From ebb9187ccaa87f46fb824eace995cf9a0c634435 Mon Sep 17 00:00:00 2001 From: delaco Date: Wed, 13 Sep 2006 20:20:37 +0000 Subject: [PATCH] Update: * OutgoingFW - Script hinzugefuegt git-svn-id: http://svn.ipfire.org/svn/ipfire/trunk@278 ea5c0bd1-69bd-2848-81d8-4f18e57aeed8 --- config/outgoingfw/outgoingfw.pl | 154 ++++++++++++++++++++++++++++++++ doc/ChangeLog | 6 ++ html/cgi-bin/outgoingfw.cgi | 153 ++++++++++++++++--------------- lfs/configroot | 3 +- 4 files changed, 237 insertions(+), 79 deletions(-) create mode 100644 config/outgoingfw/outgoingfw.pl diff --git a/config/outgoingfw/outgoingfw.pl b/config/outgoingfw/outgoingfw.pl new file mode 100644 index 000000000..5c08c3089 --- /dev/null +++ b/config/outgoingfw/outgoingfw.pl @@ -0,0 +1,154 @@ +#!/usr/bin/perl +# +# IPFire Scripts +# +# This code is distributed under the terms of the GPL +# +# (c) The IPFire Team +# + +use strict; +# enable only the following on debugging purpose +#use warnings; + +require '/var/ipfire/general-functions.pl'; + +my %outfwsettings = (); +my %checked = (); +my %selected= () ; +my %netsettings = (); +my $errormessage = ""; +my $configentry = ""; +my @configs = (); +my @configline = (); +my $p2pentry = ""; +my @p2ps = (); +my @p2pline = (); +my @protos = (); +my $CMD = ""; +my $DEBUG = 0; + +my $configfile = "/var/ipfire/outgoing/rules"; +my $p2pfile = "/var/ipfire/outgoing/p2protocols"; + +&General::readhash("${General::swroot}/ethernet/settings", \%netsettings); + +### Values that have to be initialized +$outfwsettings{'ACTION'} = ''; +$outfwsettings{'VALID'} = 'yes'; +$outfwsettings{'EDIT'} = 'no'; +$outfwsettings{'NAME'} = ''; +$outfwsettings{'SNET'} = ''; +$outfwsettings{'SIP'} = ''; +$outfwsettings{'SPORT'} = ''; +$outfwsettings{'SMAC'} = ''; +$outfwsettings{'DIP'} = ''; +$outfwsettings{'DPORT'} = ''; +$outfwsettings{'PROT'} = ''; +$outfwsettings{'STATE'} = ''; +$outfwsettings{'DISPLAY_DIP'} = ''; +$outfwsettings{'DISPLAY_DPORT'} = ''; +$outfwsettings{'DISPLAY_SMAC'} = ''; +$outfwsettings{'DISPLAY_SIP'} = ''; +$outfwsettings{'POLICY'} = 'MODE0'; +my $SOURCE = ""; +my $DESTINATION = ""; +my $PROTO = ""; +my $DPORT = ""; +my $DEV = ""; +my $MAC = ""; +my $POLICY = ""; +my $DO = ""; + +# read files +&General::readhash("${General::swroot}/outgoing/settings", \%outfwsettings); +&General::readhash("${General::swroot}/ethernet/settings", \%netsettings); + +open( FILE, "< $configfile" ) or die "Unable to read $configfile"; +@configs = ; +close FILE; + +# Say hello! +print "Outgoing firewall for IPFire - $outfwsettings{'POLICY'}\n"; +if ($DEBUG) { print "Debugging mode!\n"; } +print "\n"; + + +if ( $outfwsettings{'POLICY'} eq 'MODE0' ) { + system("/sbin/iptables --flush OUTGOINGFW >/dev/null 2>&1"); + system("/sbin/iptables --delete-chain OUTGOINGFW >/dev/null 2>&1"); + + exit 0 +} elsif ( $outfwsettings{'POLICY'} eq 'MODE1' ) { + $outfwsettings{'STATE'} = "ALLOW"; + $POLICY = "DROP"; + $DO = "ACCEPT"; +} elsif ( $outfwsettings{'POLICY'} eq 'MODE2' ) { + $outfwsettings{'STATE'} = "DENY"; + $POLICY = "ACCEPT"; + $DO = "DROP"; +} + +### Initialize IPTables +system("/sbin/iptables --flush OUTGOINGFW >/dev/null 2>&1"); +system("/sbin/iptables --delete-chain OUTGOINGFW >/dev/null 2>&1"); +system("/sbin/iptables -N OUTGOINGFW >/dev/null 2>&1"); + +foreach $configentry (sort @configs) +{ + $SOURCE = ""; + $DESTINATION = ""; + $PROTO = ""; + $DPORT = ""; + $DEV = ""; + $MAC = ""; + @configline = split( /\;/, $configentry ); + if ($outfwsettings{'STATE'} eq $configline[0]) { + if ($configline[2] eq 'green') { + $SOURCE = "$netsettings{'GREEN_NETADDRESS'}/$netsettings{'GREEN_NETMASK'}"; + $DEV = $netsettings{'GREEN_DEV'}; + } elsif ($configline[2] eq 'blue') { + $SOURCE = "$netsettings{'BLUE_NETADDRESS'}/$netsettings{'BLUE_NETMASK'}"; + $DEV = $netsettings{'BLUE_DEV'}; + } elsif ($configline[2] eq 'orange') { + $SOURCE = "$netsettings{'ORANGE_NETADDRESS'}/$netsettings{'ORANGE_NETMASK'}"; + $DEV = $netsettings{'ORANGE_DEV'}; + } elsif ($configline[2] eq 'ip') { + $SOURCE = "$configline[5]"; + $DEV = ""; + } else { + $SOURCE = "0/0"; + $DEV = ""; + } + + if ($configline[7]) { $DESTINATION = "$configline[7]"; } else { $DESTINATION = "0/0"; } + + $CMD = "/sbin/iptables -A OUTGOINGFW -s $SOURCE -d $DESTINATION"; + + if ($configline[3] ne 'tcp&udp') { + $PROTO = "$configline[3]"; + $CMD = "$CMD -p $PROTO"; + if ($configline[8]) { + $DPORT = "$configline[8]"; + $CMD = "$CMD --dport $DPORT"; + } + } + + if ($DEV) { + $CMD = "$CMD -i $DEV"; + } + + if ($configline[6]) { + $MAC = "$configline[6]"; + $CMD = "$CMD -m mac --mac-source $MAC"; + } + + $CMD = "$CMD -o $netsettings{'RED_DEV'}"; + if ($DEBUG) { print "$CMD -j $DO\n"; } else { system("$CMD -j $DO"); } + + if ($configline[9] eq "log") { + if ($DEBUG) { print "$CMD -m state --state NEW -j LOG --log-prefix 'OUTGOINGFW '\n"; } else { system("$CMD -m state --state NEW -j LOG --log-prefix 'OUTGOINGFW '"); } + } + + } +} diff --git a/doc/ChangeLog b/doc/ChangeLog index 9462c35fb..7f2ba2425 100644 --- a/doc/ChangeLog +++ b/doc/ChangeLog @@ -1,4 +1,10 @@ ------------------------------------------------------------------------ +r277 | delaco | 2006-09-13 17:30:27 +0200 (Wed, 13 Sep 2006) | 3 lines + +Fixes: + * readline - Fehler im Patch-Pfad + * php ist von libxml2 abhaengig +------------------------------------------------------------------------ r276 | delaco | 2006-09-12 23:47:37 +0200 (Tue, 12 Sep 2006) | 10 lines Hinzugefuegt: diff --git a/html/cgi-bin/outgoingfw.cgi b/html/cgi-bin/outgoingfw.cgi index 78ee951c4..d4274bd77 100644 --- a/html/cgi-bin/outgoingfw.cgi +++ b/html/cgi-bin/outgoingfw.cgi @@ -62,37 +62,6 @@ if ($outfwsettings{'POLICY'} eq 'MODE1'){ $selected{'POLICY'}{'MODE1'} = 'select if ($outfwsettings{'POLICY'} eq 'MODE2'){ $selected{'POLICY'}{'MODE2'} = 'selected'; } else { $selected{'POLICY'}{'MODE2'} = ''; } &Header::openpage('Ausgehende Firewall', 1, ''); - -print < - - - -END -; - &Header::openbigbox('100%', 'left', '', $errormessage); ############################################################################################################################ @@ -166,6 +135,8 @@ if ($outfwsettings{'ACTION'} eq $Lang::tr{'edit'}) } } close FILE; + $selected{'SNET'}{"$outfwsettings{'SNET'}"} = 'selected'; + $selected{'PROT'}{"$outfwsettings{'PROT'}"} = 'selected'; &addrule(); &Header::closebigbox(); &Header::closepage(); @@ -205,10 +176,10 @@ END ; close FILE; } else { - $outfwsettings{'ACTION'} = 'Regel hinzufuegen'; + $outfwsettings{'ACTION'} = 'Add rule'; } } -if ($outfwsettings{'ACTION'} eq 'Regel hinzufuegen') +if ($outfwsettings{'ACTION'} eq 'Add rule') { &addrule(); exit @@ -230,7 +201,8 @@ if ($outfwsettings{'POLICY'} ne 'MODE0'){ &Header::openbox('100%', 'center', 'Rules'); print < - + + END ; open( FILE, "< $configfile" ) or die "Unable to read $configfile"; @@ -240,12 +212,13 @@ END print < - + + \n"; + } + else { + print "\t\t\t\n"; + } + $id++; + print <$p2pline[0]: +
Protokoll - Netzwerk - Ziel - Anmerkung - Politik - Aktionen +
Protokoll + Netzwerk + Ziel + Anmerkung + Politik + Aktionen END ; foreach $configentry (sort @configs) @@ -266,35 +239,51 @@ END if ($outfwsettings{'STATE'} eq 'ALLOW'){ $outfwsettings{'DISPLAY_STATE'} = "ALLOW"; } if ((($outfwsettings{'POLICY'} eq 'MODE1') && ($outfwsettings{'STATE'} eq 'ALLOW')) || (($outfwsettings{'POLICY'} eq 'MODE2') && ($outfwsettings{'STATE'} eq 'DENY'))){ print < - - - - - - - - - -
$outfwsettings{'PROT'} - $outfwsettings{'SNET'} - $outfwsettings{'DISPLAY_DIP'}:$outfwsettings{'DISPLAY_DPORT'} - $outfwsettings{'NAME'} - $outfwsettings{'DISPLAY_STATE'} - -   - +
$outfwsettings{'PROT'} + $outfwsettings{'SNET'} + $outfwsettings{'DISPLAY_DIP'}:$outfwsettings{'DISPLAY_DPORT'} + $outfwsettings{'NAME'} + $outfwsettings{'DISPLAY_STATE'} + + +
+ + + + + + + + + + + +
+
+ + + + + + + + + + + +
END ; if (($outfwsettings{'SIP'}) || ($outfwsettings{'SMAC'})) { - unless ($outfwsettings{'SIP'}) { $outfwsettings{'DISPLAY_SIP'} = '---'; } else { $outfwsettings{'DISPLAY_SIP'} = $outfwsettings{'SIP'}; } - unless ($outfwsettings{'SMAC'}) { $outfwsettings{'DISPLAY_SMAC'} = '---'; } else { $outfwsettings{'DISPLAY_SMAC'} = $outfwsettings{'SMAC'}; } + unless ($outfwsettings{'SIP'}) { $outfwsettings{'DISPLAY_SIP'} = 'ALL'; } else { $outfwsettings{'DISPLAY_SIP'} = $outfwsettings{'SIP'}; } + unless ($outfwsettings{'SMAC'}) { $outfwsettings{'DISPLAY_SMAC'} = 'ALL'; } else { $outfwsettings{'DISPLAY_SMAC'} = $outfwsettings{'SMAC'}; } print <		Quell-IP-Adresse: - $outfwsettings{'DISPLAY_SIP'} - Quell-MAC-Adresse: - $outfwsettings{'DISPLAY_SMAC'} - +
Quell-IP-Adresse: + $outfwsettings{'DISPLAY_SIP'} + Quell-MAC-Adresse: + $outfwsettings{'DISPLAY_SMAC'} + END ; } @@ -310,10 +299,6 @@ END ; } - print < -END -; &Header::closebox(); } @@ -324,17 +309,28 @@ if ($outfwsettings{'POLICY'} eq 'MODE2'){ &Header::openbox('100%', 'center', 'P2P-Block'); print < -
Protokoll - Status +
Protokoll + Status END ; + my $id = 1; foreach $p2pentry (sort @p2ps) { @p2pline = split( /\;/, $p2pentry ); print < -
$p2pline[0]: - +END +; + if ($id % 2) { + print "\t\t\t
END ; if ($p2pline[2] eq 'on') { @@ -407,7 +403,7 @@ sub addrule Aktiviert:
Protokoll: - + Sicherheitspolitik: END @@ -421,14 +417,15 @@ END
Quellnetz:
Ziel-IP-Adresse: Ziel-Port: - +
$Lang::tr{'this field may be blank'} diff --git a/lfs/configroot b/lfs/configroot index 818c7eaa3..f3f404175 100644 --- a/lfs/configroot +++ b/lfs/configroot @@ -51,7 +51,7 @@ $(TARGET) : # Create all directories for i in addon-lang alcatelusb auth backup ca certs cnx_pci connscheduler crls ddns dhcp dhcpc dmzholes \ - eagle-usb eciadsl ethernet isdn key langs logging main mbmon modem net-traffic nfs optionsfw outgoing patches pakfire portfw \ + eagle-usb eciadsl ethernet isdn key langs logging main mbmon modem net-traffic nfs optionsfw outgoing/bin patches pakfire portfw \ ppp private proxy/advanced qos/bin red remote snort time urlfilter/autoupdate urlfilter/bin vpn wakeonlan wireless xtaccess ; do \ mkdir -p $(CONFIG_ROOT)/$$i; \ done @@ -85,6 +85,7 @@ $(TARGET) : cp $(DIR_SRC)/config/cfgroot/net-traffic-lib.pl $(CONFIG_ROOT)/net-traffic/net-traffic-lib.pl cp $(DIR_SRC)/config/cfgroot/nfs-server $(CONFIG_ROOT)/nfs/nfs-server cp $(DIR_SRC)/config/cfgroot/p2protocols $(CONFIG_ROOT)/outgoing/p2protocols + cp $(DIR_SRC)/config/outgoingfw/outgoingfw.pl $(CONFIG_ROOT)/outgoing/bin/ cp $(DIR_SRC)/config/cfgroot/proxy-acl $(CONFIG_ROOT)/proxy/acl-1.4 cp $(DIR_SRC)/config/qos/* $(CONFIG_ROOT)/qos/bin/ cp $(DIR_SRC)/config/cfgroot/ssh-settings $(CONFIG_ROOT)/remote/settings