hash, $key, "src");
|
||||
|
||||
# Collect all destinations.
|
||||
my @destinations = &get_addresses($hash, $key, "tgt");
|
||||
my @destinations = &fwlib::get_addresses($hash, $key, "tgt");
|
||||
|
||||
# Check if logging should be enabled.
|
||||
my $LOG = ($$hash{$key}[17] eq 'ON');
|
||||
@@ -298,7 +298,7 @@ sub buildrules {
|
||||
|
||||
# Process NAT rules.
|
||||
if ($NAT) {
|
||||
my $nat_address = &get_nat_address($$hash{$key}[29], $source);
|
||||
my $nat_address = &fwlib::get_nat_address($$hash{$key}[29], $source);
|
||||
|
||||
# Skip NAT rules if the NAT address is unknown
|
||||
# (i.e. no internet connection has been established, yet).
|
||||
@@ -307,7 +307,7 @@ sub buildrules {
|
||||
# Destination NAT
|
||||
if ($NAT_MODE eq "DNAT") {
|
||||
# Make port-forwardings useable from the internal networks.
|
||||
my @internal_addresses = &get_internal_firewall_ip_addresses(1);
|
||||
my @internal_addresses = &fwlib::get_internal_firewall_ip_addresses(1);
|
||||
unless ($nat_address ~~ @internal_addresses) {
|
||||
&add_dnat_mangle_rules($nat_address, @options);
|
||||
}
|
||||
@@ -372,65 +372,6 @@ sub buildrules {
|
||||
}
|
||||
}
|
||||
|
||||
sub get_external_interface() {
|
||||
open(IFACE, "/var/ipfire/red/iface") or return "";
|
||||
my $iface = <IFACE>;
|
||||
close(IFACE);
|
||||
|
||||
return $iface;
|
||||
}
|
||||
|
||||
sub get_external_address() {
|
||||
open(ADDR, "/var/ipfire/red/local-ipaddress") or return "";
|
||||
my $address = <ADDR>;
|
||||
close(ADDR);
|
||||
|
||||
return $address;
|
||||
}
|
||||
|
||||
sub get_alias {
|
||||
my $id = shift;
|
||||
|
||||
foreach my $alias (sort keys %aliases) {
|
||||
if ($id eq $alias) {
|
||||
return $aliases{$alias};
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
sub get_nat_address {
|
||||
my $zone = shift;
|
||||
my $source = shift;
|
||||
|
||||
# Any static address of any zone.
|
||||
if ($zone eq "AUTO") {
|
||||
if ($source) {
|
||||
my $firewall_ip = &get_internal_firewall_ip_address($source, 1);
|
||||
if ($firewall_ip) {
|
||||
return $firewall_ip;
|
||||
}
|
||||
|
||||
$firewall_ip = &get_matching_firewall_address($source, 1);
|
||||
if ($firewall_ip) {
|
||||
return $firewall_ip;
|
||||
}
|
||||
}
|
||||
|
||||
return &get_external_address();
|
||||
|
||||
} elsif ($zone eq "RED" || $zone eq "GREEN" || $zone eq "ORANGE" || $zone eq "BLUE") {
|
||||
return $defaultNetworks{$zone . "_ADDRESS"};
|
||||
|
||||
} elsif ($zone eq "Default IP") {
|
||||
return &get_external_address();
|
||||
|
||||
} else {
|
||||
return &get_alias($zone);
|
||||
}
|
||||
|
||||
print_error("Could not find NAT address");
|
||||
}
|
||||
|
||||
# Formats the given timestamp into the iptables format which is "hh:mm" UTC.
|
||||
sub format_time {
|
||||
my $val = shift;
|
||||
@@ -496,155 +437,6 @@ sub p2pblock {
|
||||
}
|
||||
}
|
||||
|
||||
sub get_addresses {
|
||||
my $hash = shift;
|
||||
my $key = shift;
|
||||
my $type = shift;
|
||||
|
||||
my @addresses = ();
|
||||
my $addr_type;
|
||||
my $value;
|
||||
my $group_name;
|
||||
|
||||
if ($type eq "src") {
|
||||
$addr_type = $$hash{$key}[3];
|
||||
$value = $$hash{$key}[4];
|
||||
|
||||
} elsif ($type eq "tgt") {
|
||||
$addr_type = $$hash{$key}[5];
|
||||
$value = $$hash{$key}[6];
|
||||
}
|
||||
|
||||
if ($addr_type ~~ ["cust_grp_src", "cust_grp_tgt"]) {
|
||||
foreach my $grp (sort {$a <=> $b} keys %customgrp) {
|
||||
if ($customgrp{$grp}[0] eq $value) {
|
||||
my @address = &get_address($customgrp{$grp}[3], $customgrp{$grp}[2], $type);
|
||||
|
||||
if (@address) {
|
||||
push(@addresses, @address);
|
||||
}
|
||||
}
|
||||
}
|
||||
} else {
|
||||
my @address = &get_address($addr_type, $value, $type);
|
||||
|
||||
if (@address) {
|
||||
push(@addresses, @address);
|
||||
}
|
||||
}
|
||||
|
||||
return @addresses;
|
||||
}
|
||||
|
||||
sub get_address {
|
||||
my $key = shift;
|
||||
my $value = shift;
|
||||
my $type = shift;
|
||||
|
||||
my @ret = ();
|
||||
|
||||
# If the user manually typed an address, we just check if it is a MAC
|
||||
# address. Otherwise, we assume that it is an IP address.
|
||||
if ($key ~~ ["src_addr", "tgt_addr"]) {
|
||||
if (&General::validmac($value)) {
|
||||
push(@ret, "-m mac --mac-source $value");
|
||||
} else {
|
||||
push(@ret, $value);
|
||||
}
|
||||
|
||||
# If a default network interface (GREEN, BLUE, etc.) is selected, we
|
||||
# try to get the corresponding address of the network.
|
||||
} elsif ($key ~~ ["std_net_src", "std_net_tgt", "Standard Network"]) {
|
||||
my $external_interface = &get_external_interface();
|
||||
|
||||
my $network_address = &fwlib::get_std_net_ip($value, $external_interface);
|
||||
if ($network_address) {
|
||||
push(@ret, $network_address);
|
||||
}
|
||||
|
||||
# Custom networks.
|
||||
} elsif ($key ~~ ["cust_net_src", "cust_net_tgt", "Custom Network"]) {
|
||||
my $network_address = &fwlib::get_net_ip($value);
|
||||
if ($network_address) {
|
||||
push(@ret, $network_address);
|
||||
}
|
||||
|
||||
# Custom hosts.
|
||||
} elsif ($key ~~ ["cust_host_src", "cust_host_tgt", "Custom Host"]) {
|
||||
my $host_address = &fwlib::get_host_ip($value, $type);
|
||||
if ($host_address) {
|
||||
push(@ret, $host_address);
|
||||
}
|
||||
|
||||
# OpenVPN networks.
|
||||
} elsif ($key ~~ ["ovpn_net_src", "ovpn_net_tgt", "OpenVPN static network"]) {
|
||||
my $network_address = &fwlib::get_ovpn_net_ip($value, 1);
|
||||
if ($network_address) {
|
||||
push(@ret, $network_address);
|
||||
}
|
||||
|
||||
# OpenVPN hosts.
|
||||
} elsif ($key ~~ ["ovpn_host_src", "ovpn_host_tgt", "OpenVPN static host"]) {
|
||||
my $host_address = &fwlib::get_ovpn_host_ip($value, 33);
|
||||
if ($host_address) {
|
||||
push(@ret, $host_address);
|
||||
}
|
||||
|
||||
# OpenVPN N2N.
|
||||
} elsif ($key ~~ ["ovpn_n2n_src", "ovpn_n2n_tgt", "OpenVPN N-2-N"]) {
|
||||
my $network_address = &fwlib::get_ovpn_n2n_ip($value, 11);
|
||||
if ($network_address) {
|
||||
push(@ret, $network_address);
|
||||
}
|
||||
|
||||
# IPsec networks.
|
||||
} elsif ($key ~~ ["ipsec_net_src", "ipsec_net_tgt", "IpSec Network"]) {
|
||||
my $network_address = &fwlib::get_ipsec_net_ip($value, 11);
|
||||
if ($network_address) {
|
||||
push(@ret, $network_address);
|
||||
}
|
||||
|
||||
# The firewall's own IP addresses.
|
||||
} elsif ($key ~~ ["ipfire", "ipfire_src"]) {
|
||||
# ALL
|
||||
if ($value eq "ALL") {
|
||||
push(@ret, "0/0");
|
||||
|
||||
# GREEN
|
||||
} elsif ($value eq "GREEN") {
|
||||
push(@ret, $defaultNetworks{"GREEN_ADDRESS"});
|
||||
|
||||
# BLUE
|
||||
} elsif ($value eq "BLUE") {
|
||||
push(@ret, $defaultNetworks{"BLUE_ADDRESS"});
|
||||
|
||||
# ORANGE
|
||||
} elsif ($value eq "ORANGE") {
|
||||
push(@ret, $defaultNetworks{"ORANGE_ADDRESS"});
|
||||
|
||||
# RED
|
||||
} elsif ($value ~~ ["RED", "RED1"]) {
|
||||
my $address = &get_external_address();
|
||||
if ($address) {
|
||||
push(@ret, $address);
|
||||
}
|
||||
|
||||
# Aliases
|
||||
} else {
|
||||
my %alias = &get_alias($value);
|
||||
if (%alias) {
|
||||
push(@ret, $alias{"IPT"});
|
||||
}
|
||||
}
|
||||
|
||||
# If nothing was selected, we assume "any".
|
||||
} else {
|
||||
push(@ret, "0/0");
|
||||
}
|
||||
|
||||
return @ret;
|
||||
}
|
||||
|
||||
sub get_protocols {
|
||||
my $hash = shift;
|
||||
my $key = shift;
|
||||
@@ -839,50 +631,12 @@ sub make_log_limit_options {
|
||||
return @options;
|
||||
}
|
||||
|
||||
sub get_internal_firewall_ip_addresses {
|
||||
my $use_orange = shift;
|
||||
|
||||
my @zones = ("GREEN", "BLUE");
|
||||
if ($use_orange) {
|
||||
push(@zones, "ORANGE");
|
||||
}
|
||||
|
||||
my @addresses = ();
|
||||
for my $zone (@zones) {
|
||||
next unless (exists $defaultNetworks{$zone . "_ADDRESS"});
|
||||
|
||||
my $zone_address = $defaultNetworks{$zone . "_ADDRESS"};
|
||||
push(@addresses, $zone_address);
|
||||
}
|
||||
|
||||
return @addresses;
|
||||
}
|
||||
|
||||
sub get_internal_firewall_ip_address {
|
||||
my $subnet = shift;
|
||||
my $use_orange = shift;
|
||||
|
||||
my ($net_address, $net_mask) = split("/", $subnet);
|
||||
if ((!$net_mask) || ($net_mask ~~ ["32", "255.255.255.255"])) {
|
||||
return 0;
|
||||
}
|
||||
|
||||
my @addresses = &get_internal_firewall_ip_addresses($use_orange);
|
||||
foreach my $zone_address (@addresses) {
|
||||
if (&General::IpInSubnet($zone_address, $net_address, $net_mask)) {
|
||||
return $zone_address;
|
||||
}
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
sub firewall_is_in_subnet {
|
||||
my $subnet = shift;
|
||||
|
||||
# ORANGE is missing here, because nothing may ever access
|
||||
# the firewall from this network.
|
||||
my $address = &get_internal_firewall_ip_address($subnet, 0);
|
||||
my $address = &fwlib::get_internal_firewall_ip_address($subnet, 0);
|
||||
|
||||
if ($address) {
|
||||
return 1;
|
||||
@@ -891,27 +645,3 @@ sub firewall_is_in_subnet {
|
||||
return 0;
|
||||
}
|
||||
|
||||
sub get_matching_firewall_address {
|
||||
my $addr = shift;
|
||||
my $use_orange = shift;
|
||||
|
||||
my ($address, $netmask) = split("/", $addr);
|
||||
|
||||
my @zones = ("GREEN", "BLUE");
|
||||
if ($use_orange) {
|
||||
push(@zones, "ORANGE");
|
||||
}
|
||||
|
||||
foreach my $zone (@zones) {
|
||||
next unless (exists $defaultNetworks{$zone . "_ADDRESS"});
|
||||
|
||||
my $zone_subnet = $defaultNetworks{$zone . "_NETADDRESS"};
|
||||
my $zone_mask = $defaultNetworks{$zone . "_NETMASK"};
|
||||
|
||||
if (&General::IpInSubnet($address, $zone_subnet, $zone_mask)) {
|
||||
return $defaultNetworks{$zone . "_ADDRESS"};
|
||||
}
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user