diff options
| -rw-r--r-- | perl-install/tinyfirewall.pm | 248 |
1 files changed, 223 insertions, 25 deletions
diff --git a/perl-install/tinyfirewall.pm b/perl-install/tinyfirewall.pm index f502ea1f1..4ff57387c 100644 --- a/perl-install/tinyfirewall.pm +++ b/perl-install/tinyfirewall.pm @@ -5,8 +5,10 @@ use strict; use common qw(:common :functional :system :file); use commands; use run_program; +use netconnect; +use network; use my_gtk qw(:helpers :wrappers); - +use Data::Dumper; my @messages = (_("tinyfirewall configurator @@ -58,15 +60,76 @@ _("Configuration complete. May we write these changes to disk?") ); my %settings; -sub ReadConfig { +#sub ReadConfig { +my $config_file = "/etc/Bastille/bastille-firewall.cfg"; +my $default_config_file = "/usr/share/Bastille/bastille-firewall.cfg"; # set this later +sub ReadConfig +############################## +## Reads the default values from $config_file +{ + ## if $config_file doesn't exist, move the + ## $default_config_file to $config_file + + system ("/bin/cp $default_config_file $config_file") + if !( -e $config_file); + + + open CONFIGFILE, $config_file + or die "Can't open $config_file: $!\n"; + + while (my $line = <CONFIGFILE>) + { + $line =~ s/\#.*$//; # remove comments + $line =~ s/^\s+//; # remove leading whitespace + $line =~ s/\s+$//; # remove tailing whitespace + $line =~ s/\s+/ /; # remove extra whitespace + + + ## what's left will be useful stuff, so + ## get the values + + $line =~ m/^(.+)\s*\=\s*\"(.*)\"\s*$/; + my ($variable, $value) = ($1, $2); + + + ## set the proper value in the hash + + $settings{$variable} = $value + if ($variable); + } + + close CONFIGFILE; + return; my ($config_file, $default_config_file)=@_; $config_file ||= "/etc/Bastille/bastille-firewall.cfg"; - $default_config_file ||= "/usr/share/Bastille/bastille-firewall.cfg"; # set this later + $default_config_file ||= "/usr/share/Bastille/bastille-firewall.cfg"; -e $config_file or cp($default_config_file, $config_file); - add2hash(\%settings, { getVarsFromSh("$config_file") }) + add2hash(\%settings, { getVarsFromSh("$config_file") }); + print Data::Dumper->Dump ( [%settings], ["plop"]) . "\n"; } -my $GetNetworkInfo = sub { print "in int! :=\n"}; +my $GetNetworkInfo = sub { + $settings{DNS_SERVERS} = join(' ', uniq(split(' ', $settings{DNS_SERVERS}), + @{network::read_resolv_conf("/etc/resolv.conf")}{'dnsServer', 'dnsServer2', 'dnsServer3'})); + open NETSTAT, "/bin/netstat -in |" or die "Can't pipe from /bin/netstat: $!\n"; <NETSTAT>; <NETSTAT>; + my @interfaces = map { (split / /)[0]; } (<NETSTAT>); close NETSTAT; + open ROUTE, "/sbin/route -n |" or die "Can't pipe from /sbin/route: $!\n"; <ROUTE>; <ROUTE>; + my $defaultgw; + my $iface; + while (<ROUTE>) { + my @parts = split /\s+/; + ($parts[0] eq "0.0.0.0") and $defaultgw = $parts[1], $iface = $parts[7]; + } close ROUTE; + my $fulliface = $iface; + $fulliface =~ s/[0-9]+/\\\+/; # so we can match eth0 against eth+, for example + $settings{PUBLIC_INTERFACES} = join(' ', uniq(split(' ', $settings{PUBLIC_INTERFACES}), $iface)); + $settings{PUBLIC_INTERFACES} =~ $fulliface and $settings{PUBLIC_INTERFACES} =~ s/$iface *//; + $settings{INTERNAL_IFACES} = join(' ', uniq(split(' ', $settings{INTERNAL_IFACES}), + map { my $i=$_; my $f=$i; $f=~s/[0-9]+/\\\+/; + if_(and_( map {$settings{$_} !~ /$i/ and $settings{$_} !~ /$f/ } ('TRUSTED_IFACES', 'PUBLIC_IFACES', 'INTERNAL_IFACES')), $i) + } (@interfaces) )); + print Data::Dumper->Dump ( [%settings], ["plop"]) . "\n"; +}; sub DoInterface { my ($in)=@_; @@ -81,35 +144,171 @@ sub DoInterface { [undef , undef, undef, "ftp no", "ftp yes", ["tcp", "20"],["tcp", "21"]], [undef , undef, undef, "smtp no", "smtp yes", ["tcp", "25"]], [undef , undef, undef, "popimap no", "popimap yes", ["tcp", "109"], ["tcp", "110"], ["tcp", "143"]], - [undef , _("No I don't need DHCP"), "Yes I need DHCP", "dhcp no", "dhcp yes", [$settings{DHCP_IFACES}]], - [undef , _("No I don't need NTP"), "Yes I need NTP", "ntp no", "ntp yes", ] + [undef , _("No I don't need DHCP"), _("Yes I need DHCP"), "dhcp no", "dhcp yes", [$settings{DHCP_IFACES}]], + [undef , _("No I don't need NTP"), _("Yes I need NTP"), "ntp no", "ntp yes", ] ); - my $totalsteps = @struct; - $totalsteps -= 2 if !Kernel22(); - # $curstep=0; - # my $step = "Step " . ($curstep eq $num_steps && !Kernel22() ? $curstep - 2 : $curstep) . " / $totalsteps\n\n"; - - foreach (0..@struct) { - my $l = $struct[$_]; - my $size=@$l; - $size or next; - print "### $size ###\n"; - $size == 1 and ($l->[0])->(); + !Kernel22() and pop @struct, pop @struct; + for (my $i=0;$i<@struct;$i++) { + $::Wizard_no_previous = $i == 0; + $::Wizard_finished = $i == $#struct; + my $l = $struct[$i]; + @$l or goto ask; + if (@$l == 1) { + ($l->[0])->(); + ask: + $in->ask_okcancel(_("Firewall Configuration Wizard"), $messages[$i],1) ? next : goto prev; + } my $no = $l->[1] ? $l->[1] : _("No (firewall this off from the internet)"); my $yes = $l->[2] ? $l->[2] : _("Yes (allow this through the firewall)"); - print "Y : $yes\n"; - print "N : $no\n"; - if ($in->ask_from_list(_("Firewall Configuration Wizard"), - $messages[$_], + if (my $e = $in->ask_from_list(_("Firewall Configuration Wizard"), + $messages[$i], [ $yes, $no ], or_( map { if_($_, CheckService($_->[0], $_->[1])) } (@$l[5..7])) ? $yes : $no )) { - print "EEEEEEEEEEEEEEEEE\n"; + WidgetHandler($i, $e =~ /Yes/) } else { - print "NNNNNNNNNNN\n"; + prev: + $i = $i-2 >= -1 ? $i-2 : -1; } } } +sub WidgetHandler { + my ($i, $e)=@_; + + if ($data eq "save no") + { + Gtk->exit (0); + } + elsif ($data eq "save yes") + { + CloseWindow(); + } + elsif ($data eq "quit no") + { + DestroyStep(); + $curstep = $previous_step; + DoInterface(); + return 0; + } + + if ($togglebutton->active) + { + if ($data eq "http no") + { + RemoveService ("tcp", "80"); + RemoveService ("tcp", "443"); + } + + elsif ($data eq "http yes") + { + AddService ("tcp", "80"); + AddService ("tcp", "443"); + } + + elsif ($data eq "dns no") + { + RemoveService ("tcp", "53"); + RemoveService ("udp", "53"); + } + + elsif ($data eq "dns yes") + { + AddService ("tcp", "53"); + AddService ("udp", "53"); + } + elsif ($data eq "ssh no") + { + RemoveService ("tcp", "22"); + } + elsif ($data eq "ssh yes") + { + AddService ("tcp", "22"); + } + elsif ($data eq "telnet no") + { + RemoveService ("tcp", "23"); + } + elsif ($data eq "telnet yes") + { + AddService ("tcp", "23"); + } + elsif ($data eq "ftp no") + { + RemoveService ("tcp", "20"); + RemoveService ("tcp", "21"); + } + elsif ($data eq "ftp yes") + { + AddService ("tcp", "20"); + AddService ("tcp", "21"); + } + elsif ($data eq "smtp no") + { + RemoveService ("tcp", "25"); + } + elsif ($data eq "smtp yes") + { + AddService ("tcp", "25"); + } + elsif ($data eq "popimap no") + { + RemoveService ("tcp", "109"); + RemoveService ("tcp", "110"); + RemoveService ("tcp", "143"); + + + } + elsif ($data eq "popimap yes") + { + AddService ("tcp", "109"); + AddService ("tcp", "110"); + AddService ("tcp", "143"); + + $settings{FORCE_PASV_FTP} = "N"; + $settings{TCP_BLOCKED_SERVICES} = "6000:6020"; + $settings{UDP_BLOCKED_SERVICES} = "2049"; + $settings{ICMP_ALLOWED_TYPES} = "destination-unreachable echo-reply time-exceeded"; + $settings{ENABLE_SRC_ADDR_VERIFY} = "Y"; + $settings{IP_MASQ_NETWORK} = ""; + $settings{IP_MASQ_MODULES} = ""; + $settings{REJECT_METHOD} = "DENY"; + } + elsif ($data eq "dhcp yes") + { + return if $settings{DHCP_IFACES}; # variable already has something + + ## Get a list of network interfaces + + open NETSTAT, "/bin/netstat -in |" + or die "Can't pipe from /bin/netstat: $!\n"; + + <NETSTAT>; <NETSTAT>; # get rid of first 2 lines + + my @interfaces; + + while (<NETSTAT>) + { + $settings{DHCP_IFACES} .= (split / /)[0] . " "; + } + + close NETSTAT; + + chop $settings{DHCP_IFACES} + } + elsif ($data eq "dhcp no") + { + $settings{DHCP_IFACES} = ""; + } + elsif ($data eq "ntp yes") + { + $settings{ICMP_OUTBOUND_DISABLED_TYPES} = ""; + $settings{LOG_FAILURES} = "N"; + } + + + + } +} sub CheckService { my ($protocol, $port) = @_; @@ -129,5 +328,4 @@ sub main { my ($in)=@_; ReadConfig; DoInterface($in); - } |