mirror of
https://github.com/webmin/webmin.git
synced 2025-07-20 16:48:46 +00:00
416 lines
12 KiB
Perl
Executable File
416 lines
12 KiB
Perl
Executable File
#!/usr/local/bin/perl
|
|
# save_rule.cgi
|
|
# Save, create or delete a rule in a chain
|
|
|
|
require './firewall-lib.pl';
|
|
&ReadParse();
|
|
if (&get_ipvx_version() == 6) {
|
|
require './firewall6-lib.pl';
|
|
}
|
|
else {
|
|
require './firewall4-lib.pl';
|
|
}
|
|
&error_setup($text{'save_err'});
|
|
@tables = &get_iptables_save();
|
|
$table = $tables[$in{'table'}];
|
|
&can_edit_table($table->{'name'}) || &error($text{'etable'});
|
|
if ($in{'new'}) {
|
|
$rule = { 'chain' => $in{'chain'} };
|
|
}
|
|
else {
|
|
$rule = $table->{'rules'}->[$in{'idx'}];
|
|
&can_jump($rule) || &error($text{'ejump'});
|
|
}
|
|
if ($in{'clone'}) {
|
|
# Go back to the editing page
|
|
&redirect("edit_rule.cgi?version=${ipvx_arg}&new=1&clone=$in{'idx'}&".
|
|
"table=".&urlize($in{'table'})."&".
|
|
"chain=".&urlize($rule->{'chain'}));
|
|
}
|
|
|
|
&lock_file($ipvx_save);
|
|
if ($in{'delete'}) {
|
|
# Just delete this rule
|
|
splice(@{$table->{'rules'}}, $in{'idx'}, 1);
|
|
}
|
|
else {
|
|
# Validate and store inputs
|
|
if ($config{'comment_mod'}) {
|
|
$in{'cmt'} =~ s/^\s+//;
|
|
$in{'cmt'} =~ s/\s+$//;
|
|
if ($in{'cmt'}) {
|
|
$rule->{'comment'} = [ "", $in{'cmt'} ];
|
|
push(@mods, "comment");
|
|
}
|
|
else {
|
|
delete($rule->{'comment'});
|
|
}
|
|
}
|
|
else {
|
|
$rule->{'cmt'} = $in{'cmt'};
|
|
delete($rule->{'comment'});
|
|
@mods = grep { $_ ne "comment" } @mods;
|
|
}
|
|
if ($in{'jump'} eq '*') {
|
|
$in{'other'} =~ /^\S+$/ || &error($text{'save_echain'});
|
|
$rule->{'j'} = [ "", $in{'other'} ];
|
|
}
|
|
elsif ($in{'jump'}) {
|
|
$rule->{'j'} = [ "", $in{'jump'} ];
|
|
}
|
|
else {
|
|
delete($rule->{'j'});
|
|
}
|
|
&can_jump($rule) || &error($text{'save_ecanjump'});
|
|
if (defined($in{'rwithtype'})) {
|
|
if ($rule->{'j'}->[1] eq 'REJECT' && !$in{'rwithdef'}) {
|
|
$rule->{'reject-with'} = [ "", $in{'rwithtype'} ];
|
|
}
|
|
else {
|
|
delete($rule->{'reject-with'});
|
|
}
|
|
}
|
|
|
|
# Parse redirect or masquerade input
|
|
if ($table->{'name'} eq 'nat') {
|
|
if ($rule->{'j'}->[1] eq 'REDIRECT' && !$in{'rtodef'}) {
|
|
$in{'rtofrom'} =~ /^\d+$/ ||
|
|
&error($text{'save_ertoports'});
|
|
$in{'rtoto'} =~ /^\d*$/ ||
|
|
&error($text{'save_ertoports'});
|
|
$rule->{'to-ports'} = [ "", $in{'rtoto'} eq '' ?
|
|
$in{'rtofrom'} : $in{'rtofrom'}."-".$in{'rtoto'} ];
|
|
}
|
|
elsif ($rule->{'j'}->[1] eq 'MASQUERADE' && !$in{'mtodef'}) {
|
|
$in{'mtofrom'} =~ /^\d+$/ ||
|
|
&error($text{'save_emtoports'});
|
|
$in{'mtoto'} =~ /^\d*$/ ||
|
|
&error($text{'save_emtoports'});
|
|
$rule->{'to-ports'} = [ "", $in{'mtoto'} eq '' ?
|
|
$in{'mtofrom'} : $in{'mtofrom'}."-".$in{'mtoto'} ];
|
|
}
|
|
else {
|
|
delete($rule->{'to-ports'});
|
|
}
|
|
}
|
|
if ($table->{'name'} eq 'nat' && $rule->{'chain'} ne 'POSTROUTING') {
|
|
if ($rule->{'j'}->[1] eq 'DNAT' && !$in{'dnatdef'}) {
|
|
!$in{'dipfrom'} || &check_ip6address($in{'dipfrom'}) ||
|
|
&error($text{'save_edipfrom'});
|
|
!$in{'dipto'} || &check_ip6address($in{'dipto'}) ||
|
|
&error($text{'save_edipto'});
|
|
local $v = "[".$in{'dipfrom'}."]";
|
|
$v .= "-[".$in{'dipto'}."]" if ($in{'dipto'});
|
|
if ($in{'dpfrom'} ne '') {
|
|
$in{'dpfrom'} =~ /^\d+$/ ||
|
|
&error($text{'save_edpfrom'});
|
|
$in{'dpto'} =~ /^\d*$/ ||
|
|
&error($text{'save_edpto'});
|
|
if ($in{'dpto'} eq '') {
|
|
$v .= ":".$in{'dpfrom'};
|
|
}
|
|
else {
|
|
$v .= ":".$in{'dpfrom'}."-".$in{'dpto'};
|
|
}
|
|
}
|
|
$rule->{'to-destination'} = [ "", $v ];
|
|
}
|
|
else {
|
|
delete($rule->{'to-destination'});
|
|
}
|
|
}
|
|
if ($table->{'name'} eq 'nat' && $rule->{'chain'} ne 'PREROUTING' &&
|
|
$rule->{'chain'} ne 'OUTPUT') {
|
|
if ($rule->{'j'}->[1] eq 'SNAT' && !$in{'snatdef'}) {
|
|
(!$in{'sipfrom'} && !$in{'sipto'}) ||
|
|
&check_ip6address($in{'sipfrom'}) ||
|
|
&error($text{'save_esipfrom'});
|
|
!$in{'sipto'} || &check_ip6address($in{'sipto'}) ||
|
|
&error($text{'save_esipto'});
|
|
local $v = $in{'sipfrom'};
|
|
$v .= "-".$in{'sipto'} if ($in{'sipto'});
|
|
if ($in{'spfrom'} ne '') {
|
|
$in{'spfrom'} =~ /^\d+$/ ||
|
|
&error($text{'save_espfrom'});
|
|
$in{'spto'} =~ /^\d*$/ ||
|
|
&error($text{'save_espto'});
|
|
if ($in{'spto'} eq '') {
|
|
$v .= ":".$in{'spfrom'};
|
|
}
|
|
else {
|
|
$v .= ":".$in{'spfrom'}."-".$in{'spto'};
|
|
}
|
|
}
|
|
$rule->{'to-source'} = [ "", $v ];
|
|
}
|
|
else {
|
|
delete($rule->{'to-source'});
|
|
}
|
|
}
|
|
if (&parse_mode("source", $rule, "s")) {
|
|
&check_ipmask($in{'source'}) || &error($text{'save_esource'});
|
|
$rule->{'s'}->[1] = join(",", split(/[ \t\r\n,]+/, $in{'source'}));
|
|
}
|
|
if (&parse_mode("dest", $rule, "d")) {
|
|
&check_ipmask($in{'dest'}) || &error($text{'save_edest'});
|
|
$rule->{'d'}->[1] = join(",", split(/[ \t\r\n,]+/, $in{'dest'}));
|
|
}
|
|
if (&parse_mode("in", $rule, "i")) {
|
|
$in{'in'} ne '' || $in{'in_other'} =~ /^\S+$/ ||
|
|
&error($text{'save_ein'});
|
|
$rule->{'i'}->[1] = $in{'in'} eq '' || $in{'in'} eq 'other' ?
|
|
$in{'in_other'} : $in{'in'};
|
|
}
|
|
if (&parse_mode("out", $rule, "o")) {
|
|
$in{'out'} ne '' || $in{'out_other'} =~ /^\S+$/ ||
|
|
&error($text{'save_eout'});
|
|
$rule->{'o'}->[1] = $in{'out'} eq '' || $in{'out'} eq 'other' ?
|
|
$in{'out_other'} : $in{'out'};
|
|
}
|
|
if ($in{'frag'} == 0) { delete($rule->{'f'}); }
|
|
elsif ($in{'frag'} == 1) { $rule->{'f'} = [ "" ]; }
|
|
else { $rule->{'f'} = [ "!" ]; }
|
|
if (&parse_mode("proto", $rule, "p")) {
|
|
$in{'proto'} || $in{'proto_other'} =~ /^\d+$/ ||
|
|
&error($text{'save_eproto'});
|
|
$rule->{'p'}->[1] = $in{'proto'} || $in{'proto_other'};
|
|
if (!$rule->{'p'}->[0]) {
|
|
$proto = $in{'proto'};
|
|
push(@mods, $in{'proto'})
|
|
if ($proto eq 'tcp' || $proto eq 'udp' ||
|
|
$proto eq "icmp${ipvx_icmp}" && $in{'icmptype_mode'});
|
|
}
|
|
}
|
|
|
|
if (&parse_mode("sport", $rule, "sport")) {
|
|
$proto eq "tcp" || $proto eq "udp" || $proto eq "sctp" ||
|
|
&error($text{'save_etcpudp'});
|
|
if ($in{"sport_type"} == 0) {
|
|
$in{"sport"} =~ /^\S+$/ ||
|
|
&error($text{'save_esport'});
|
|
if ($in{"sport"} =~ /,/) {
|
|
$rule->{'sports'}->[1] = $in{"sport"};
|
|
$rule->{'sports'}->[0] = $rule->{'sport'}->[0];
|
|
push(@mods, "multiport");
|
|
delete($rule->{'sport'});
|
|
}
|
|
else {
|
|
$rule->{'sport'}->[1] = $in{"sport"};
|
|
delete($rule->{'sports'});
|
|
}
|
|
}
|
|
else {
|
|
$in{"sport_from"} =~ /^\d*$/ ||
|
|
&error($text{'save_esportfrom'});
|
|
$in{"sport_to"} =~ /^\d*$/ ||
|
|
&error($text{'save_esportto'});
|
|
$rule->{'sport'}->[1] = $in{"sport_from"}.":".
|
|
$in{"sport_to"};
|
|
$rule->{'sport'}->[1] eq ":" &&
|
|
&error($text{'save_esportrange'});
|
|
delete($rule->{'sports'});
|
|
}
|
|
}
|
|
else {
|
|
delete($rule->{'sports'});
|
|
}
|
|
if (&parse_mode("dport", $rule, "dport")) {
|
|
$proto eq "tcp" || $proto eq "udp" || $proto eq "sctp" ||
|
|
&error($text{'save_etcpudp'});
|
|
if ($in{"dport_type"} == 0) {
|
|
$in{"dport"} =~ /^\S+$/ ||
|
|
&error($text{'save_edport'});
|
|
if ($in{"dport"} =~ /,/) {
|
|
$rule->{'dports'}->[1] = $in{"dport"};
|
|
$rule->{'dports'}->[0] = $rule->{'dport'}->[0];
|
|
push(@mods, "multiport");
|
|
delete($rule->{'dport'});
|
|
}
|
|
else {
|
|
$rule->{'dport'}->[1] = $in{"dport"};
|
|
delete($rule->{'dports'});
|
|
}
|
|
}
|
|
else {
|
|
$in{"dport_from"} =~ /^\d*$/ ||
|
|
&error($text{'save_edportfrom'});
|
|
$in{"dport_to"} =~ /^\d*$/ ||
|
|
&error($text{'save_edportto'});
|
|
$rule->{'dport'}->[1] = $in{"dport_from"}.":".
|
|
$in{"dport_to"};
|
|
$rule->{'dport'}->[1] eq ":" &&
|
|
&error($text{'save_edportrange'});
|
|
delete($rule->{'dports'});
|
|
}
|
|
}
|
|
else {
|
|
delete($rule->{'dports'});
|
|
}
|
|
if (&parse_mode("ports", $rule, "ports")) {
|
|
$proto eq "tcp" || $proto eq "udp" || $proto eq "sctp" ||
|
|
&error($text{'save_etcpudp'});
|
|
$in{"ports"} =~ /^\S+$/ || &error($text{'save_eports'});
|
|
$rule->{'ports'}->[1] = $in{'ports'};
|
|
push(@mods, "multiport");
|
|
}
|
|
if (&parse_mode("tcpflags", $rule, "tcp-flags")) {
|
|
$proto eq "tcp" || &error($text{'save_etcp1'});
|
|
local $tcp0 = join(",", split(/\0/, $in{"tcpflags0"}));
|
|
local $tcp1 = join(",", split(/\0/, $in{"tcpflags1"}));
|
|
#$tcp0 && $tcp1 || &error($text{'save_etcpflags'});
|
|
$tcp0 || &error($text{'save_etcpflags2'});
|
|
$rule->{'tcp-flags'}->[1] = $tcp0;
|
|
$rule->{'tcp-flags'}->[2] = $tcp1 || "NONE";
|
|
}
|
|
if (&parse_mode("tcpoption", $rule, "tcp-option")) {
|
|
$proto eq "tcp" || &error($text{'save_etcp2'});
|
|
$in{"tcpoption"} =~ /^\d+$/ ||
|
|
&error($text{'save_etcpoption'});
|
|
$rule->{'tcp-option'}->[1] = $in{"tcpoption"};
|
|
}
|
|
if (&parse_mode("icmptype", $rule, "icmp${ipvx_icmp}-type")) {
|
|
$proto eq "icmp${ipvx_icmp}" || &error($text{'save_eicmp'});
|
|
$rule->{"icmp${ipvx_icmp}-type"}->[1] = $in{'icmptype'};
|
|
}
|
|
if (&parse_mode("macsource", $rule, "mac-source")) {
|
|
$in{"macsource"} =~ /^([0-9a-z]{2}:){5}[[0-9a-z]{2}$/i ||
|
|
&error($text{'save_emac'});
|
|
$rule->{'mac-source'}->[1] = $in{'macsource'};
|
|
push(@mods, "mac");
|
|
}
|
|
if (&parse_mode("limit", $rule, "limit")) {
|
|
$in{'limit0'} =~ /^\d+$/ || &error($text{'save_elimit'});
|
|
$rule->{'limit'}->[1] = $in{'limit0'}."/".$in{'limit1'};
|
|
push(@mods, "limit");
|
|
}
|
|
if (&parse_mode("limitburst", $rule, "limit-burst")) {
|
|
$in{'limitburst'} =~ /^\d+$/ ||
|
|
&error($text{'save_elimitburst'});
|
|
$rule->{'limit-burst'}->[1] = $in{'limitburst'};
|
|
push(@mods, "limit");
|
|
}
|
|
|
|
if ($rule->{'chain'} eq 'OUTPUT') {
|
|
if (&parse_mode("uidowner", $rule, "uid-owner")) {
|
|
defined(getpwnam($in{"uidowner"})) ||
|
|
&error($text{'save_euidowner'});
|
|
$rule->{'uid-owner'}->[1] = $in{"uidowner"};
|
|
push(@mods, "owner");
|
|
}
|
|
if (&parse_mode("gidowner", $rule, "gid-owner")) {
|
|
defined(getgrnam($in{"gidowner"})) ||
|
|
&error($text{'save_egidowner'});
|
|
$rule->{'gid-owner'}->[1] = $in{"gidowner"};
|
|
push(@mods, "owner");
|
|
}
|
|
if (&parse_mode("pidowner", $rule, "pid-owner")) {
|
|
$in{"pidowner"} =~ /^\d+$/ ||
|
|
&error($text{'save_epidowner'});
|
|
$rule->{'pid-owner'}->[1] = $in{"pidowner"};
|
|
push(@mods, "owner");
|
|
}
|
|
if (&parse_mode("sidowner", $rule, "sid-owner")) {
|
|
$in{"sidowner"} =~ /^\d+$/ ||
|
|
&error($text{'save_esidowner'});
|
|
$rule->{'sid-owner'}->[1] = $in{"sidowner"};
|
|
push(@mods, "owner");
|
|
}
|
|
}
|
|
|
|
# Save connection states and TOS
|
|
my $sd = &supports_conntrack() ? "ctstate" : "state";
|
|
if (&parse_mode($sd, $rule, $sd)) {
|
|
@states = split(/\0/, $in{$sd});
|
|
@states || &error($text{'save_estates'});
|
|
$rule->{$sd}->[1] = join(",", @states);
|
|
push(@mods, $sd eq "state" ? "state" : "conntrack");
|
|
}
|
|
if (&parse_mode("tos", $rule, "tos")) {
|
|
$rule->{'tos'}->[1] = $in{'tos'};
|
|
push(@mods, "tos");
|
|
}
|
|
|
|
# Parse physical input and output interfaces
|
|
if (&parse_mode("physdevin", $rule, "physdev-in")) {
|
|
$in{'physdevin'} ne '' || $in{'physdevin_other'} =~ /^\S+$/ ||
|
|
&error($text{'save_ephysdevin'});
|
|
$rule->{'physdev-in'}->[1] =
|
|
$in{'physdevin'} eq '' || $in{'physdevin'} eq 'other' ?
|
|
$in{'physdevin_other'} : $in{'physdevin'};
|
|
push(@mods, "physdev");
|
|
}
|
|
if (&parse_mode("physdevout", $rule, "physdev-out")) {
|
|
$in{'physdevout'} ne '' || $in{'physdevout_other'} =~ /^\S+$/ ||
|
|
&error($text{'save_ephysdevout'});
|
|
$rule->{'physdev-out'}->[1] =
|
|
$in{'physdevout'} eq '' || $in{'physdevout'} eq 'other' ?
|
|
$in{'physdevout_other'} : $in{'physdevout'};
|
|
push(@mods, "physdev");
|
|
}
|
|
|
|
# Parse physdev match modes
|
|
if (&parse_mode("physdevisin", $rule, "physdev-is-in")) {
|
|
push(@mods, "physdev");
|
|
}
|
|
if (&parse_mode("physdevisout", $rule, "physdev-is-out")) {
|
|
push(@mods, "physdev");
|
|
}
|
|
if (&parse_mode("physdevisbridged", $rule, "physdev-is-bridged")) {
|
|
push(@mods, "physdev");
|
|
}
|
|
|
|
# Add custom parameters and modules
|
|
$rule->{'args'} = $in{'args'};
|
|
push(@mods, split(/\s+/, $in{'mods'}));
|
|
|
|
# Save the rule
|
|
if (@mods) {
|
|
$rule->{'m'} = [ map { [ "", $_ ] } &unique(@mods) ];
|
|
}
|
|
else {
|
|
delete($rule->{'m'});
|
|
}
|
|
delete($rule->{'j'}) if (!$in{'jump'});
|
|
if ($in{'new'}) {
|
|
if ($in{'before'} ne '') {
|
|
splice(@{$table->{'rules'}}, $in{'before'}, 0, $rule);
|
|
}
|
|
elsif ($in{'after'} ne '') {
|
|
splice(@{$table->{'rules'}}, $in{'after'}+1, 0, $rule);
|
|
}
|
|
else {
|
|
push(@{$table->{'rules'}}, $rule);
|
|
}
|
|
}
|
|
}
|
|
|
|
# Write out the new save file
|
|
&run_before_command();
|
|
&save_table($table);
|
|
&run_after_command();
|
|
©_to_cluster();
|
|
&unlock_file($ipvx_save);
|
|
&webmin_log($in{'delete'} ? "delete" : $in{'new'} ? "create" : "modify",
|
|
"rule", undef, { 'chain' => $rule->{'chain'},
|
|
'table' => $table->{'name'} });
|
|
&redirect("index.cgi?version=${ipvx_arg}&table=$in{'table'}");
|
|
|
|
# parse_mode(name, &rule, option)
|
|
sub parse_mode
|
|
{
|
|
if ($in{"$_[0]_mode"} == 0) {
|
|
delete($_[1]->{$_[2]});
|
|
return 0;
|
|
}
|
|
elsif ($in{"$_[0]_mode"} == 1) {
|
|
$_[1]->{$_[2]} = [ "" ];
|
|
return 1;
|
|
}
|
|
else {
|
|
$_[1]->{$_[2]} = [ "!" ];
|
|
return 1;
|
|
}
|
|
}
|
|
|
|
|