cmaffio/pannello
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Aggiunta gestione regole in ingresso

Browse Source
This commit is contained in:
cmaffio
2016-06-21 16:23:20 +02:00
parent 3b97704f6d
commit da3fe71d69
9 changed files with 733 additions and 83 deletions
Download Patch File Download Diff File Expand all files Collapse all files

136
firewall/firewall_library.php
View File

@@ -1,9 +1,6 @@
<?php
function genera () {
// $file_in = "/etc/sysconfig/scripts/SuSEfirewall2-custom";
// $file_in = "tmp/fw.new";
// $file_out = "tmp/fw.new";
$FW_conf = carica_conf ("Firewall");
$FW = file ($FW_conf['file_in']);
@@ -34,13 +31,9 @@ function genera () {
array_push($dopo, $riga);
break;
}
}
$nuove_ext = genera_ext ();
$cancellare = array_diff($vecchie_u, $nuove_ext[0]);
$aggiungere = array_diff($nuove_ext[0], $vecchie_u);
@@ -52,15 +45,108 @@ function genera () {
elimina ($regola);
}
$new = array_merge($prima,$nuove_ext[1], $dopo);
$nuove_int = genera_int ();
$cancellare = array_diff($vecchie_i, $nuove_int[0]);
$aggiungere = array_diff($nuove_int[0], $vecchie_i);
foreach ($aggiungere as $regola) {
exec ($nuove_int[2][$regola]);
}
foreach ($cancellare as $regola) {
elimina ($regola);
}
$new = array_merge($prima,$nuove_ext[1],$nuove_int[1],$dopo);
file_put_contents ($FW_conf['file_out'], $new, LOCK_EX);
$comando = "sudo cp ".$FW_conf['file_out']." ".$FW_conf['file_in'];
exec ($comando);
}
function genera_ext () {
function genera_int () {
global $UTENTE, $DB_ID, $CONF, $FW_conf;
$query = " SELECT
firewall_versointerno_regole.id,
firewall_versointerno_regole.stato,
firewall_versointerno.proto,
firewall_versointerno.int_port,
firewall_versointerno.fw_port,
proxy_pool.ip AS int_ip,
firewall_vpn.ip AS ext_ip
FROM
firewall_versointerno_regole
JOIN
firewall_versointerno
ON
firewall_versointerno_regole.id_firewall_versointerno = firewall_versointerno.id
JOIN
firewall_macchine
ON
firewall_versointerno.id_firewall_macchine = firewall_macchine.id
JOIN
proxy_pool
ON
firewall_macchine.id_proxy_pool = proxy_pool.id
JOIN
firewall_vpn
ON
firewall_versointerno.id_firewall_vpn = firewall_vpn.id
WHERE
firewall_versointerno_regole.attivo = 1
AND
firewall_versointerno_regole.stato > 0
GROUP BY
firewall_versointerno_regole.id_firewall_versointerno
";
$nomi = array ();
$file = array ();
$esegui = array ();
$res = mysql_query( $query, $DB_ID );
while ($dato = mysql_fetch_array ( $res )) {
$id = $dato['id'];
$proto = $dato['proto'];
$stato = $dato['stato'];
$int_port = $dato['int_port'];
$ext_port = $dato['fw_port'];
$int_ip = $dato['int_ip'];
$ext_ip = $dato['ext_ip'];
$portaIN = $FW_conf['portaIN'];
array_push($nomi, "REGOLA-I$id");
if ($stato == 2) $perm = "PERMANENTE"; else $perm = "";
$regola = "### START REGOLA-I$id $perm ###\n";
$regola .= "iptables -I PREROUTING -t nat -p $proto -i $portaIN --dport $ext_port -j DNAT --to $int_ip:$int_port\n";
$regola .= "iptables -N REGOLA-I$id\n";
$regola .= "iptables -I REGOLA-I$id -p $proto -i $portaIN -s $ext_ip -d $int_ip --dport $int_port -j ACCEPT\n";
$regola .= "iptables -I REGOLA-I$id -p $proto -o $portaIN -d $ext_ip -s $int_ip --sport $int_port -j ACCEPT\n";
$regola .= "iptables -I FORWARD -j REGOLA-I$id\n";
$regola .= "### STOP REGOLA-I$id $perm ###\n";
array_push($file, $regola);
$regola .= "sudo iptables -I PREROUTING -t nat -p $proto -i $portaIN --dport $ext_port -j DNAT --to $int_ip:$int_port; ";
$regola .= "sudo iptables -N REGOLA-I$id; ";
$regola .= "sudo iptables -I REGOLA-I$id -p $proto -i $portaIN -s $ext_ip -d $int_ip --dport $int_port -j ACCEPT; ";
$regola .= "sudo iptables -I REGOLA-I$id -p $proto -o $portaIN -d $ext_ip -s $int_ip --sport $int_port -j ACCEPT; ";
$regola .= "sudo iptables -I FORWARD -j REGOLA-I$id; ";
$esegui['REGOLA-I'.$id] = $regola;
}
$ritorna[0] = $nomi;
$ritorna[1] = $file;
$ritorna[2] = $esegui;
return $ritorna;
}
function genera_ext () {
global $UTENTE, $DB_ID, $CONF, $FW_conf;
$query = " SELECT
firewall_versoesterno_regole.id,
@@ -70,10 +156,8 @@ function genera_ext () {
firewall_versoesterno.ext_port,
proxy_pool.ip AS int_ip,
firewall_macchine_ext.ip AS ext_ip
FROM
firewall_versoesterno_regole
JOIN
firewall_versoesterno
ON
@@ -90,8 +174,6 @@ function genera_ext () {
firewall_macchine_ext
ON
firewall_versoesterno.id_firewall_macchine_ext = firewall_macchine_ext.id
WHERE
firewall_versoesterno_regole.attivo = 1
AND
@@ -162,18 +244,14 @@ function genera_ext () {
$regola .= "sudo iptables -I FORWARD -j REGOLA-U$id";
$esegui['REGOLA-U'.$id] = $regola;
}
$ritorna[0] = $nomi;
$ritorna[1] = $file;
$ritorna[2] = $esegui;
return $ritorna;
}
function elimina ($cerca) {
exec ("sudo iptables -nL FORWARD --line-numbers | grep $cerca", $ritorno);
foreach (array_reverse($ritorno) as $riga) {
$pezzi = explode (" " , $riga);
@@ -183,4 +261,28 @@ function elimina ($cerca) {
}
}
function azzera () {
global $UTENTE, $DB_ID, $CONF, $FW_conf;
$query = " UPDATE
firewall_versoesterno_regole
SET
stato = 0,
modifica = NOW()
WHERE
stato = 1
";
$res = mysql_query( $query, $DB_ID );
$query = " UPDATE
firewall_versointerno_regole
SET
stato = 0,
modifica = NOW()
WHERE
stato = 1
";
$res = mysql_query( $query, $DB_ID );
}
?>