[git.ipfire.org] IPFire 2.x development tree branch, next, updated. da7a2208d3a3c4143ce9029665ad9d738e70d3b1

[git@ipfire.org]

[-- Attachment #1: Type: text/plain, Size: 6187 bytes --]

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "IPFire 2.x development tree".

The branch, next has been updated
       via  da7a2208d3a3c4143ce9029665ad9d738e70d3b1 (commit)
       via  5cf8c8c12382d77b07fbcb1b8916d78d2806cc74 (commit)
       via  c2a1af7545c52edc9354e778acecb6370ea15d48 (commit)
      from  2a07aa9d9c4c1968a1072147107d889a1a8aae5e (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit da7a2208d3a3c4143ce9029665ad9d738e70d3b1
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date:   Mon Mar 17 18:03:00 2014 +0100

    firewall: rules.pl: Code cleanup.

commit 5cf8c8c12382d77b07fbcb1b8916d78d2806cc74
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date:   Mon Mar 17 17:39:47 2014 +0100

    firewall: Fix DNAT rules between internal zones.

commit c2a1af7545c52edc9354e778acecb6370ea15d48
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date:   Mon Mar 17 15:47:28 2014 +0100

    firewall: rules.pl: Sanitise source and destination IP addresses.
    
    Those variables are now empty if source or destination are
    unspecified.

-----------------------------------------------------------------------

Summary of changes:
 config/firewall/rules.pl | 79 ++++++++++++++++++++++++++++++++++++++++--------
 1 file changed, 66 insertions(+), 13 deletions(-)

Difference in files:
diff --git a/config/firewall/rules.pl b/config/firewall/rules.pl
index 51ddb44..7a8e9ba 100755
--- a/config/firewall/rules.pl
+++ b/config/firewall/rules.pl
@@ -39,6 +39,7 @@ my $CHAIN_NAT_SOURCE      = "NAT_SOURCE";
 my $CHAIN_NAT_DESTINATION = "NAT_DESTINATION";
 my $CHAIN_MANGLE_NAT_DESTINATION_FIX = "NAT_DESTINATION";
 my @VALID_CHAINS          = ($CHAIN_INPUT, $CHAIN_FORWARD, $CHAIN_OUTPUT);
+my @ANY_ADDRESSES         = ("0.0.0.0/0.0.0.0", "0.0.0.0/0", "0/0");
 
 my @PROTOCOLS = ("tcp", "udp", "icmp", "igmp", "ah", "esp", "gre", "ipv6", "ipip");
 my @PROTOCOLS_WITH_PORTS = ("tcp", "udp");
@@ -255,6 +256,16 @@ sub buildrules {
 					# Skip invalid rules.
 					next if (!$source || !$destination || ($destination eq "none"));
 
+					# Sanitize source.
+					if ($source ~~ @ANY_ADDRESSES) {
+						$source = "";
+					}
+
+					# Sanitize destination.
+					if ($destination ~~ @ANY_ADDRESSES) {
+						$destination = "";
+					}
+
 					# Array with iptables arguments.
 					my @options = ();
 
@@ -268,12 +279,15 @@ sub buildrules {
 					my @source_options = ();
 					if ($source =~ /mac/) {
 						push(@source_options, $source);
-					} else {
+					} elsif ($source) {
 						push(@source_options, ("-s", $source));
 					}
 
 					# Prepare destination options.
-					my @destination_options = ("-d", $destination);
+					my @destination_options = ();
+					if ($destination) {
+						push(@destination_options, ("-d", $destination));
+					}
 
 					# Add time constraint options.
 					push(@options, @time_options);
@@ -285,7 +299,7 @@ sub buildrules {
 
 					# Process NAT rules.
 					if ($NAT) {
-						my $nat_address = &get_nat_address($$hash{$key}[29]);
+						my $nat_address = &get_nat_address($$hash{$key}[29], $source);
 
 						# Skip NAT rules if the NAT address is unknown
 						# (i.e. no internet connection has been established, yet).
@@ -294,7 +308,10 @@ sub buildrules {
 						# Destination NAT
 						if ($NAT_MODE eq "DNAT") {
 							# Make port-forwardings useable from the internal networks.
-							&add_dnat_mangle_rules($nat_address, @options);
+							my @internal_addresses = &get_internal_firewall_ip_addresses(1);
+							unless ($nat_address ~~ @internal_addresses) {
+								&add_dnat_mangle_rules($nat_address, @options);
+							}
 
 							my @nat_options = @options;
 							push(@nat_options, @source_options);
@@ -380,12 +397,21 @@ sub get_alias {
 
 sub get_nat_address {
 	my $zone = shift;
+	my $source = shift;
 
 	# Any static address of any zone.
 	if ($zone eq "RED" || $zone eq "GREEN" || $zone eq "ORANGE" || $zone eq "BLUE") {
 		return $defaultNetworks{$zone . "_ADDRESS"};
 
 	} elsif ($zone eq "Default IP") {
+		if ($source) {
+			my $firewall_ip = &get_internal_firewall_ip_address($source, 1);
+
+			if ($firewall_ip) {
+				return $firewall_ip;
+			}
+		}
+
 		return &get_external_address();
 
 	} else {
@@ -795,25 +821,52 @@ sub make_log_limit_options {
 	return @options;
 }
 
-sub firewall_is_in_subnet {
-	my $subnet = shift;
+sub get_internal_firewall_ip_addresses {
+	my $use_orange = shift;
 
-	my ($net_address, $net_mask) = split("/", $subnet);
-	if (!$net_mask) {
-		return 0;
+	my @zones = ("GREEN", "BLUE");
+	if ($use_orange) {
+		push(@zones, "ORANGE");
 	}
 
-	# ORANGE is missing here, because nothing may ever access
-	# the firewall from this network.
-	foreach my $zone ("GREEN", "BLUE") {
+	my @addresses = ();
+	for my $zone (@zones) {
 		next unless (exists $defaultNetworks{$zone . "_ADDRESS"});
 
 		my $zone_address = $defaultNetworks{$zone . "_ADDRESS"};
+		push(@addresses, $zone_address);
+	}
 
+	return @addresses;
+}
+
+sub get_internal_firewall_ip_address {
+	my $subnet = shift;
+	my $use_orange = shift;
+
+	my ($net_address, $net_mask) = split("/", $subnet);
+	if (!$net_mask) {
+		return;
+	}
+
+	my @addresses = &get_internal_firewall_ip_addresses($use_orange);
+	foreach my $zone_address (@addresses) {
 		if (&General::IpInSubnet($zone_address, $net_address, $net_mask)) {
-			return 1;
+			return $zone_address;
 		}
 	}
+}
+
+sub firewall_is_in_subnet {
+	my $subnet = shift;
+
+	# ORANGE is missing here, because nothing may ever access
+	# the firewall from this network.
+	my $address = &get_internal_firewall_ip_address($subnet, 0);
+
+	if ($address) {
+		return 1;
+	}
 
 	return 0;
 }


hooks/post-receive
--
IPFire 2.x development tree