From mboxrd@z Thu Jan 1 00:00:00 1970 From: git@ipfire.org To: ipfire-scm@lists.ipfire.org Subject: [git.ipfire.org] IPFire 2.x development tree branch, fifteen, updated. 5b0bc4ca3d5609bed04a34284b5f746616f768f1 Date: Sat, 12 Oct 2013 21:01:23 +0200 Message-ID: <20131012190123.A8FC1208D8@argus.ipfire.org> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============3717807491977322408==" List-Id: --===============3717807491977322408== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, fifteen has been updated via 5b0bc4ca3d5609bed04a34284b5f746616f768f1 (commit) via 3af3ecd319bdcf8db27e9ca14af72383b4754567 (commit) via 433b7aa8e95f4b075fd259257c61c96a29e03830 (commit) via 64e822fb45db06af7a7e7ddc94961840d5bd1158 (commit) via 90f8339a42506ca95dacb820914881bc922f19db (commit) via 6e62882de69ad42efcb4c3c2097abb5d5c54666c (commit) via 58bda09b683311db948fb5be06b1521386286f03 (commit) via 95c86656e70af668d25f0a33afb3913ee5e2ded0 (commit) via e6e9a8117677eca8319982ce56aa72e93c9b407e (commit) via 73c39dd4bda322d7d9240651c6db003bff477670 (commit) via 9f6da934a3b635f5c9f96ab737977dad2582e498 (commit) via b4f94285ff8ef9b347ee6f3e6fdb53e998ef63dd (commit) via 03dd9a2949d953e15bdaceab07af5649bfb21bd5 (commit) via a4c7bf6b73e5a2faae948188591d50cedbf18de3 (commit) via 40d505ea08931038fba56ee3a8da5053ad7ed389 (commit) via bcd9852e2ee73b741f5996ecc05ba3758d330fb8 (commit) via 753bb74ce55d5107d3e8001ed5c15f462261aab3 (commit) via 2ad3c084eef6d82a8690e5d488d84c61e892ef4e (commit) via 285de10662731bb67e946e7e112bb4cf892173bf (commit) via 4c27368a7bc135dc4443711c4eeabec0885ce1ff (commit) via 3bb77d08a689ef0b4ebaa88f48a684fe85ec580d (commit) via 16ba0c00d0d7b223682ab161c23af71315f6826a (commit) via fadcfb73203c97e7062828eb77360b4382555943 (commit) via a0a5efd7684e90f8dd8e465f1b54ec4fd043ae4d (commit) via 71670b91cccc3500d03605673f3966d669c93d70 (commit) via 2aeb4b256eb99c8971da60a5dff6bd3929270798 (commit) from 2dcea58cc2faf39bd170cef7366f05e940c62751 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 5b0bc4ca3d5609bed04a34284b5f746616f768f1 Merge: 2dcea58 3af3ecd Author: Michael Tremer Date: Sat Oct 12 21:01:13 2013 +0200 Merge commit '3af3ecd319bdcf8db27e9ca14af72383b4754567' into fifteen commit 3af3ecd319bdcf8db27e9ca14af72383b4754567 Author: Alexander Marx Date: Wed Oct 9 10:31:35 2013 +0200 Firewall: fix rules.pl when using custom hosts/networks and services no r= ule was applied because no protokoll could be found Also extended JS code to correctly show ICMP Types only, if NO Targetport= is selcted commit 433b7aa8e95f4b075fd259257c61c96a29e03830 Author: Alexander Marx Date: Wed Oct 9 08:23:57 2013 +0200 Firewall: fixed typo in en.pl "Add new hetwork"-> "Add new network" commit 64e822fb45db06af7a7e7ddc94961840d5bd1158 Author: Alexander Marx Date: Tue Oct 8 10:24:56 2013 +0200 Firewall: Bugfix: when deleting services from a servicegroup,it was possi= ble to delete the last service even if the group was used in a rule. commit 90f8339a42506ca95dacb820914881bc922f19db Author: Alexander Marx Date: Tue Oct 8 10:08:09 2013 +0200 Firewall: Bugfix: WHen using servicegroup with only ICMP services, the ru= letable was broken. Also fixed another useless if clause in rules.pl commit 6e62882de69ad42efcb4c3c2097abb5d5c54666c Author: Alexander Marx Date: Mon Oct 7 14:54:57 2013 +0200 Firewall: fix senseless if clause in rulecreation commit 58bda09b683311db948fb5be06b1521386286f03 Merge: 95c8665 e6e9a81 Author: Alexander Marx Date: Mon Oct 7 07:25:42 2013 +0200 Merge branch 'firewall-fifteen' of ssh://git.ipfire.org/pub/git/people/am= arx/ipfire-2.x into firewall-fifteen commit 95c86656e70af668d25f0a33afb3913ee5e2ded0 Merge: 9f6da93 1a3dbe9 Author: Alexander Marx Date: Mon Oct 7 07:25:19 2013 +0200 Merge branch 'fifteen' of ssh://git.ipfire.org/pub/git/ipfire-2.x into fi= rewall-fifteen commit e6e9a8117677eca8319982ce56aa72e93c9b407e Author: Alexander Marx Date: Sat Oct 5 13:50:35 2013 +0200 Firewall: added some more plausichecks and additional errormessages commit 73c39dd4bda322d7d9240651c6db003bff477670 Merge: 03dd9a2 5c86caa Author: Alexander Marx Date: Sat Oct 5 13:31:22 2013 +0200 Merge branch 'fifteen' of ssh://git.ipfire.org/pub/git/ipfire-2.x into fi= rewall-fifteen commit 9f6da934a3b635f5c9f96ab737977dad2582e498 Merge: b4f9428 03dd9a2 Author: Alexander Marx Date: Fri Oct 4 08:09:18 2013 +0200 Merge branch 'firewall-fifteen' of ssh://git.ipfire.org/pub/git/people/am= arx/ipfire-2.x into firewall-fifteen commit b4f94285ff8ef9b347ee6f3e6fdb53e998ef63dd Merge: bcd9852 71ed067 Author: Alexander Marx Date: Fri Oct 4 07:17:15 2013 +0200 Merge branch 'fifteen' of ssh://git.ipfire.org/pub/git/ipfire-2.x into fi= rewall-fifteen commit 03dd9a2949d953e15bdaceab07af5649bfb21bd5 Author: Alexander Marx Date: Thu Oct 3 12:01:19 2013 +0200 Firewall: fixed JS code for toggeling div areas commit a4c7bf6b73e5a2faae948188591d50cedbf18de3 Author: Alexander Marx Date: Wed Oct 2 21:28:50 2013 +0200 Firewall: Reorganized layout of rulecreationpage =20 Protocol is now an extra area containing protocol, ICMP-Type and source/target ports commit 40d505ea08931038fba56ee3a8da5053ad7ed389 Merge: 753bb74 5b6acb8 Author: Alexander Marx Date: Wed Oct 2 21:15:22 2013 +0200 Merge branch 'fifteen' of ssh://git.ipfire.org/pub/git/ipfire-2.x into fi= rewall-fifteen commit bcd9852e2ee73b741f5996ecc05ba3758d330fb8 Merge: 285de10 ec36876 Author: Alexander Marx Date: Wed Oct 2 07:22:10 2013 +0200 Merge branch 'fifteen' of ssh://git.ipfire.org/pub/git/ipfire-2.x into fi= rewall-fifteen commit 753bb74ce55d5107d3e8001ed5c15f462261aab3 Merge: 2ad3c08 ec36876 Author: Alexander Marx Date: Tue Oct 1 20:30:30 2013 +0200 Merge branch 'fifteen' of ssh://git.ipfire.org/pub/git/ipfire-2.x into fi= rewall-fifteen commit 2ad3c084eef6d82a8690e5d488d84c61e892ef4e Merge: 3bb77d0 285de10 Author: Alexander Marx Date: Tue Oct 1 20:30:06 2013 +0200 Merge branch 'firewall-fifteen' of ssh://git.ipfire.org/pub/git/people/am= arx/ipfire-2.x into firewall-fifteen commit 285de10662731bb67e946e7e112bb4cf892173bf Author: Alexander Marx Date: Tue Oct 1 07:45:58 2013 +0200 Firewall: fixed rules.pl (no INPUT rules where created when using port an= d prot "all") This is a bug which was raised due to the last commit commit 4c27368a7bc135dc4443711c4eeabec0885ce1ff Merge: fadcfb7 42e4fa8 Author: Alexander Marx Date: Tue Oct 1 07:44:29 2013 +0200 Merge branch 'fifteen' of ssh://git.ipfire.org/pub/git/ipfire-2.x into fi= rewall-fifteen commit 3bb77d08a689ef0b4ebaa88f48a684fe85ec580d Merge: 16ba0c0 fadcfb7 Author: Alexander Marx Date: Mon Sep 30 20:04:38 2013 +0200 Merge branch 'firewall-fifteen' of ssh://git.ipfire.org/pub/git/people/am= arx/ipfire-2.x into firewall-fifteen commit 16ba0c00d0d7b223682ab161c23af71315f6826a Merge: 71670b9 83dfa1d Author: Alexander Marx Date: Mon Sep 30 20:04:05 2013 +0200 Merge branch 'fifteen' of ssh://git.ipfire.org/pub/git/ipfire-2.x into fi= rewall-fifteen commit fadcfb73203c97e7062828eb77360b4382555943 Author: Alexander Marx Date: Mon Sep 30 15:43:51 2013 +0200 Firewall: moved nat part between source and target and moved protocol dro= pdown behind target area commit a0a5efd7684e90f8dd8e465f1b54ec4fd043ae4d Merge: 2aeb4b2 83dfa1d Author: Alexander Marx Date: Mon Sep 30 11:06:42 2013 +0200 Merge branch 'fifteen' of ssh://git.ipfire.org/pub/git/ipfire-2.x into fi= rewall-fifteen commit 71670b91cccc3500d03605673f3966d669c93d70 Merge: 439d2a5 2aeb4b2 Author: Alexander Marx Date: Fri Sep 27 15:18:05 2013 +0200 Merge branch 'firewall-fifteen' of ssh://git.ipfire.org/pub/git/people/am= arx/ipfire-2.x into firewall-fifteen commit 2aeb4b256eb99c8971da60a5dff6bd3929270798 Author: Alexander Marx Date: Fri Sep 27 10:16:52 2013 +0200 Firewall: Bugfix: wrong counter when using selfdefinded services in a rul= e that could not be applied Bugfix: When using ICMP-ALL in a rule, the rule was not applied Bugfix: When using selfdefined services (icmp) and group them together. T= hen when using these services/groups in a rule and afterwards changing the se= rvice, the edited service was not applied ----------------------------------------------------------------------- Summary of changes: config/forwardfw/rules.pl | 67 ++++---- html/cgi-bin/forwardfw.cgi | 404 ++++++++++++++++++++++++++-----------------= -- html/cgi-bin/fwhosts.cgi | 2 +- langs/de/cgi-bin/de.pl | 2 + langs/en/cgi-bin/en.pl | 4 +- 5 files changed, 273 insertions(+), 206 deletions(-) Difference in files: diff --git a/config/forwardfw/rules.pl b/config/forwardfw/rules.pl index 3f491f7..fcaade2 100755 --- a/config/forwardfw/rules.pl +++ b/config/forwardfw/rules.pl @@ -213,14 +213,13 @@ sub buildrules } ##get source prot and port $SRC_TGT=3D'SRC'; - $SPROT =3D &get_prot($hash,$key); $SPORT =3D &get_port($hash,$key); $SRC_TGT=3D''; =20 ##get target prot and port $DPROT=3D&get_prot($hash,$key); =20 - if ($DPROT eq ''){$DPROT=3D' ';} =09 + if ($DPROT eq ''){$DPROT=3D' ';} @DPROT=3Dsplit(",",$DPROT); =20 #get time if defined @@ -252,12 +251,12 @@ sub buildrules #print rules to console foreach my $DPROT (@DPROT){ $DPORT =3D &get_port($hash,$key,$DPROT); - if ($SPROT ne ''){$PROT=3D$SPROT;}else{$PROT=3D$DPROT;} + $PROT=3D$DPROT; $PROT=3D"-p $PROT" if ($PROT ne '' && $PROT ne ' '); foreach my $a (sort keys %sourcehash){ foreach my $b (sort keys %targethash){ if ($sourcehash{$a}[0] ne $targethash{$b}[0] && $targethash{$b}[0] ne= 'none' || $sourcehash{$a}[0] eq '0.0.0.0/0.0.0.0'){ - if($SPROT eq '' || $SPROT eq $DPROT || $DPROT eq ' '){ + if($DPROT ne ''){ if(substr($sourcehash{$a}[0], 3, 3) ne 'mac' && $sourcehash{$a}[0] = ne ''){ $STAG=3D"-s";} if(substr($DPORT, 2, 4) eq 'icmp'){ my @icmprule=3D split(",",substr($DPORT, 12,)); @@ -311,12 +310,12 @@ sub buildrules }elsif($MODE eq '0'){ foreach my $DPROT (@DPROT){ $DPORT =3D &get_port($hash,$key,$DPROT); - if ($SPROT ne ''){$PROT=3D$SPROT;}else{$PROT=3D$DPROT;} + $PROT=3D$DPROT; $PROT=3D"-p $PROT" if ($PROT ne '' && $PROT ne ' '); foreach my $a (sort keys %sourcehash){ foreach my $b (sort keys %targethash){ if ($sourcehash{$a}[0] ne $targethash{$b}[0] && $targethash{$b}[0] ne= 'none' || $sourcehash{$a}[0] eq '0.0.0.0/0.0.0.0'){ - if($SPROT eq '' || $SPROT eq $DPROT || $DPROT eq ' '){ + if($DPROT ne ''){ if(substr($sourcehash{$a}[0], 3, 3) ne 'mac' && $sourcehash{$a}[0] = ne ''){ $STAG=3D"-s";} #Process ICMP RULE if(substr($DPORT, 2, 4) eq 'icmp'){ @@ -528,33 +527,29 @@ sub get_prot { my $hash=3Dshift; my $key=3Dshift; - if ($$hash{$key}[7] eq 'ON' && $SRC_TGT eq 'SRC'){ - if ($$hash{$key}[10] ne ''){ - return"$$hash{$key}[8]"; - }elsif($$hash{$key}[9] ne ''){ - return"$$hash{$key}[8]"; - }else{ - return "$$hash{$key}[8]"; - } - }elsif($$hash{$key}[11] eq 'ON' && $SRC_TGT eq ''){ - if ($$hash{$key}[14] eq 'TGT_PORT'){ - if ($$hash{$key}[15] ne ''){ - return "$$hash{$key}[12]"; - }elsif($$hash{$key}[13] ne ''){ - return "$$hash{$key}[12]"; - }else{ - return "$$hash{$key}[12]"; - } - }elsif($$hash{$key}[14] eq 'cust_srv'){ + #check AH,GRE,ESP or ICMP + if ($$hash{$key}[7] ne 'ON' && $$hash{$key}[11] ne 'ON'){ + return "$$hash{$key}[8]"; + } + if ($$hash{$key}[7] eq 'ON' || $$hash{$key}[11] eq 'ON'){ + #check if servicegroup or service + if($$hash{$key}[14] eq 'cust_srv'){ return &fwlib::get_srv_prot($$hash{$key}[15]); - =09 }elsif($$hash{$key}[14] eq 'cust_srvgrp'){ return &fwlib::get_srvgrp_prot($$hash{$key}[15]); + }elsif (($$hash{$key}[10] ne '' || $$hash{$key}[15] ne '') && $$hash{$key}= [8] eq ''){ #when ports are used and prot set to "all" + return "TCP,UDP"; + }elsif (($$hash{$key}[10] ne '' || $$hash{$key}[15] ne '') && ($$hash{$key= }[8] eq 'TCP' || $$hash{$key}[8] eq 'UDP')){ #when ports are used and prot se= t to "tcp" or "udp" + return "$$hash{$key}[8]"; + }elsif (($$hash{$key}[10] eq '' && $$hash{$key}[15] eq '') && $$hash{$key}= [8] ne 'ICMP'){ #when ports are NOT used and prot NOT set to "ICMP" + return "$$hash{$key}[8]"; + }else{ + return "$$hash{$key}[8]"; } } #DNAT if ($SRC_TGT eq '' && $$hash{$key}[31] eq 'dnat' && $$hash{$key}[11] eq '' = && $$hash{$key}[12] ne ''){ - return "$$hash{$key}[12]"; + return "$$hash{$key}[8]"; } } sub get_port @@ -574,10 +569,6 @@ sub get_port return ":$$hash{$key}[10]"; } } - }elsif($$hash{$key}[9] ne '' && $$hash{$key}[9] ne 'All ICMP-Types'){ - return "--icmp-type $$hash{$key}[9] "; - }elsif($$hash{$key}[9] eq 'All ICMP-Types'){ - return; } }elsif($$hash{$key}[11] eq 'ON' && $SRC_TGT eq ''){ if($$hash{$key}[14] eq 'TGT_PORT'){ @@ -593,10 +584,6 @@ sub get_port return ":$$hash{$key}[15]"; } } - }elsif($$hash{$key}[13] ne '' && $$hash{$key}[13] ne 'All ICMP-Types'){ - return "--icmp-type $$hash{$key}[13] "; - }elsif($$hash{$key}[13] ne '' && $$hash{$key}[13] eq 'All ICMP-Types'){ - return; } }elsif($$hash{$key}[14] eq 'cust_srv'){ if ($prot ne 'ICMP'){ @@ -605,10 +592,8 @@ sub get_port }else{ return "--dport ".&fwlib::get_srv_port($$hash{$key}[15],1,$prot); } - }elsif($prot eq 'ICMP' && $$hash{$key}[15] ne 'All ICMP-Types'){ + }elsif($prot eq 'ICMP' && $$hash{$key}[11] eq 'ON'){ #When PROT is= ICMP and "use targetport is checked, this is an icmp-service return "--icmp-type ".&fwlib::get_srv_port($$hash{$key}[15],3,$prot); - }elsif($prot eq 'ICMP' && $$hash{$key}[15] eq 'All ICMP-Types'){ - return; } }elsif($$hash{$key}[14] eq 'cust_srvgrp'){ if ($prot ne 'ICMP'){ @@ -619,4 +604,12 @@ sub get_port } } } + #CHECK ICMP + if ($$hash{$key}[7] ne 'ON' && $$hash{$key}[11] ne 'ON' && $SRC_TGT eq ''){ + if($$hash{$key}[9] ne '' && $$hash{$key}[9] ne 'All ICMP-Types'){ + return "--icmp-type $$hash{$key}[9] "; + }elsif($$hash{$key}[9] eq 'All ICMP-Types'){ + return; + } + } } diff --git a/html/cgi-bin/forwardfw.cgi b/html/cgi-bin/forwardfw.cgi index 405a97d..f8f14ad 100755 --- a/html/cgi-bin/forwardfw.cgi +++ b/html/cgi-bin/forwardfw.cgi @@ -115,6 +115,45 @@ print< END =20 @@ -128,7 +167,6 @@ if ($fwdfwsettings{'ACTION'} eq 'saverule') $errormessage=3D&checksource; if(!$errormessage){&checktarget;} if(!$errormessage){&checkrule;} -=09 #check if manual ip (source) is orange network if ($fwdfwsettings{'grp1'} eq 'src_addr'){ my ($sip,$scidr) =3D split("/",$fwdfwsettings{$fwdfwsettings{'grp1'}}); @@ -466,32 +504,6 @@ sub checksource =20 #check empty fields if ($fwdfwsettings{$fwdfwsettings{'grp1'}} eq ''){ $errormessage.=3D$Lang::= tr{'fwdfw err nosrc'}."
";} - #check icmp source - if ($fwdfwsettings{'USE_SRC_PORT'} eq 'ON' && $fwdfwsettings{'PROT'} eq 'I= CMP'){ - $fwdfwsettings{'SRC_PORT'}=3D''; - &General::readhasharray("${General::swroot}/fwhosts/icmp-types", \%icmpty= pes); - foreach my $key (keys %icmptypes){ - if($fwdfwsettings{'ICMP_TYPES'} eq "$icmptypes{$key}[0] ($icmptypes{$key= }[1])"){ - $fwdfwsettings{'ICMP_TYPES'}=3D"$icmptypes{$key}[0]"; - } - } - }elsif($fwdfwsettings{'USE_SRC_PORT'} eq 'ON' && $fwdfwsettings{'PROT'} eq= 'GRE'){ - $fwdfwsettings{'SRC_PORT'}=3D''; - $fwdfwsettings{'ICMP_TYPES'}=3D''; - }elsif($fwdfwsettings{'USE_SRC_PORT'} eq 'ON' && $fwdfwsettings{'PROT'} eq= 'ESP'){ - $fwdfwsettings{'SRC_PORT'}=3D''; - $fwdfwsettings{'ICMP_TYPES'}=3D''; - }elsif($fwdfwsettings{'USE_SRC_PORT'} eq 'ON' && $fwdfwsettings{'PROT'} eq= 'AH'){ - $fwdfwsettings{'SRC_PORT'}=3D''; - $fwdfwsettings{'ICMP_TYPES'}=3D'';=09 - }elsif($fwdfwsettings{'USE_SRC_PORT'} eq 'ON' && $fwdfwsettings{'PROT'} ne= 'ICMP'){ - $fwdfwsettings{'ICMP_TYPES'}=3D''; - }else{ - $fwdfwsettings{'ICMP_TYPES'}=3D''; - $fwdfwsettings{'SRC_PORT'}=3D''; - $fwdfwsettings{'PROT'}=3D''; - } - if($fwdfwsettings{'USE_SRC_PORT'} eq 'ON' && ($fwdfwsettings{'PROT'} eq 'TC= P' || $fwdfwsettings{'PROT'} eq 'UDP') && $fwdfwsettings{'SRC_PORT'} ne ''){ my @parts=3Dsplit(",",$fwdfwsettings{'SRC_PORT'}); my @values=3D(); @@ -552,11 +564,11 @@ sub checktarget } #check if Port is a single Port or portrange if ($fwdfwsettings{'nat'} eq 'dnat' && $fwdfwsettings{'grp3'} eq 'TGT_PO= RT'){ - if(($fwdfwsettings{'TGT_PROT'} ne 'TCP'|| $fwdfwsettings{'TGT_PROT'} ne = 'UDP') && $fwdfwsettings{'TGT_PORT'} eq ''){ + if(($fwdfwsettings{'PROT'} ne 'TCP'|| $fwdfwsettings{'PROT'} ne 'UDP') &= & $fwdfwsettings{'TGT_PORT'} eq ''){ $errormessage=3D$Lang::tr{'fwdfw target'}.": ".$Lang::tr{'fwdfw dnat po= rterr'}."
"; return $errormessage; } - if (($fwdfwsettings{'TGT_PROT'} eq 'TCP'|| $fwdfwsettings{'TGT_PROT'} eq= 'UDP') && $fwdfwsettings{'TGT_PORT'} ne '' && !&check_natport($fwdfwsettings= {'TGT_PORT'})){ + if (($fwdfwsettings{'PROT'} eq 'TCP'|| $fwdfwsettings{'PROT'} eq 'UDP') = && $fwdfwsettings{'TGT_PORT'} ne '' && !&check_natport($fwdfwsettings{'TGT_PO= RT'})){ $errormessage=3D$Lang::tr{'fwdfw target'}.": ".$Lang::tr{'fwdfw dnat po= rterr'}."
"; return $errormessage; } @@ -601,17 +613,19 @@ sub checktarget if ($fwdfwsettings{'grp3'} eq 'cust_srv'){ $fwdfwsettings{'TGT_PROT'}=3D''; $fwdfwsettings{'ICMP_TGT'}=3D''; + $fwdfwsettings{'TGT_PORT'}=3D''; } if ($fwdfwsettings{'grp3'} eq 'cust_srvgrp'){ $fwdfwsettings{'TGT_PROT'}=3D''; $fwdfwsettings{'ICMP_TGT'}=3D''; + $fwdfwsettings{'TGT_PORT'}=3D''; #check target service if($fwdfwsettings{$fwdfwsettings{'grp3'}} eq ''){ $errormessage.=3D$Lang::tr{'fwdfw err tgt_grp'}; } } if ($fwdfwsettings{'grp3'} eq 'TGT_PORT'){ - if ($fwdfwsettings{'TGT_PROT'} eq 'TCP' || $fwdfwsettings{'TGT_PROT'} eq = 'UDP'){ + if ($fwdfwsettings{'PROT'} eq 'TCP' || $fwdfwsettings{'PROT'} eq 'UDP'){ if ($fwdfwsettings{'TGT_PORT'} ne ''){ if ($fwdfwsettings{'TGT_PORT'} =3D~ "," && $fwdfwsettings{'USE_NAT'} &&= $fwdfwsettings{'nat'} eq 'dnat') { $errormessage=3D$Lang::tr{'fwdfw dnat porterr'}."
"; @@ -645,34 +659,26 @@ sub checktarget if (&General::validport($_)){ push (@values,$_); }else{ - =09 } } } $fwdfwsettings{'TGT_PORT'}=3Djoin("|",@values); } - }elsif ($fwdfwsettings{'TGT_PROT'} eq 'GRE'){ + }elsif ($fwdfwsettings{'PROT'} eq 'GRE'){ $fwdfwsettings{$fwdfwsettings{'grp3'}} =3D ''; $fwdfwsettings{'TGT_PORT'} =3D ''; $fwdfwsettings{'ICMP_TGT'} =3D ''; - }elsif($fwdfwsettings{'TGT_PROT'} eq 'ESP'){ + }elsif ($fwdfwsettings{'PROT'} eq 'ESP'){ $fwdfwsettings{$fwdfwsettings{'grp3'}} =3D ''; $fwdfwsettings{'TGT_PORT'} =3D ''; $fwdfwsettings{'ICMP_TGT'}=3D''; - }elsif($fwdfwsettings{'TGT_PROT'} eq 'AH'){ + }elsif ($fwdfwsettings{'PROT'} eq 'AH'){ $fwdfwsettings{$fwdfwsettings{'grp3'}} =3D ''; $fwdfwsettings{'TGT_PORT'} =3D ''; $fwdfwsettings{'ICMP_TGT'}=3D''; - }elsif ($fwdfwsettings{'TGT_PROT'} eq 'ICMP'){ + }elsif ($fwdfwsettings{'PROT'} eq 'ICMP'){ $fwdfwsettings{$fwdfwsettings{'grp3'}} =3D ''; $fwdfwsettings{'TGT_PORT'} =3D ''; - &General::readhasharray("${General::swroot}/fwhosts/icmp-types", \%icmpt= ypes); - foreach my $key (keys %icmptypes){ - =09 - if ("$icmptypes{$key}[0] ($icmptypes{$key}[1])" eq $fwdfwsettings{'ICMP= _TGT'}){ - $fwdfwsettings{'ICMP_TGT'}=3D$icmptypes{$key}[0]; - } - } } } } @@ -807,26 +813,68 @@ sub checkrule } } } - #check source and destination protocol if manual - if( $fwdfwsettings{'USE_SRC_PORT'} eq 'ON' && $fwdfwsettings{'USESRV'} eq '= ON'){ - if($fwdfwsettings{'PROT'} ne $fwdfwsettings{'TGT_PROT'} && $fwdfwsettings= {'grp3'} eq 'TGT_PORT'){ - $errormessage.=3D$Lang::tr{'fwdfw err prot'}; - } - #check source and destination protocol if source manual and dest servicegrp - if ($fwdfwsettings{'grp3'} eq 'cust_srv'){ - foreach my $key (sort keys %customservice){ - if($customservice{$key}[0] eq $fwdfwsettings{$fwdfwsettings{'grp3'}}){ - if ($customservice{$key}[2] ne $fwdfwsettings{'PROT'}){ - $errormessage.=3D$Lang::tr{'fwdfw err prot'}; - last; - } + #When using source- or targetport, the protocol has to be TCP or UDP + if (($fwdfwsettings{'USESRV'} eq 'ON' || $fwdfwsettings{'USE_SRC_PORT'} eq = 'ON') && ($fwdfwsettings{'SRC_PORT'} ne '' || $fwdfwsettings{'TGT_PORT'} ne '= ') && ($fwdfwsettings{'PROT'} ne 'TCP' && $fwdfwsettings{'PROT'} ne 'UDP')){ + $errormessage.=3D$Lang::tr{'fwdfw err prot_port1'}; + return; + } + #when icmp selected, no targetport allowed + if (($fwdfwsettings{'PROT'} ne '' && $fwdfwsettings{'PROT'} ne 'TCP' && $fw= dfwsettings{'PROT'} ne 'UDP') && ($fwdfwsettings{'USESRV'} eq 'ON' || $fwdfws= ettings{'USE_SRC_PORT'} eq 'ON')){ + $errormessage.=3D$Lang::tr{'fwdfw err prot_port'}; + return; + } + #change protocol if prot not equal dest single service + if ($fwdfwsettings{'grp3'} eq 'cust_srv'){ + foreach my $key (sort keys %customservice){ + if($customservice{$key}[0] eq $fwdfwsettings{$fwdfwsettings{'grp3'}}){ + if ($customservice{$key}[2] ne $fwdfwsettings{'PROT'}){ + $fwdfwsettings{'PROT'} =3D $customservice{$key}[2]; + last; } } } } - if( $fwdfwsettings{'USE_SRC_PORT'} ne 'ON' && $fwdfwsettings{'USESRV'} ne '= ON'){ - $fwdfwsettings{'PROT'}=3D''; - $fwdfwsettings{'TGT_PROT'}=3D''; + #check source and destination protocol if source manual and dest servicegro= up + if ($fwdfwsettings{'grp3'} eq 'cust_srvgrp'){ + $fwdfwsettings{'PROT'} =3D ''; + } + #ATTENTION: $fwdfwsetting{'TGT_PROT'} deprecated since 30.09.2013 + $fwdfwsettings{'TGT_PROT'}=3D''; #Set field empty (deprecated) + #Check ICMP Types + if ($fwdfwsettings{'PROT'} eq 'ICMP'){ + $fwdfwsettings{'USE_SRC_PORT'}=3D''; + $fwdfwsettings{'SRC_PORT'}=3D''; + #$fwdfwsettings{'USESRV'}=3D''; + $fwdfwsettings{'TGT_PORT'}=3D''; + &General::readhasharray("${General::swroot}/fwhosts/icmp-types", \%icmptyp= es); + foreach my $key (keys %icmptypes){ + if($fwdfwsettings{'ICMP_TYPES'} eq "$icmptypes{$key}[0] ($icmptypes{$key}= [1])"){ + $fwdfwsettings{'ICMP_TYPES'}=3D"$icmptypes{$key}[0]"; + } + } + }elsif($fwdfwsettings{'PROT'} eq 'GRE'){ + $fwdfwsettings{'USE_SRC_PORT'}=3D''; + $fwdfwsettings{'SRC_PORT'}=3D''; + $fwdfwsettings{'ICMP_TYPES'}=3D''; + $fwdfwsettings{'USESRV'}=3D''; + $fwdfwsettings{'TGT_PORT'}=3D''; + }elsif($fwdfwsettings{'PROT'} eq 'ESP'){ + $fwdfwsettings{'USE_SRC_PORT'}=3D''; + $fwdfwsettings{'SRC_PORT'}=3D''; + $fwdfwsettings{'ICMP_TYPES'}=3D''; + $fwdfwsettings{'USESRV'}=3D''; + $fwdfwsettings{'TGT_PORT'}=3D''; + }elsif($fwdfwsettings{'PROT'} eq 'AH'){ + $fwdfwsettings{'USE_SRC_PORT'}=3D''; + $fwdfwsettings{'SRC_PORT'}=3D''; + $fwdfwsettings{'ICMP_TYPES'}=3D''; + $fwdfwsettings{'USESRV'}=3D''; + $fwdfwsettings{'TGT_PORT'}=3D''; + }elsif($fwdfwsettings{'PROT'} ne 'TCP' && $fwdfwsettings{'PROT'} ne 'UDP' &= & $fwdfwsettings{'PROT'} ne 'ICMP'){ + $fwdfwsettings{'ICMP_TYPES'}=3D''; + $fwdfwsettings{'PROT'} =3D ''; + }elsif($fwdfwsettings{'PROT'} ne 'ICMP'){ + $fwdfwsettings{'ICMP_TYPES'}=3D''; } } sub checkcounter @@ -1158,7 +1206,7 @@ sub getsrcport { my %hash=3D%{(shift)}; my $key=3Dshift; - if($hash{$key}[7] eq 'ON' && $hash{$key}[8] ne '' && $hash{$key}[10]){ + if($hash{$key}[7] eq 'ON' && $hash{$key}[10]){ $hash{$key}[10]=3D~ s/\|/,/g; print": $hash{$key}[10]"; }elsif($hash{$key}[7] eq 'ON' && $hash{$key}[8] eq 'ICMP'){ @@ -1188,8 +1236,6 @@ sub gettgtport if($service){ print": $service"; } - }elsif($hash{$key}[11] eq 'ON' && $hash{$key}[12] eq 'ICMP'){ - print":
$hash{$key}[13]"; } } sub get_serviceports @@ -1226,7 +1272,7 @@ sub get_serviceports } } if($tcp && $udp && $icmp){ - push (@protocols,"All"); + push (@protocols,"TCP,UDP,
ICMP"); return @protocols; } if($tcp){ @@ -1541,7 +1587,6 @@ END print "" if (&Header::orange_used()); print "" if (&Header::blue_used()); print "