perl-install/pixmaps/langs/lang-tk.png

package network::drakfirewall; # $Id$

use strict;
use diagnostics;

use network::shorewall;
use common;
use network::nfs;
use network::network;

my @all_servers =
(
  {
   name => N_("Web Server"),
   pkg => 'apache apache-mod_perl boa lighttpd thttpd',
   ports => '80/tcp 443/tcp',
  },
  {
   name => N_("Domain Name Server"),
   pkg => 'bind dnsmasq mydsn',
   ports => '53/tcp 53/udp',
  },
  {
   name => N_("SSH server"),
   pkg => 'openssh-server',
   ports => '22/tcp',
  },
  {
   name => N_("FTP server"),
   pkg => 'ftp-server-krb5 wu-ftpd proftpd pure-ftpd',
   ports => '20/tcp 21/tcp',
  },
  {
   name => N_("DHCP Server"),
   pkg => 'dhcp-server udhcpd',
   ports => '67/udp 68/udp',
   hide => 1,
  },
  {
   name => N_("Mail Server"),
   pkg => 'sendmail postfix qmail exim',
   ports => '25/tcp',
  },
  {
   name => N_("POP and IMAP Server"),
   pkg => 'imap courier-imap-pop',
   ports => '109/tcp 110/tcp 143/tcp',
  },
  {
   name => N_("Telnet server"),
   pkg => 'telnet-server-krb5',
   ports => '23/tcp',
   hide => 1,
  },
  {
   name => N_("NFS Server"),
   pkg => 'nfs-utils nfs-utils-clients',
   ports => '111/tcp 111/udp 2049/tcp 2049/udp ' . network::nfs::list_nfs_ports(),
   hide => 1,
   prepare => sub { network::nfs::write_nfs_ports(network::nfs::read_nfs_ports()); },
   restart => 'nfs-common nfs-server',
  },
  {
   name => N_("Windows Files Sharing (SMB)"),
   pkg => 'samba-server',
   ports => '137/tcp 137/udp 138/tcp 138/udp 139/tcp 139/udp 445/tcp 445/udp 1024:1100/tcp 1024:1100/udp',
   hide => 1,
  },
  {
   name => N_("Bacula backup"),
   pkg => 'bacula-fd bacula-sd bacula-dir-common',
   ports => '9101:9103/tcp',
   hide => 1,
  },
  {
   name => N_("Syslog network logging"),
   pkg => 'rsyslog syslog-ng',
   ports => '514/udp',
   hide => 1,
  },
  {
   name => N_("CUPS server"),
   pkg => 'cups',
   ports => '631/tcp 631/udp',
   hide => 1,
  },
  {
   name => N_("MySQL server"),
   pkg => 'mysql',
   ports => '3306/tcp 3306/udp',
   hide => 1,
  },
  {
   name => N_("PostgreSQL server"),
   pkg => 'postgresql8.2 postgresql8.3',
   ports => '5432/tcp 5432/udp',
   hide => 1,
  },
  {
   name => N_("Echo request (ping)"),
   ports => '8/icmp',
   force_default_selection => 0,
  },
  {
   name => N_("AVAHI and mDNS"),
   ports => '5353/udp',
   hide => 1,
   pkg => 'avahi',
  },
  {
   name => N_("BitTorrent"),
   ports => '6881:6999/tcp',
   hide => 1,
   pkg => 'bittorrent deluge ktorrent transmission vuze rtorrent ctorrent',
  },
  {
   name => N_("Windows Mobile device synchronization"),
   pkg => 'synce-hal',
   ports => '990/tcp 999/tcp 5678/tcp 5679/udp 26675/tcp',
   hide => 1,
  },
);

my @ifw_rules = (
    {
        name => N_("Port scan detection"),
        ifw_rule => 'psd',
    },
);

# global network configuration
my $net = {};
network::network::read_net_conf($net);

sub port2server {
    my ($port) = @_;
    find {
	any { $port eq $_ } split(' ', $_->{ports});
    } @all_servers;
}

sub check_ports_syntax {
    my ($ports) = @_;
    foreach (split ' ', $ports) {
	my ($nb, $range, $nb2) = m!^(\d+)(:(\d+))?/(tcp|udp|icmp)$! or return $_;
	foreach my $port ($nb, if_($range, $nb2)) {
	    1 <= $port && $port <= 65535 or return $_;
	}
	$nb < $nb2 or return $_ if $range;
    }
    '';
}

sub to_ports {
    my ($servers, $unlisted) = @_;
    join(' ', (map { $_->{ports} } @$servers), if_($unlisted, $unlisted));
}

sub from_ports {
    my ($ports) = @_;

    my @l;
    my @unlisted;
    foreach (split ' ', $ports) {
	if (my $s = port2server($_)) {
	    push @l, $s;
	} else {
	    push @unlisted, $_;
	}
    }
    [ uniq(@l) ], join(' ', @unlisted);
}

sub default_from_pkgs {
    my ($do_pkgs) = @_;
    my @pkgs = $do_pkgs->are_installed(map { split ' ', $_->{pkg} } @all_servers);
    [ grep {
	my $s = $_;
	exists $s->{force_default_selection} ?
	  $s->{force_default_selection} :
	  any { member($_, @pkgs) } split(' ', $s->{pkg});
    } @all_servers ];
}

sub default_ports {
    my ($do_pkgs) = @_;
    to_ports(default_from_pkgs($do_pkgs), '');
}

sub get_ports() {
    my $shorewall = network::shorewall::read() or return;
    $shorewall->{ports};
}

sub set_ports {
    my ($do_pkgs, $disabled, $ports, $log_net_drop, $o_in) = @_;

    if (!$disabled || -x "$::prefix/sbin/shorewall") {
	$do_pkgs->ensure_binary_is_installed('shorewall', 'shorewall', $::isInstall) or return;
	my $shorewall = network::shorewall::read(!$disabled && $o_in);
	if (!$shorewall) {
	    log::l("unable to read shorewall configuration, skipping installation");
	    return;
	}

	$shorewall->{disabled} = $disabled;
	$shorewall->{ports} = $ports;
        $shorewall->{log_net_drop} = $log_net_drop;
	log::l($disabled ? "disabling shorewall" : "configuring shorewall to allow ports: $ports");
	network::shorewall::write($shorewall, $o_in);
    }
}

sub get_conf {
    my ($in, $disabled, $o_ports) = @_;

    my $possible_servers = default_from_pkgs($in->do_pkgs);
    $_->{hide} = 0 foreach @$possible_servers;

    if ($o_ports) {
	$disabled, from_ports($o_ports);
    } elsif (my $shorewall = network::shorewall::read()) {
	$shorewall->{disabled}, from_ports($shorewall->{ports}), $shorewall->{log_net_drop};
    } else {
	$in->ask_okcancel(N("Firewall configuration"), N("drakfirewall configurator

This configures a personal firewall for this Mandriva Linux machine.
For a powerful and dedicated firewall solution, please look to the
specialized Mandriva Security Firewall distribution."), 1) or return;

	$in->ask_okcancel(N("Firewall configuration"), N("drakfirewall configurator

Make sure you have configured your Network/Internet access with
drakconnect before going any further."), 1) or return;

	$disabled, $possible_servers, '';
    }
}

sub choose_allowed_services {
    my ($in, $disabled, $servers, $unlisted, $log_net_drop) = @_;

    $_->{on} = 0 foreach @all_servers;
    $_->{on} = 1 foreach @$servers;
    my @l = grep { $_->{on} || !$_->{hide} } @all_servers;

    $in->ask_from_({
		    title => N("Firewall"),
		    icon => $network::shorewall::firewall_icon,
		    if_(!$::isEmbedded, banner_title => N("Firewall")),
		    advanced_messages => N("You can enter miscellaneous ports. 
Valid examples are: 139/tcp 139/udp 600:610/tcp 600:610/udp.
Have a look at /etc/services for information."),
		    callbacks => {
			complete => sub {
			    if (my $invalid_port = check_ports_syntax($unlisted)) {
				$in->ask_warn('', N("Invalid port given: %s.
The proper format is \"port/tcp\" or \"port/udp\", 
where port is between 1 and 65535.

You can also give a range of ports (eg: 24300:24350/udp)", $invalid_port));
				return 1;
			    }
			},
		   } },
		  [
		   { label => N("Which services would you like to allow the Internet to connect to?"), title => 1 },
		   if_($net->{PROFILE} && network::network::netprofile_count() > 0, { label => N("Those settings will be saved for the network profile <b>%s</b>", $net->{PROFILE}) }),
		   { text => N("Everything (no firewall)"), val => \$disabled, type => 'bool' },
		   (map { { text => translate($_->{name}), val => \$_->{on}, type => 'bool', disabled => sub { $disabled } } } @l),
		   { label => N("Other ports"), val => \$unlisted, advanced => 1, disabled => sub { $disabled } },
		   { text => N("Log firewall messages in system logs"), val => \$log_net_drop, type => 'bool', advanced => 1, disabled => sub { $disabled } },
		  ]) or return;

    $disabled, [ grep { $_->{on} } @l ], $unlisted, $log_net_drop;
}

sub set_ifw {
    my ($do_pkgs, $enabled, $rules, $ports) = @_;
    if ($enabled) {
        $do_pkgs->ensure_is_installed('mandi-ifw', '/etc/ifw/start', $::isInstall) or return;

        my $ports_by_proto = network::shorewall::ports_by_proto($ports);
        output_with_perm("$::prefix/etc/ifw/rules", 0644,
            (map { "source /etc/ifw/rules.d/$_\n" } @$rules),
            map {
                my $proto = $_;
                map {
                    my $multiport = /:/ && " -m multiport";
ofs	hex dump	ascii
0000	89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 a8 00 00 00 0f 08 06 00 00 00 70 52 84	.PNG........IHDR.............pR.
0020	e2 00 00 02 a8 49 44 41 54 78 9c ed d9 5d a8 4e 59 1c c7 f1 cf e1 48 42 5e c7 5b 92 64 bc 34 1a	.....IDATx...].NY.....HB^.[.d.4.
0040	13 52 e4 c2 a1 71 81 e4 42 6a 4a ae c7 8d 5c 78 19 35 cd c5 a4 99 91 97 48 91 dc c8 15 b9 d1 b8	.R...q..BjJ...\x.5......H.......
0060	32 79 29 4a 1c 52 1c 71 e1 75 24 4a e2 44 18 0e 99 8b b5 4e f6 d9 9e cd b3 1f cf d3 29 ad 6f 3d	2y)J.R.q.u$J.D.....N........).o=
0080	3d 6b ff fb af df ff bf eb bf ff 6b ad bd 49 24 be 12 96 e1 3d c6 63 71 1c 8f ae 72 ee dc e8 3f	=k.........k..I$....=.cq...r...?
00a0	b4 21 99 25 be 5a 9a 85 c2 f9 1c 83 70 09 ab f0 08 6f e2 f8 69 e3 52 4b 24 68 c2 0f 99 eb 16 6c	.!.%.Z......p....o..i.RK$h.....l
00c0	c7 22 3c c8 d8 db f0 ae c6 18 bd 31 0b a7 f0 0d 1e d7 a8 93 48 58 2a 74 d4 b1 39 fb dc 68 1f 98	."<........1........HX*t..9..h..
00e0	b3 df c7 9a 0a 7e 2b 84 a2 7e 8e b5 3e 5e e2 9b b0 59 28 d6 d9 b9 b9 0b 70 11 af 70 36 e6 32 03	.....~+..~..>^...Y(.....p..p6.2.
0100	ad f8 0f 17 f0 6d 26 66 0f ac c3 0d a1 b3 df c7 26 61 75 c8 e7 b5 12 d7 63 5e ad 98 98 f1 e9 89	.....m&f........&au.....c^......
0120	5f 71 1b 1d 51 e7 97 92 71 12 0d a6 5e 05 7a 01 e3 a2 ad 9f ae 05 da 1b 07 71 4b d7 42 eb f4 69	_q..Q...q...^.z..........qK.B..i
0140	c5 3c 7c 8f f3 38 87 33 42 77 9f 1a 6d c7 33 f3 b6 e2 26 16 0a 7b e2 16 a1 88 b6 54 d0 3e 86 21	.<\|..8.3Bw..m.3...&..{.....T.>.!
0160	31 87 a3 42 57 ef 64 27 da 85 87 6b 0c a6 e3 a7 92 71 12 0d a6 5e 05 fa 63 c1 fc 09 38 2d 14 d9	1..BW.d'...k.....q...^..c...8-..
0180	b0 02 9f ec dc e5 d1 d6 92 b3 75 08 1d 6f b0 d0 cd e6 e5 b4 96 0b c5 d6 94 d3 9e 99 f1 59 1a 75	..........u..o...............Y.u
01a0	9a a3 4e 07 7e 56 99 6a e3 24 ea 4c a3 96 a7 b6 02 fb 71 fc 2b 14 dc cb 02 9f 2b 99 f1 a3 02 5b	..N.~V.j.$.L......q.+.....+....[
01c0	b3 d0 99 a7 a2 17 4e 14 68 f5 c7 b3 cc f5 9d cc b8 3d ea f4 c5 94 38 3e 59 a0 53 36 4e a2 4e f4	......N.h........=....8>Y.S6N.N.
01e0	a8 d2 af e8 a4 df b3 c0 fe b6 c0 7e 04 d3 30 e7 13 b1 2a 1d c6 2a d9 9a 7c c8 ff bb 78 9d ff e5	...........~..0.......\|...x...
0200	8b a6 d2 7d 54 d3 fd ca c6 49 d4 89 6a 0b b4 3d fe 8f c8 d8 46 62 78 c9 78 bf e3 37 fc 8d 25 25	...}T....I..j..=....Fbx.x..7..%%
0220	e7 56 e2 b2 f0 30 cc ff 42 9d ab 51 27 bf 84 d7 3b 4e a2 24 d5 2e f1 d7 f0 10 7f 60 23 06 e0 2f	.V...0..B..Q'...;N.$.......`#../
0240	bc ae 21 e6 36 61 79 3f 2c 9c aa 0f d5 a0 d1 c9 63 ec 88 79 bd c6 3f c2 3d cd 10 3e 28 6c aa 52	..!.6ay?,.......c..y..?.=..>(l.R
0260	e7 09 f6 0a f7 f4 5c d8 27 0f c1 24 e1 40 57 af 38 89 92 54 5b a0 1d c2 81 60 8f b0 bf bc 2b bc	......\.'..$.@W.8..T[....`....+.
0280	92 99 50 63 dc 3d 78 81 03 e8 83 fd 35 ea c0 7a dc c3 6a ec 8a b9 b6 61 77 49 9d 35 42 21 fe 89	..Pc.=x.....5..z..j....awI.5B!..
02a0	51 c2 03 b9 ab 01 71 12 89 2f 66 25 36 74 77 12 89 44 9e ce 83 d7 64 e1 1d 67 a2 9b 49 5f 41 ba	Q.....q../f%6tw..D....d..g..I_A.
02c0	d2 4f 38 10 f5 c1 be 6e ce 25 81 ff 01 55 31 b1 12 39 9d eb be 00 00 00 00 49 45 4e 44 ae 42 60	.O8....n.%...U1..9.......IEND.B`
02e0	82	.