[git.ipfire.org] IPFire 2.x development tree branch, fifteen, updated. cbc6219852bbb1162469e5a002e1c923e7e4fad9 - IPFire-SCM

8 Nov 2013

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "IPFire 2.x development tree".
The branch, fifteen has been updated
       via  cbc6219852bbb1162469e5a002e1c923e7e4fad9 (commit)
       via  f8cbcb7c8ac944c54c57023fe7951ac1770941c2 (commit)
       via  7b82bee7c4886652ef64f639fd877daa727d1348 (commit)
       via  84ac1131b1789de9c0ff76a24190b508c4101806 (commit)
       via  ab4876ad4221acad2e62bbb7fe7f92ba45099806 (commit)
      from  89f8ad0e9966e0d78cbafcb6eedce4ed7bd4b133 (commit)
Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.
- Log -----------------------------------------------------------------
commit cbc6219852bbb1162469e5a002e1c923e7e4fad9
Author: Alexander Marx amarx@ipfire.org
Date:   Tue Nov 5 13:47:56 2013 +0100
Firewall: Fix typo in backup script which stops the conversion of old firewallrules
commit f8cbcb7c8ac944c54c57023fe7951ac1770941c2
Author: Alexander Marx amarx@ipfire.org
Date:   Mon Nov 4 08:04:44 2013 +0100
Firewall: Bugfix: When creating a servcie in firewall-groups and selecting a protocol other than icmp, the enty in the ruletable shows correct values PLUS the "all icmp-types" under ICMP.
    Now the ICMP FIeld is emtpy when selecting another protocol than icmp
commit 7b82bee7c4886652ef64f639fd877daa727d1348
Author: Alexander Marx amarx@ipfire.org
Date:   Fri Nov 8 13:40:24 2013 +0100
Firewall: Bugfix: When creating a rule and using brackets in comment, the rule is denied because of invalid characters in String. But when creating a rule with just valid characters (witjout brackets) and then editing the rule it is possible to use brackets without errormessage.
    Now brackets are allowed.
commit 84ac1131b1789de9c0ff76a24190b508c4101806
Author: Alexander Marx amarx@ipfire.org
Date:   Mon Nov 4 07:31:31 2013 +0100
Firewall: remove /var/ipfire/portfw as it is not used anymore
commit ab4876ad4221acad2e62bbb7fe7f92ba45099806
Author: Michael Tremer michael.tremer@ipfire.org
Date:   Fri Nov 8 13:38:09 2013 +0100
firewall: Don't require to enable the RW server for N2N networks.
The firewall rules for OpenVPN have not been applied for N2N
    connections when the road warrior server was disabled.
-----------------------------------------------------------------------
Summary of changes:
 config/backup/backup.pl            |   2 +-
 config/rootfiles/common/configroot |   2 +-
 html/cgi-bin/firewall.cgi          |   2 +-
 html/cgi-bin/fwhosts.cgi           |   1 +
 src/initscripts/init.d/firewall    |   8 ++-
 src/misc-progs/openvpnctrl.c       | 144 +++++--------------------------------
 6 files changed, 28 insertions(+), 131 deletions(-)
Difference in files:

diff --git a/config/backup/backup.pl b/config/backup/backup.pl
index 5424a1e..a56a698 100644
--- a/config/backup/backup.pl
+++ b/config/backup/backup.pl
@@ -120,7 +120,7 @@ elsif ($ARGV[0] eq 'restore') {
   #PORTFORWARD CONVERTER
   if( -d "${General::swroot}/portfw"){
    #START CONVERTER "PORTFW"
-	System("/usr/sbin/convert-portfw");
+	system("/usr/sbin/convert-portfw");
    rmtree("${General::swroot}/portfw");
   }
   system("/usr/local/bin/firewallctrl");
diff --git a/config/rootfiles/common/configroot b/config/rootfiles/common/configroot
index 7fdc983..795bdb1 100644
--- a/config/rootfiles/common/configroot
+++ b/config/rootfiles/common/configroot
@@ -134,7 +134,7 @@ var/ipfire/ovpn
 var/ipfire/pakfire
 #var/ipfire/pakfire/settings
 #var/ipfire/patches
-var/ipfire/portfw
+#var/ipfire/portfw
 #var/ipfire/portfw/config
 var/ipfire/ppp
 #var/ipfire/ppp/fake-resolv.conf
diff --git a/html/cgi-bin/firewall.cgi b/html/cgi-bin/firewall.cgi
index 0b7c6fc..3e4e3b0 100755
--- a/html/cgi-bin/firewall.cgi
+++ b/html/cgi-bin/firewall.cgi
@@ -2355,7 +2355,7 @@ sub validremark
    if ($remark !~ /^[a-zäöüA-ZÖÄÜ0-9-.:;|_()/\s]*$/) {
    	return 0;}
    # First character can only be a letter or a digit
-	if (substr ($remark, 0, 1) !~ /^[a-zäöüA-ZÖÄÜ0-9]*$/) {
+	if (substr ($remark, 0, 1) !~ /^[a-zäöüA-ZÖÄÜ0-9(]*$/) {
    	return 0;}
    # Last character can only be a letter or a digit
    if (substr ($remark, -1, 1) !~ /^[a-zöäüA-ZÖÄÜ0-9.:;_)]*$/) {
diff --git a/html/cgi-bin/fwhosts.cgi b/html/cgi-bin/fwhosts.cgi
index fd66a49..91de897 100755
--- a/html/cgi-bin/fwhosts.cgi
+++ b/html/cgi-bin/fwhosts.cgi
@@ -741,6 +741,7 @@ if ($fwhostsettings{'ACTION'} eq 'saveservice')
    	}
    }
    if($ICMP eq ''){$ICMP=$fwhostsettings{'ICMP_TYPES'};}
+	if ($fwhostsettings{'PROT'} ne 'ICMP'){$ICMP='';}
    if (!$errormessage){
    	my $key = &General::findhasharraykey (%customservice);
    	foreach my $i (0 .. 4) { $customservice{$key}[$i] = "";}
diff --git a/src/initscripts/init.d/firewall b/src/initscripts/init.d/firewall
index 36d7e44..37ef351 100644
--- a/src/initscripts/init.d/firewall
+++ b/src/initscripts/init.d/firewall
@@ -159,6 +159,10 @@ iptables_init() {
    /sbin/iptables -N WIRELESSFORWARD
    /sbin/iptables -A FORWARD -m conntrack --ctstate NEW -j WIRELESSFORWARD
+	# OpenVPN
+	/sbin/iptables -N OVPNINPUT
+	/sbin/iptables -A INPUT -j OVPNINPUT
+
    # TOR
    /sbin/iptables -N TOR_INPUT
    /sbin/iptables -A INPUT -j TOR_INPUT
@@ -206,8 +210,8 @@ iptables_init() {
    	/etc/sysconfig/firewall.local start
    fi
-	# run openvpn
-	/usr/local/bin/openvpnctrl --create-chains-and-rules
+	# Apply OpenVPN firewall rules
+	/usr/local/bin/openvpnctrl --firewall-rules
# run wirelessctrl
    /usr/local/bin/wirelessctrl
diff --git a/src/misc-progs/openvpnctrl.c b/src/misc-progs/openvpnctrl.c
index 2577788..2af5372 100644
--- a/src/misc-progs/openvpnctrl.c
+++ b/src/misc-progs/openvpnctrl.c
@@ -25,12 +25,10 @@ char enableblue[STRING_SIZE] = "off";
 char enableorange[STRING_SIZE] = "off";
// consts
-char OVPNRED[STRING_SIZE] = "OVPN";
-char OVPNBLUE[STRING_SIZE] = "OVPN_BLUE_";
-char OVPNORANGE[STRING_SIZE] = "OVPN_ORANGE_";
+char OVPNINPUT[STRING_SIZE] = "OVPNINPUT";
 char OVPNBLOCK[STRING_SIZE] = "OVPNBLOCK";
 char OVPNNAT[STRING_SIZE] = "OVPNNAT";
-char WRAPPERVERSION[STRING_SIZE] = "ipfire-2.2.3";
+char WRAPPERVERSION[STRING_SIZE] = "ipfire-2.2.4";
struct connection_struct {
    char name[STRING_SIZE];
@@ -40,7 +38,7 @@ struct connection_struct {
    char local_subnet[STRING_SIZE];
    char transfer_subnet[STRING_SIZE];
    char role[STRING_SIZE];
-	int port;
+	char port[STRING_SIZE];
    struct connection_struct *next;
 };
@@ -81,10 +79,6 @@ void usage(void)
    printf("      removes current OpenVPN chains and rules and resets them according to the config\n");
    printf(" -sdo --start-daemon-only\n");
    printf("      starts OpenVPN daemon only\n");
-	printf(" -ccr --create-chains-and-rules\n");
-	printf("      creates chains and rules for OpenVPN\n");
-	printf(" -dcr --delete-chains-and-rules\n");
-	printf("      removes all chains for OpenVPN\n");
    exit(1);
 }
@@ -149,7 +143,7 @@ connection *getConnections() {
    		} else if (count == 29) {
    			strcpy(conn_curr->proto, result);
    		} else if (count == 30) {
-				conn_curr->port = atoi(result);
+				strcpy(conn_curr->port, result);
    		}
count++;
@@ -242,111 +236,28 @@ void executeCommand(char *command) {
    safe_system(strncat(command, " >/dev/null 2>&1", 17));
 }
-void setChainRules(char *chain, char *interface, char *protocol, char *port)
-{
-	char str[STRING_SIZE];
+void addRule(const char *chain, const char *interface, const char *protocol, const char *port) {
+	char command[STRING_SIZE];
-	sprintf(str, "/sbin/iptables -A %sINPUT -i %s -p %s --dport %s -j ACCEPT", chain, interface, protocol, port);
-	executeCommand(str);
+	snprintf(command, STRING_SIZE - 1, "/sbin/iptables -A %s -i %s -p %s --dport %s -j ACCEPT",
+		chain, interface, protocol, port);
+	executeCommand(command);
 }
void flushChain(char *chain) {
    char str[STRING_SIZE];
-	sprintf(str, "/sbin/iptables -F %s", chain);
+	snprintf(str, STRING_SIZE - 1, "/sbin/iptables -F %s", chain);
    executeCommand(str);
 }
void flushChainNAT(char *chain) {
    char str[STRING_SIZE];
-	sprintf(str, "/sbin/iptables -t nat -F %s", chain);
-	executeCommand(str);
-}
-
-void flushChainINPUT(char *chain) {
-	char str[STRING_SIZE];
-
-	snprintf(str, STRING_SIZE, "%sINPUT", chain);
-	flushChain(str);
-}
-
-void deleteChainReference(char *chain) {
-	char str[STRING_SIZE];
-
-	sprintf(str, "/sbin/iptables -D INPUT -j %sINPUT", chain);
-	executeCommand(str);
-}
-
-void deleteChain(char *chain) {
-	char str[STRING_SIZE];
-
-	sprintf(str, "/sbin/iptables -X %sINPUT", chain);
-	executeCommand(str);
-}
-
-void deleteAllChains(void) {
-	// not an elegant solution, but to avoid timing problems with undeleted chain references
-	deleteChainReference(OVPNRED);
-	deleteChainReference(OVPNBLUE);
-	deleteChainReference(OVPNORANGE);
-	flushChainINPUT(OVPNRED);
-	flushChainINPUT(OVPNBLUE);
-	flushChainINPUT(OVPNORANGE);
-	deleteChain(OVPNRED);
-	deleteChain(OVPNBLUE);
-	deleteChain(OVPNORANGE);
-
-	// Only flush chains that are created by the firewall
-	flushChain(OVPNBLOCK);
-	flushChainNAT(OVPNNAT);
-}
-
-void createChainReference(char *chain) {
-	char str[STRING_SIZE];
-	sprintf(str, "/sbin/iptables -I INPUT %s -j %sINPUT", "14", chain);
-	executeCommand(str);
-}
-
-void createChain(char *chain) {
-	char str[STRING_SIZE];
-	sprintf(str, "/sbin/iptables -N %sINPUT", chain);
+	snprintf(str, STRING_SIZE - 1, "/sbin/iptables -t nat -F %s", chain);
    executeCommand(str);
 }
-void createAllChains(void) {
-	// create chain and chain references
-	if (!strcmp(enableorange, "on")) {
-		if (strlen(orangeif) > 0) {
-			createChain(OVPNORANGE);
-			createChainReference(OVPNORANGE);
-		} else {
-			fprintf(stderr, "OpenVPN enabled on orange but no orange interface found\n");
-			//exit(1);
-		}
-	}
-
-	if (!strcmp(enableblue, "on")) {
-		if (strlen(blueif) > 0) {
-			createChain(OVPNBLUE);
-			createChainReference(OVPNBLUE);
-		} else {
-			fprintf(stderr, "OpenVPN enabled on blue but no blue interface found\n");
-			//exit(1);
-		}
-	}
-
-	if (!strcmp(enablered, "on")) {
-		if (strlen(redif) > 0) {
-			createChain(OVPNRED);
-			createChainReference(OVPNRED);
-		} else {
-			fprintf(stderr, "OpenVPN enabled on red but no red interface found\n");
-			//exit(1);
-		}
-	}
-}
-
 char* calcTransferNetAddress(const connection* conn) {
    char *subnetmask = strdup(conn->transfer_subnet);
    char *address = strsep(&subnetmask, "/");
@@ -459,19 +370,17 @@ void setFirewallRules(void) {
    freekeyvalues(kv);
// Flush all chains.
-	flushChainINPUT(OVPNRED);
-	flushChainINPUT(OVPNBLUE);
-	flushChainINPUT(OVPNORANGE);
+	flushChain(OVPNINPUT);
    flushChain(OVPNBLOCK);
    flushChainNAT(OVPNNAT);
// set firewall rules
    if (!strcmp(enablered, "on") && strlen(redif))
-		setChainRules(OVPNRED, redif, protocol, dport);
+		addRule(OVPNINPUT, redif, protocol, dport);
    if (!strcmp(enableblue, "on") && strlen(blueif))
-		setChainRules(OVPNBLUE, blueif, protocol, dport);
+		addRule(OVPNINPUT, blueif, protocol, dport);
    if (!strcmp(enableorange, "on") && strlen(orangeif))
-		setChainRules(OVPNORANGE, orangeif, protocol, dport);
+		addRule(OVPNINPUT, orangeif, protocol, dport);
// read connection configuration
    connection *conn = getConnections();
@@ -482,12 +391,10 @@ void setFirewallRules(void) {
    char *transfer_subnet_address = NULL;
    while (conn != NULL) {
    	if (strcmp(conn->type, "net") == 0) {
-			sprintf(command, "/sbin/iptables -A %sINPUT -i %s -p %s --dport %d -j ACCEPT",
-				OVPNRED, redif, conn->proto, conn->port);
-			executeCommand(command);
+			addRule(OVPNINPUT, redif, conn->proto, conn->port);
/* Block all communication from the transfer nets. */
-			snprintf(command, STRING_SIZE, "/sbin/iptables -A %s -s %s -j DROP",
+			snprintf(command, STRING_SIZE - 1, "/sbin/iptables -A %s -s %s -j DROP",
    			OVPNBLOCK, conn->transfer_subnet);
    		executeCommand(command);
@@ -495,7 +402,7 @@ void setFirewallRules(void) {
    		transfer_subnet_address = calcTransferNetAddress(conn);
if ((local_subnet_address) && (transfer_subnet_address)) {
-				snprintf(command, STRING_SIZE, "/sbin/iptables -t nat -A %s -s %s -j SNAT --to-source %s",
+				snprintf(command, STRING_SIZE - 1, "/sbin/iptables -t nat -A %s -s %s -j SNAT --to-source %s",
    				OVPNNAT, transfer_subnet_address, local_subnet_address);
    			executeCommand(command);
    		}
@@ -705,16 +612,10 @@ int main(int argc, char *argv[]) {
    		displayopenvpn();
    		return 0;
    	}
-		else if( (strcmp(argv[1], "-dcr") == 0) || (strcmp(argv[1], "--delete-chains-and-rules") == 0) ) {
-			deleteAllChains();
-			return 0;
-		}
    	else {
    		ovpnInit();
    		
    		if( (strcmp(argv[1], "-s") == 0) || (strcmp(argv[1], "--start") == 0) ) {
-				deleteAllChains();
-				createAllChains();
    			setFirewallRules();
    			startDaemon();
    			return 0;
@@ -733,20 +634,11 @@ int main(int argc, char *argv[]) {
    		}
    		else if( (strcmp(argv[1], "-r") == 0) || (strcmp(argv[1], "--restart") == 0) ) {
    			stopDaemon();
-				deleteAllChains();
-				createAllChains();
    			setFirewallRules();
    			startDaemon();
    			return 0;
    		}
    		else if( (strcmp(argv[1], "-fwr") == 0) || (strcmp(argv[1], "--firewall-rules") == 0) ) {
-				deleteAllChains();
-				createAllChains();
-				setFirewallRules();
-				return 0;
-			}
-			else if( (strcmp(argv[1], "-ccr") == 0) || (strcmp(argv[1], "--create-chains-and-rules") == 0) ) {
-				createAllChains();
    			setFirewallRules();
    			return 0;
    		}
hooks/post-receive
--
IPFire 2.x development tree

    