IPFire-SCM September 2010

ipfire-scm@lists.ipfire.org

1 participants
43 discussions

[IPFire-SCM] [git.ipfire.org] IPFire 2.x development tree branch, master, updated. 3d8249d34fb6df24168df4ab8052136b54343672
by git＠ipfire.org 02 Sep '10

02 Sep '10

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, master has been updated via 3d8249d34fb6df24168df4ab8052136b54343672 (commit) from 9bde9a2023b6847b3ad45a3de9d4346cfac2390f (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 3d8249d34fb6df24168df4ab8052136b54343672 Author: Christian Schmidt <christian.schmidt(a)ipfire.org> Date: Thu Sep 2 20:11:51 2010 +0200 Fixed language error. ----------------------------------------------------------------------- Summary of changes: langs/en/cgi-bin/en.pl | 8 ++++---- 1 files changed, 4 insertions(+), 4 deletions(-) Difference in files: diff --git a/langs/en/cgi-bin/en.pl b/langs/en/cgi-bin/en.pl index 7fbeb39..2c053da 100644 --- a/langs/en/cgi-bin/en.pl +++ b/langs/en/cgi-bin/en.pl @@ -644,7 +644,7 @@ 'dhcp bootp pxe data' => 'Enter optional bootp pxe data for this fixed lease', 'dhcp configuration' => 'DHCP configuration', 'dhcp create fixed leases' => 'Create fixed leases', -'dhcp fixed lease err1' => 'For a fix lease you have to enter the MAC adress or the hostname, or you enter both.', +'dhcp fixed lease err1' => 'For a fix lease you have to enter the MAC address or the hostname, or you enter both.', 'dhcp fixed lease help1' => 'IP Addresses might be entered as FQDN', 'dhcp mode' => 'DHCP', 'dhcp server' => 'DHCP Server', @@ -1102,7 +1102,7 @@ 'mac address' => 'MAC Address', 'mac address menu' => 'Assign MAC-address', 'mac address in use' => 'MAC address already in use', -'mac address title' => 'Medium Access Control Adresse', +'mac address title' => 'Medium Access Control Address', 'mac address header' => 'MAC address on red0', 'mac address error not valid' => 'MAC addresse not valid!', 'mac address error not 00' => 'MAC addresse has to start with 00!', @@ -1304,9 +1304,9 @@ 'outgoing firewall' => 'Outgoing Firewall', 'outgoing firewall groups' => 'Firewall Groups', 'outgoing firewall add ip group' => 'Add IP Address Group', -'outgoing firewall ip groups' => 'Outgoing Firewall IP Adress Groups', +'outgoing firewall ip groups' => 'Outgoing Firewall IP Address Groups', 'outgoing firewall add mac group' => 'Add MAC Address Group', -'outgoing firewall mac groups' => 'Outgoing Firewall MAC Adress Groups', +'outgoing firewall mac groups' => 'Outgoing Firewall MAC Address Groups', 'outgoing firewall view group' => 'View group', 'outgoing firewall group error' => 'A group with the same name exists.', 'outgoing traffic in bytes per second' => 'Outgoing Traffic', hooks/post-receive -- IPFire 2.x development tree

1 0

[IPFire-SCM] [git.ipfire.org] IPFire 2.x development tree branch, master, updated. 9bde9a2023b6847b3ad45a3de9d4346cfac2390f
by git＠ipfire.org 02 Sep '10

02 Sep '10

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, master has been updated via 9bde9a2023b6847b3ad45a3de9d4346cfac2390f (commit) from cdb4dc96305083c0d16977fb6e1db1d665bb6196 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 9bde9a2023b6847b3ad45a3de9d4346cfac2390f Author: Christian Schmidt <christian.schmidt(a)ipfire.org> Date: Thu Sep 2 20:08:06 2010 +0200 Added the latest commit to next core. ----------------------------------------------------------------------- Summary of changes: config/rootfiles/core/40/filelists/files | 3 +++ config/rootfiles/core/40/update.sh | 5 +++++ 2 files changed, 8 insertions(+), 0 deletions(-) Difference in files: diff --git a/config/rootfiles/core/40/filelists/files b/config/rootfiles/core/40/filelists/files index 04075e6..47ccf94 100644 --- a/config/rootfiles/core/40/filelists/files +++ b/config/rootfiles/core/40/filelists/files @@ -5,6 +5,7 @@ var/ipfire/langs/de.pl var/ipfire/langs/es.pl var/ipfire/langs/fr.pl var/ipfire/dhcp/dhcpd.conf.local +var/ipfire/outgoing/bin/outgoingfw.pl etc/rc.d/init.d/dnsmasq etc/rc.d/init.d/firewall etc/rc.d/init.d/functions @@ -13,6 +14,8 @@ srv/web/ipfire/cgi-bin/backup.cgi srv/web/ipfire/cgi-bin/dhcp.cgi srv/web/ipfire/cgi-bin/time.cgi srv/web/ipfire/cgi-bin/pppsetup.cgi +srv/web/ipfire/cgi-bin/outgoinggrp.cgi +srv/web/ipfire/cgi-bin/outgoingfw.cgi srv/web/ipfire/cgi-bin/qos.cgi usr/lib/python2.7/ipaddr.pyc usr/lib/python2.7/site-packages/drv_libxml2.py diff --git a/config/rootfiles/core/40/update.sh b/config/rootfiles/core/40/update.sh index 8878200..88c067d 100644 --- a/config/rootfiles/core/40/update.sh +++ b/config/rootfiles/core/40/update.sh @@ -51,6 +51,11 @@ echo non /var/lock tmpfs defaults,size=8M 0 0 >> /etc #Rebuild module dep's depmod 2.6.32.15-ipfire depmod 2.6.32.15-ipfire-xen + +#Create the misssing mac group +mkdir /var/ipfire/outgoing/macgroups +chown nobody.nobody /var/ipfire/outgoing/macgroups + # #Finish #Don't report the exitcode last command hooks/post-receive -- IPFire 2.x development tree

1 0

[IPFire-SCM] [git.ipfire.org] IPFire 2.x development tree branch, master, updated. cdb4dc96305083c0d16977fb6e1db1d665bb6196
by git＠ipfire.org 02 Sep '10

02 Sep '10

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, master has been updated via cdb4dc96305083c0d16977fb6e1db1d665bb6196 (commit) via d9716b067d5ad6c904653840c70d9fde01eac3f7 (commit) from 4247f58a1295e4f8748eea61baf5f9aa03872806 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit cdb4dc96305083c0d16977fb6e1db1d665bb6196 Merge: d9716b0 4247f58 Author: Christian Schmidt <christian.schmidt(a)ipfire.org> Date: Thu Sep 2 20:05:11 2010 +0200 Merge branch 'master' of git://git.ipfire.org/ipfire-2.x commit d9716b067d5ad6c904653840c70d9fde01eac3f7 Author: Christian Schmidt <christian.schmidt(a)ipfire.org> Date: Thu Sep 2 20:04:03 2010 +0200 Readded the mac filter to the outgoing firewall. Added mac groups. This feature was requested by bug #0000705. ----------------------------------------------------------------------- Summary of changes: config/outgoingfw/outgoingfw.pl | 38 +++++--- config/rootfiles/common/configroot | 2 +- html/cgi-bin/outgoingfw.cgi | 55 +++++++++--- html/cgi-bin/outgoinggrp.cgi | 170 +++++++++++++++++++++++++++++++++--- langs/de/cgi-bin/de.pl | 22 +++-- langs/en/cgi-bin/en.pl | 22 +++-- langs/es/cgi-bin/es.pl | 11 ++- langs/fr/cgi-bin/fr.pl | 22 +++-- lfs/configroot | 10 +- src/initscripts/init.d/firewall | 3 + 10 files changed, 276 insertions(+), 79 deletions(-) Difference in files: diff --git a/config/outgoingfw/outgoingfw.pl b/config/outgoingfw/outgoingfw.pl index 1bdd612..b323c38 100644 --- a/config/outgoingfw/outgoingfw.pl +++ b/config/outgoingfw/outgoingfw.pl @@ -94,7 +94,7 @@ if ( $outfwsettings{'POLICY'} eq 'MODE1' ) { } elsif ( $outfwsettings{'POLICY'} eq 'MODE2' ) { $outfwsettings{'STATE'} = "DENY"; $POLICY = "ACCEPT"; - $DO = "DROP -m comment --comment 'DROP_OUTGOINGFW'"; + $DO = "DROP -m comment --comment 'DROP_OUTGOINGFW '"; } ### Initialize IPTables @@ -102,6 +102,10 @@ system("/sbin/iptables --flush OUTGOINGFW >/dev/null 2>&1"); system("/sbin/iptables --delete-chain OUTGOINGFW >/dev/null 2>&1"); system("/sbin/iptables -N OUTGOINGFW >/dev/null 2>&1"); +system("/sbin/iptables --flush OUTGOINGFWMAC >/dev/null 2>&1"); +system("/sbin/iptables --delete-chain OUTGOINGFWMAC >/dev/null 2>&1"); +system("/sbin/iptables -N OUTGOINGFWMAC >/dev/null 2>&1"); + if ( $outfwsettings{'POLICY'} eq 'MODE0' ) { exit 0 } @@ -109,8 +113,12 @@ if ( $outfwsettings{'POLICY'} eq 'MODE0' ) { if ( $outfwsettings{'POLICY'} eq 'MODE1' ) { $CMD = "/sbin/iptables -A OUTGOINGFW -m state --state ESTABLISHED,RELATED -j ACCEPT"; if ($DEBUG) { print "$CMD\n"; } else { system("$CMD"); } + $CMD = "/sbin/iptables -A OUTGOINGFWMAC -m state --state ESTABLISHED,RELATED -j ACCEPT"; + if ($DEBUG) { print "$CMD\n"; } else { system("$CMD"); } $CMD = "/sbin/iptables -A OUTGOINGFW -p icmp -j ACCEPT"; if ($DEBUG) { print "$CMD\n"; } else { system("$CMD"); } + $CMD = "/sbin/iptables -A OUTGOINGFWMAC -p icmp -j ACCEPT"; + if ($DEBUG) { print "$CMD\n"; } else { system("$CMD"); } } foreach $configentry (sort @configs) @@ -148,16 +156,20 @@ foreach $configentry (sort @configs) } elsif ($configline[2] eq 'all') { @SOURCE = ("0/0"); $DEV = ""; + } elsif ($configline[2] eq 'mac') { + @SOURCE = ("$configline[6]"); + $DEV = ""; } else { - if ( -e "/var/ipfire/outgoing/groups/ipgroups/$configline[2]" ) - { + if ( -e "/var/ipfire/outgoing/groups/ipgroups/$configline[2]" ) { @SOURCE = `cat /var/ipfire/outgoing/groups/ipgroups/$configline[2]`; + } elsif ( -e "/var/ipfire/outgoing/groups/macgroups/$configline[2]" ) { + @SOURCE = `cat /var/ipfire/outgoing/groups/macgroups/$configline[2]`; } $DEV = ""; } if ($configline[7]) { $DESTINATION = "$configline[7]"; } else { $DESTINATION = "0/0"; } - + if ($configline[3] eq 'tcp') { @PROTO = ("tcp"); } elsif ($configline[3] eq 'udp') { @@ -174,9 +186,14 @@ foreach $configentry (sort @configs) foreach $SOURCE (@SOURCE) { $SOURCE =~ s/\s//gi; - if ( $SOURCE eq "" ){next;} + if ( $SOURCE eq "" ){next;} - $CMD = "/sbin/iptables -A OUTGOINGFW -s $SOURCE -d $DESTINATION -p $PROTO"; + if ( $configline[6] ne "" ){ + $SOURCE =~ s/[^a-zA-Z0-9]/:/gi; + $CMD = "/sbin/iptables -A OUTGOINGFWMAC -m mac --mac-source $SOURCE -d $DESTINATION -p $PROTO"; + } else { + $CMD = "/sbin/iptables -A OUTGOINGFW -s $SOURCE -d $DESTINATION -p $PROTO"; + } if ($configline[8] && ( $configline[3] ne 'esp' || $configline[3] ne 'gre') ) { $DPORT = "$configline[8]"; @@ -187,11 +204,6 @@ foreach $configentry (sort @configs) $CMD = "$CMD -i $DEV"; } - if ($configline[6]) { - $MAC = "$configline[6]"; - $CMD = "$CMD -m mac --mac-source $MAC"; - } - if ($configline[17] && $configline[18]) { if ($configline[10]){$DAY = "Mon,"} if ($configline[11]){$DAY .= "Tue,"} @@ -263,10 +275,10 @@ if ( $outfwsettings{'POLICY'} eq 'MODE1' ) { } } - $CMD = "/sbin/iptables -A OUTGOINGFW -o $netsettings{'RED_DEV'} -j DROP -m comment --comment 'DROP_OUTGOINGFW'"; + $CMD = "/sbin/iptables -A OUTGOINGFW -o $netsettings{'RED_DEV'} -j DROP -m comment --comment 'DROP_OUTGOINGFW '"; if ($DEBUG) { print "$CMD\n"; } else { system("$CMD"); } -} +} \ No newline at end of file diff --git a/config/rootfiles/common/configroot b/config/rootfiles/common/configroot index abc1ee3..5f0faf3 100644 --- a/config/rootfiles/common/configroot +++ b/config/rootfiles/common/configroot @@ -102,7 +102,7 @@ var/ipfire/outgoing var/ipfire/outgoing/defaultservices #var/ipfire/outgoing/groups #var/ipfire/outgoing/groups/ipgroups -#var/ipfire/outgoing/ipgroups +#var/ipfire/outgoing/groups/macgroups #var/ipfire/outgoing/p2protocols #var/ipfire/outgoing/rules #var/ipfire/outgoing/settings diff --git a/html/cgi-bin/outgoingfw.cgi b/html/cgi-bin/outgoingfw.cgi index b746a8e..3482f35 100644 --- a/html/cgi-bin/outgoingfw.cgi +++ b/html/cgi-bin/outgoingfw.cgi @@ -321,7 +321,7 @@ END $outfwsettings{'ACTION'} = 'Add rule'; } } -if ($outfwsettings{'ACTION'} eq 'Add rule') +if ($outfwsettings{'ACTION'} eq $Lang::tr{'Add Rule'}) { &addrule(); exit @@ -343,7 +343,7 @@ if ($outfwsettings{'POLICY'} ne 'MODE0'){ &Header::openbox('100%', 'center', 'Rules'); print <<END <form method='post' action='$ENV{'SCRIPT_NAME'}'> - <input type='submit' name='ACTION' value='Add rule' /> + <input type='submit' name='ACTION' value='$Lang::tr{'Add Rule'}' /> </form> END ; @@ -462,14 +462,22 @@ END END ; if (($outfwsettings{'SIP'}) || ($outfwsettings{'SMAC'})) { - unless ($outfwsettings{'SIP'}) { $outfwsettings{'DISPLAY_SIP'} = 'ALL'; } else { $outfwsettings{'DISPLAY_SIP'} = $outfwsettings{'SIP'}; } - unless ($outfwsettings{'SMAC'}) { $outfwsettings{'DISPLAY_SMAC'} = 'ALL'; } else { $outfwsettings{'DISPLAY_SMAC'} = $outfwsettings{'SMAC'}; } - print <<END - <tr><td width='14%' align='right'>$Lang::tr{'source ip or net'}: - <td width='14%' align='left'>$outfwsettings{'DISPLAY_SIP'} - <td width='44%' colspan='2' align='center'> -END -; + + unless ($outfwsettings{'SIP'}) { + $outfwsettings{'DISPLAY_SIP'} = 'ALL'; + } else { + $outfwsettings{'DISPLAY_SIP'} = $outfwsettings{'SIP'}; + } + + unless ($outfwsettings{'SMAC'}) { + $outfwsettings{'DISPLAY_SMAC'} = 'ALL'; + print "<tr><td /><td align='left'>$Lang::tr{'source ip or net'}: </td>"; + print "<td align='left' colspan='2'>$outfwsettings{'DISPLAY_SIP'}</td>"; + } else { + $outfwsettings{'DISPLAY_SMAC'} = $outfwsettings{'SMAC'}; + print "<tr><td /><td align='left'>$Lang::tr{'source'} $Lang::tr{'mac address'}: </td>"; + print "<td align='left' colspan='2'>$outfwsettings{'DISPLAY_SMAC'}</td>"; + } } print <<END <tr><td width='14%' align='right'>$Lang::tr{'time'} - </td> @@ -627,7 +635,7 @@ print <<END <td width='30%' align='left' colspan='2'><input type='checkbox' name='ENABLED' $selected{'ENABLED'} /></td> </tr> <tr> - <td width='20%' align='right'>$Lang::tr{'protocol'}:</td> + <td width='20%' align='right'>$Lang::tr{'protocol'}</td> <td width='30%' align='left'> <select name='PROT'> <option value='all' $selected{'PROT'}{'all'}>All</option> @@ -655,6 +663,9 @@ END <select name='SNET'> <optgroup label='---'> <option value='all' $selected{'SNET'}{'ALL'}>$Lang::tr{'all'}</option> + <optgroup label='$Lang::tr{'mac address'}'> + <option value='mac' $selected{'SNET'}{'mac'}>$Lang::tr{'source'} $Lang::tr{'mac address'}</option> + </optgroup> <optgroup label='$Lang::tr{'ip address'}'> <option value='ip' $selected{'SNET'}{'ip'}>$Lang::tr{'source ip or net'}</option> <option value='red' $selected{'SNET'}{'red'}>$Lang::tr{'red'} IP</option> @@ -674,7 +685,7 @@ END } print <<END </optgroup> - <optgroup label='$Lang::tr{'advproxy NCSA group'}'> + <optgroup label='IP $Lang::tr{'advproxy NCSA group'}'> END ; my @ipgroups = qx(ls $configpath/ipgroups/); @@ -683,10 +694,26 @@ END } print <<END </optgroup> + <optgroup label='MAC $Lang::tr{'advproxy NCSA group'}'> +END +; + my @macgroups = qx(ls $configpath/macgroups/); + foreach (sort @macgroups){ + print "\t\t\t\t\t<option value='$_' $selected{'SNET'}{'$_'}>$_</option>\n"; + } + print <<END + </optgroup> </select> </td> - <td width='20%' align='right' colspan='2'>$Lang::tr{'source ip or net'}<img src='/blob.gif' /></td> - <td width='30%' align='left' colspan='2'><input type='text' name='SIP' value='$outfwsettings{'SIP'}' /></td> + <td align='right' colspan='4'><font color='red'>$Lang::tr{'outgoingfw warning'}</font></td> + </tr> + <tr> + <td align='right' colspan='4' >$Lang::tr{'source ip or net'}<img src='/blob.gif' /></td> + <td align='left' colspan='4' ><input type='text' name='SIP' value='$outfwsettings{'SIP'}' /></td> + </tr> + <tr> + <td align='right' colspan='4' >$Lang::tr{'source'} $Lang::tr{'mac address'}: <img src='/blob.gif' /> + <td align='left' colspan='4' ><input type='text' name='SMAC' maxlength='23' value='$outfwsettings{'SMAC'}' /> </tr> <tr> <td width='20%' align='right'>$Lang::tr{'logging'}:</td> diff --git a/html/cgi-bin/outgoinggrp.cgi b/html/cgi-bin/outgoinggrp.cgi index a94ac82..28e5261 100644 --- a/html/cgi-bin/outgoinggrp.cgi +++ b/html/cgi-bin/outgoinggrp.cgi @@ -48,13 +48,13 @@ my %mainsettings = (); ### Values that have to be initialized $outgrpsettings{'ACTION'} = ''; $outgrpsettings{'ipgroup'} = 'none'; -$outgrpsettings{'portgroup'} = 'none'; +$outgrpsettings{'macgroup'} = 'none'; &Header::getcgihash(\%outgrpsettings); delete $outgrpsettings{'__CGI__'};delete $outgrpsettings{'x'};delete $outgrpsettings{'y'}; $selected{'ipgroup'}{$outgrpsettings{'ipgroup'}} = "selected='selected'"; -$selected{'portgroup'}{$outgrpsettings{'portgroup'}} = "selected='selected'"; +$selected{'macgroup'}{$outgrpsettings{'macgroup'}} = "selected='selected'"; &Header::openpage($Lang::tr{'outgoing firewall groups'}, 1, ''); &Header::openbigbox('100%', 'left', '', $errormessage); @@ -75,24 +75,46 @@ $selected{'portgroup'}{$outgrpsettings{'portgroup'}} = "selected='selected'"; ############################################################################################################################ ############################################################################################################################ -if ($errormessage) -{ - &Header::openbox('100%', 'left', $Lang::tr{'error messages'}); - print "<class name='base'>$errormessage\n"; - print " </class>\n"; - &Header::closebox(); -} - if ($outgrpsettings{'ACTION'} eq 'newipgroup') { &newipgroup(); } elsif ($outgrpsettings{'ACTION'} eq 'deleteipgroup' ) { unlink("$configpath/ipgroups/$outgrpsettings{'ipgroup'}"); } elsif ($outgrpsettings{'ACTION'} eq 'addipgroup') { - open (FILE, ">$configpath/ipgroups/$outgrpsettings{'ipgroup'}") or die "Can't save $outgrpsettings{'ipgroup'} settings $!"; - flock (FILE, 2); - print FILE $outgrpsettings{'ipgroupcontent'}."\n"; - close FILE; + + if ( -e "$configpath/macgroups/$outgrpsettings{'ipgroup'}" ){ + $errormessage = "$Lang::tr{'outgoing firewall group error'}"; + } else { + open (FILE, ">$configpath/ipgroups/$outgrpsettings{'ipgroup'}") or die "Can't save $outgrpsettings{'ipgroup'} settings $!"; + flock (FILE, 2); + print FILE $outgrpsettings{'ipgroupcontent'}."\n"; + close FILE; + } +} + +if ($outgrpsettings{'ACTION'} eq 'newmacgroup') +{ + &newmacgroup(); +} elsif ($outgrpsettings{'ACTION'} eq 'deletemacgroup' ) { + unlink("$configpath/macgroups/$outgrpsettings{'macgroup'}"); +} elsif ($outgrpsettings{'ACTION'} eq 'addmacgroup') { + + if ( -e "$configpath/ipgroups/$outgrpsettings{'macgroup'}" ){ + $errormessage = "$Lang::tr{'outgoing firewall group error'}"; + } else { + open (FILE, ">$configpath/macgroups/$outgrpsettings{'macgroup'}") or die "Can't save $outgrpsettings{'macgroup'} settings $!"; + flock (FILE, 2); + print FILE $outgrpsettings{'macgroupcontent'}."\n"; + close FILE; + } +} + +if ($errormessage) +{ + &Header::openbox('100%', 'left', $Lang::tr{'error messages'}); + print "<class name='base'><font color=red>$errormessage\n</font>"; + print " </class>\n"; + &Header::closebox(); } ############################################################################################################################ @@ -107,6 +129,7 @@ $ipgroupcontent =~ s/\n/<br \/>/g; &Header::openbox('100%', 'center', $Lang::tr{'outgoing firewall ip groups'}); print <<END +<a name="outgoing showipgroup"</a> <br /> <form method='post' action='$ENV{'SCRIPT_NAME'}#outgoing showipgroup'> <table width='95%' cellspacing='0'> @@ -171,9 +194,91 @@ END ; &Header::closebox(); +############################################################################################################################ +############################################################################################################################ + +my @macgroups = qx(ls $configpath/macgroups/); +if ($outgrpsettings{'macgroup'} eq "none" and $#macgroups >= 0 ){ $outgrpsettings{'macgroup'} = $macgroups[0];} + +my $macgroupcontent = `cat $configpath/macgroups/$outgrpsettings{'macgroup'} 2>/dev/null`; +$macgroupcontent =~ s/\n/<br \/>/g; + +&Header::openbox('100%', 'center', $Lang::tr{'outgoing firewall mac groups'}); + +print <<END +<a name="outgoing showmacgroup"</a> +<br /> +<form method='post' action='$ENV{'SCRIPT_NAME'}#outgoing showmacgroup'> +<table width='95%' cellspacing='0'> + <tr> + <td bgcolor='$color{'color20'}' colspan='3' align='left'><b>$Lang::tr{'outgoing firewall mac groups'}</b></td> + </tr> + <tr> + <td colspan='3' align='left'><br /></td> + </tr> + <tr> + <td align='left' colspan='2'><select name='macgroup' style="width: 200px"> +END +; +foreach my $member (@macgroups) {chomp $member;print" <option value='$member' $selected{'macgroup'}{$member}>$member</option>\n";} +print <<END + </select></td> + <td align='left'> + <input type='hidden' name='ACTION' value='showmacgroup' /> + <input type='image' alt='$Lang::tr{'outgoing firewall view group'}' title='$Lang::tr{'outgoing firewall view group'}' src='/images/format-justify-fill.png' /> + </td> + </tr> + <tr> + <td colspan='3' align='left'><br /></td> + </tr> + <tr> + <td colspan='3' align='left'><font size=1>$macgroupcontent</font></td> + </tr> + <tr> + <td colspan='3' align='left'><br /></td> + </tr> + <tr> + <td colspan='3' align='center'><font size=1>$Lang::tr{'outgoing firewall mac groups'} - $outgrpsettings{'macgroup'}</font></td> + </tr> +</table> +</form> +<table width='10%' cellspacing='0'> +<tr> + <td align='center'> + <form method='post' action='$ENV{'SCRIPT_NAME'}#outgoing showmacgroup'> + <input type='hidden' name='ACTION' value='newmacgroup' /> + <input type='image' alt='$Lang::tr{'new'}' title='$Lang::tr{'new'}' src='/images/list-add.png' /> + </form> + </td> + <td align='center'> + <form method='post' action='$ENV{'SCRIPT_NAME'}#outgoing showmacgroup'> + <input type='hidden' name='ACTION' value='savemacgroup' /> + <input type='hidden' name='macgroup' value='$outgrpsettings{'macgroup'}' /> + <input type='image' alt='$Lang::tr{'save'}' title='$Lang::tr{'save'}' src='/images/media-floppy.png' /> + </form> + </td> + <td align='center'> + <form method='post' action='$ENV{'SCRIPT_NAME'}#outgoing showmacgroup'> + <input type='hidden' name='ACTION' value='deletemacgroup' /> + <input type='hidden' name='macgroup' value='$outgrpsettings{'macgroup'}' /> + <input type='image' alt='$Lang::tr{'delete'}' title='$Lang::tr{'delete'}' src='/images/user-trash.png' /> + </form> + </td> +</tr> +</table> + +END +; +&Header::closebox(); + &Header::closebigbox(); &Header::closepage(); + +############################################################################################################################ +############################################################################################################################ + + sub newipgroup { &Header::openbox('100%', 'center', $Lang::tr{'outgoing firewall add ip group'}); @@ -210,3 +315,40 @@ END &Header::closepage(); exit 0; } + +sub newmacgroup +{ + &Header::openbox('100%', 'center', $Lang::tr{'outgoing firewall add mac group'}); + +print <<END + <form method='post' action='$ENV{'SCRIPT_NAME'}#outgoing showmacgroup'> + <table width='95%' cellspacing='0'> + <tr> + <td bgcolor='$color{'color20'}' colspan='3' align='left'><b>$Lang::tr{'outgoing firewall add mac group'}</b></td> + </tr> + <tr> + <td colspan='3' align='left'><br /></td> + </tr> + <tr> + <td align='left' colspan='2'> + <input type='text' name='macgroup' value='newgroup' size="30" /> + </td> + <td align='left'> + <input type='hidden' name='ACTION' value='addmacgroup' /> + <input type='image' alt='$Lang::tr{'save'}' title='$Lang::tr{'save'}' src='/images/media-floppy.png' /> + </td> + </tr> + <tr> + <td align='left' colspan='3'> + <textarea name="macgroupcontent" cols="20" rows="5" Wrap="off">00:24:F6:04:5F:2b\n14:26:36:5A:5F:2B\n</textarea> + </td> + </tr> + </table> + </form> +END +; + &Header::closebox(); + &Header::closebigbox(); + &Header::closepage(); + exit 0; +} \ No newline at end of file diff --git a/langs/de/cgi-bin/de.pl b/langs/de/cgi-bin/de.pl index 7d55857..aa09abe 100644 --- a/langs/de/cgi-bin/de.pl +++ b/langs/de/cgi-bin/de.pl @@ -22,6 +22,7 @@ 'ConnSched scheduled actions' => 'Geplante Aktionen', 'ConnSched scheduler' => 'Scheduler', 'ConnSched select profile' => 'Wähle Profil', +'outgoingfw warning' => 'Nur die Auswahl Quell IP / MAC aktiviert diese', 'ConnSched time' => 'Zeit:', 'ConnSched up' => 'Hoch', 'ConnSched weekdays' => 'Wochentage:', @@ -1275,17 +1276,20 @@ 'outgoing firewall groups' => 'Firewall Gruppen', 'outgoing firewall add ip group' => 'IP Adressgruppen hinzufügen', 'outgoing firewall ip groups' => 'Ausgehende Firewall IP Adressgruppen', +'outgoing firewall add mac group' => 'MAC Adressgruppen hinzufügen', +'outgoing firewall mac groups' => 'Ausgehende Firewall MAC Adressgruppen', 'outgoing firewall view group' => 'Gruppe anzeigen', +'outgoing firewall group error' => 'Eine Gruppe mit dem selben Namen existiert bereits.', 'outgoing traffic in bytes per second' => 'Abgehender Verkehr', -'outgoingfw mode0' => 'In diesem Modus ist es allen Rechnern im Netzwerk uneingeschränkt möglich Verbindungen ins Internet aufzubauen.', -'outgoingfw mode1' => 'In diesem Modus werden nur Verbindungen nach den oben definierten Regeln zugelassen.', -'outgoingfw mode2' => 'In diesem Modus werden sämtliche Verbindungen erlaubt, bis auf die oben definierten Block-Regeln.', -'outgoingfw p2p description 1' => 'Das Symbol', -'outgoingfw p2p description 2' => 'bedeutet, dass das P2P-Protokoll erlaubt wird oder', -'outgoingfw p2p description 3' => 'das P2P-Protokoll gesperrt wird.', -'outgoingfw p2p deny' => 'P2P-Protokoll ist gesperrt!', -'outgoingfw p2p allow' => 'P2P-Protokoll ist erlaubt!', -'outgoingfw reset' => 'Alle Regeln löschen', +'outgoing firewall mode0' => 'In diesem Modus ist es allen Rechnern im Netzwerk uneingeschränkt möglich Verbindungen ins Internet aufzubauen.', +'outgoing firewall mode1' => 'In diesem Modus werden nur Verbindungen nach den oben definierten Regeln zugelassen.', +'outgoing firewall mode2' => 'In diesem Modus werden sämtliche Verbindungen erlaubt, bis auf die oben definierten Block-Regeln.', +'outgoing firewall p2p description 1' => 'Das Symbol', +'outgoing firewall p2p description 2' => 'bedeutet, dass das P2P-Protokoll erlaubt wird oder', +'outgoing firewall p2p description 3' => 'das P2P-Protokoll gesperrt wird.', +'outgoing firewall p2p deny' => 'P2P-Protokoll ist gesperrt!', +'outgoing firewall p2p allow' => 'P2P-Protokoll ist erlaubt!', +'outgoing firewall reset' => 'Alle Regeln löschen', 'override mtu' => 'Überschreibe Standard MTU', 'ovpn' => 'OpenVPN', 'ovpn con stat' => 'OpenVPN Verbindungs-Statistik', diff --git a/langs/en/cgi-bin/en.pl b/langs/en/cgi-bin/en.pl index a66ec67..7fbeb39 100644 --- a/langs/en/cgi-bin/en.pl +++ b/langs/en/cgi-bin/en.pl @@ -19,6 +19,7 @@ 'ConnSched ipsecstop' => 'IPSec stop', 'ConnSched reconnect' => 'Reconnect', 'ConnSched scheduled actions' => 'Scheduled actions', +'outgoingfw warning' => 'Not selecting source ip or mac ignores them', 'ConnSched scheduler' => 'Scheduler', 'ConnSched select profile' => 'Select profile', 'modify' => 'Modify', @@ -1304,17 +1305,20 @@ 'outgoing firewall groups' => 'Firewall Groups', 'outgoing firewall add ip group' => 'Add IP Address Group', 'outgoing firewall ip groups' => 'Outgoing Firewall IP Adress Groups', +'outgoing firewall add mac group' => 'Add MAC Address Group', +'outgoing firewall mac groups' => 'Outgoing Firewall MAC Adress Groups', 'outgoing firewall view group' => 'View group', +'outgoing firewall group error' => 'A group with the same name exists.', 'outgoing traffic in bytes per second' => 'Outgoing Traffic', -'outgoingfw mode0' => 'Using this mode, all clients are able to access the internet without any restrictions.', -'outgoingfw mode1' => 'Using this mode, only connections based on the defined rules are allowed.', -'outgoingfw mode2' => 'Using this mode, all connections are allowed despited off the defined ones.', -'outgoingfw p2p description 1' => 'The button', -'outgoingfw p2p description 2' => 'means that the p2p protocol is allowed or', -'outgoingfw p2p description 3' => 'that the p2p protocol is denied.', -'outgoingfw p2p deny' => 'p2p protocol is denied', -'outgoingfw p2p allow' => 'p2p protocol is allowed', -'outgoingfw reset' => 'Reset all', +'outgoing firewall mode0' => 'Using this mode, all clients are able to access the internet without any restrictions.', +'outgoing firewall mode1' => 'Using this mode, only connections based on the defined rules are allowed.', +'outgoing firewall mode2' => 'Using this mode, all connections are allowed despited off the defined ones.', +'outgoing firewall p2p description 1' => 'The button', +'outgoing firewall p2p description 2' => 'means that the p2p protocol is allowed or', +'outgoing firewall p2p description 3' => 'that the p2p protocol is denied.', +'outgoing firewall p2p deny' => 'p2p protocol is denied', +'outgoing firewall p2p allow' => 'p2p protocol is allowed', +'outgoing firewall reset' => 'Reset all', 'override mtu' => 'Override default MTU', 'ovpn' => 'OpenVPN', 'ovpn con stat' => 'OpenVPN Connection Statistics', diff --git a/langs/es/cgi-bin/es.pl b/langs/es/cgi-bin/es.pl index 5a2fbe3..8b7d293 100644 --- a/langs/es/cgi-bin/es.pl +++ b/langs/es/cgi-bin/es.pl @@ -18,6 +18,7 @@ 'ConnSched ipsecstop' => 'Detener IPSec', 'ConnSched reconnect' => 'Reconectar', 'ConnSched scheduled actions' => 'Acciones planificadas', +'outgoingfw warning' => 'No seleccionar ip origen o mac las ignora', 'ConnSched scheduler' => 'Planificador', 'ConnSched select profile' => 'Elegir Perfil', 'modify' => 'Modificar', @@ -1300,11 +1301,11 @@ 'outgoing' => 'salida', 'outgoing firewall' => 'Firewall de salida', 'outgoing traffic in bytes per second' => 'Tráfico de salida', -'outgoingfw mode0' => 'Usando este modo, todos los clientes tienen acceso al internet sin restricciones.', -'outgoingfw mode1' => 'Usando este modo, solamente las conexión basadas en las reglas definidas son permitidas.', -'outgoingfw mode2' => 'Usando este modo, todas las conexioens son permitidas sin importar las ya definidias.', -'outgoingfw p2p description' => 'Presiones el botón correspondiente para activar/desactivar el módulo de bloqueo P2P', -'outgoingfw reset' => 'Restablecer todo', +'outgoing firewall mode0' => 'Usando este modo, todos los clientes tienen acceso al internet sin restricciones.', +'outgoing firewall mode1' => 'Usando este modo, solamente las conexión basadas en las reglas definidas son permitidas.', +'outgoing firewall mode2' => 'Usando este modo, todas las conexioens son permitidas sin importar las ya definidias.', +'outgoing firewall p2p description' => 'Presiones el botón correspondiente para activar/desactivar el módulo de bloqueo P2P', +'outgoing firewall reset' => 'Restablecer todo', 'override mtu' => 'Sobreescribir MTU por defecto', 'ovpn' => 'OpenVPN', 'ovpn con stat' => 'Estadisticas de conexión OpenVPN', diff --git a/langs/fr/cgi-bin/fr.pl b/langs/fr/cgi-bin/fr.pl index dbc11bf..7d76c78 100644 --- a/langs/fr/cgi-bin/fr.pl +++ b/langs/fr/cgi-bin/fr.pl @@ -18,6 +18,7 @@ 'ConnSched ipsecstart' => 'IPSec (re)démarrage', 'ConnSched ipsecstop' => 'IPSec arrêt', 'ConnSched reconnect' => 'Reconnecter', +'outgoingfw warning' => 'Ne pas choisir IP source ou Mac ignore les', 'ConnSched scheduled actions' => 'Actions planifiées', 'ConnSched scheduler' => 'Planificateur', 'ConnSched select profile' => 'Sélectionner profil', @@ -1301,17 +1302,20 @@ 'outgoing firewall groups' => 'Groupes de pare-feu', 'outgoing firewall add ip group' => 'Ajouter un groupe d\'adresses IP', 'outgoing firewall ip groups' => 'Groupes d\'adresses IP du pare-feu sortant', +'outgoing firewall add mac group' => 'Ajouter un groupe d\'adresses MAC', +'outgoing firewall mac groups' => 'Groupes d\'adresses MAC du pare-feu sortant', 'outgoing firewall view group' => 'Voir le groupe', +'outgoing firewall group error' => 'Un groupe portant le même nom existe.', 'outgoing traffic in bytes per second' => 'Trafic sortant', -'outgoingfw mode0' => 'En utilisant ce mode, tous les clients peuvent avoir accès à Internet sans restrictions.', -'outgoingfw mode1' => 'En utilisant ce mode, seules les connexions basées sur les règles prédéfinies sont autorisées.', -'outgoingfw mode2' => 'En utilisant ce mode, toutes les connexions sont autorisées sans tenir compte de la liste de définitions.', -'outgoingfw p2p description 1' => 'Le bouton', -'outgoingfw p2p description 2' => ' signifie que le protocol est autorisé ou', -'outgoingfw p2p description 3' => 'que le protocole p2p est bloqué.', -'outgoingfw p2p deny' => 'le protocole p2p est refusé', -'outgoingfw p2p allow' => 'le protocole p2p est autorisé', -'outgoingfw reset' => 'Tout réinitialiser', +'outgoing firewall mode0' => 'En utilisant ce mode, tous les clients peuvent avoir accès à Internet sans restrictions.', +'outgoing firewall mode1' => 'En utilisant ce mode, seules les connexions basées sur les règles prédéfinies sont autorisées.', +'outgoing firewall mode2' => 'En utilisant ce mode, toutes les connexions sont autorisées sans tenir compte de la liste de définitions.', +'outgoing firewall p2p description 1' => 'Le bouton', +'outgoing firewall p2p description 2' => ' signifie que le protocol est autorisé ou', +'outgoing firewall p2p description 3' => 'que le protocole p2p est bloqué.', +'outgoing firewall p2p deny' => 'le protocole p2p est refusé', +'outgoing firewall p2p allow' => 'le protocole p2p est autorisé', +'outgoing firewall reset' => 'Tout réinitialiser', 'override mtu' => 'Outrepasser le MTU par défaut', 'ovpn' => 'OpenVPN', 'ovpn con stat' => 'Statistiques de connexions OpenVPN', diff --git a/lfs/configroot b/lfs/configroot index 544bb25..ff1a206 100644 --- a/lfs/configroot +++ b/lfs/configroot @@ -51,12 +51,12 @@ $(TARGET) : # Create all directories for i in addon-lang auth backup ca certs connscheduler crls ddns dhcp dhcpc dmzholes dns \ - ethernet extrahd/bin fwlogs isdn key langs logging mac main menu.d modem net-traffic \ + ethernet extrahd/bin fwlogs isdn key langs logging mac main menu.d modem net-traffic \ net-traffic/templates nfs optionsfw outgoing/bin outgoing/groups outgoing/groups/ipgroups \ - patches pakfire portfw ppp private proxy/advanced/cre proxy/calamaris/bin qos/bin red \ - remote sensors snort time tripwire/report updatexlrator/bin updatexlrator/autocheck \ - urlfilter/autoupdate urlfilter/bin upnp vpn \ - wakeonlan wireless xtaccess ; do \ + outgoing/groups/macgroups patches pakfire portfw ppp private proxy/advanced/cre \ + proxy/calamaris/bin qos/bin red remote sensors snort time tripwire/report \ + updatexlrator/bin updatexlrator/autocheck urlfilter/autoupdate urlfilter/bin upnp vpn \ + wakeonlan wireless xtaccess ; do \ mkdir -p $(CONFIG_ROOT)/$$i; \ done diff --git a/src/initscripts/init.d/firewall b/src/initscripts/init.d/firewall index c38cce5..b9f3908 100644 --- a/src/initscripts/init.d/firewall +++ b/src/initscripts/init.d/firewall @@ -147,6 +147,7 @@ case "$1" in /sbin/iptables -N CUSTOMOUTPUT /sbin/iptables -A OUTPUT -j CUSTOMOUTPUT /sbin/iptables -N OUTGOINGFW + /sbin/iptables -N OUTGOINGFWMAC /sbin/iptables -A OUTPUT -j OUTGOINGFW /sbin/iptables -t nat -N CUSTOMPREROUTING /sbin/iptables -t nat -A PREROUTING -j CUSTOMPREROUTING @@ -183,6 +184,8 @@ case "$1" in # Outgoing Firewall /sbin/iptables -A FORWARD -j OUTGOINGFW + /sbin/iptables -A FORWARD -j OUTGOINGFWMAC + /sbin/iptables -A INPUT -j OUTGOINGFWMAC # localhost and ethernet. /sbin/iptables -A INPUT -i lo -m state --state NEW -j ACCEPT hooks/post-receive -- IPFire 2.x development tree

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

IPFire-SCM September 2010