Project

General

Profile

Download (6.19 KB) Statistics
| Branch: | Tag: | Revision:
1
<?php
2
/*
3
 * openvpn.attributes.php
4
 *
5
 * part of pfSense (https://www.pfsense.org)
6
 * Copyright (c) 2011-2016 Rubicon Communications, LLC (Netgate)
7
 * All rights reserved.
8
 *
9
 * Redistribution and use in source and binary forms, with or without
10
 * modification, are permitted provided that the following conditions are met:
11
 *
12
 * 1. Redistributions of source code must retain the above copyright notice,
13
 *    this list of conditions and the following disclaimer.
14
 *
15
 * 2. Redistributions in binary form must reproduce the above copyright
16
 *    notice, this list of conditions and the following disclaimer in
17
 *    the documentation and/or other materials provided with the
18
 *    distribution.
19
 *
20
 * 3. All advertising materials mentioning features or use of this software
21
 *    must display the following acknowledgment:
22
 *    "This product includes software developed by the pfSense Project
23
 *    for use in the pfSense® software distribution. (http://www.pfsense.org/).
24
 *
25
 * 4. The names "pfSense" and "pfSense Project" must not be used to
26
 *    endorse or promote products derived from this software without
27
 *    prior written permission. For written permission, please contact
28
 *    coreteam@pfsense.org.
29
 *
30
 * 5. Products derived from this software may not be called "pfSense"
31
 *    nor may "pfSense" appear in their names without prior written
32
 *    permission of the Electric Sheep Fencing, LLC.
33
 *
34
 * 6. Redistributions of any form whatsoever must retain the following
35
 *    acknowledgment:
36
 *
37
 * "This product includes software developed by the pfSense Project
38
 * for use in the pfSense software distribution (http://www.pfsense.org/).
39
 *
40
 * THIS SOFTWARE IS PROVIDED BY THE pfSense PROJECT ``AS IS'' AND ANY
41
 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
42
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
43
 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE pfSense PROJECT OR
44
 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
45
 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
46
 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
47
 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
48
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
49
 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
50
 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
51
 * OF THE POSSIBILITY OF SUCH DAMAGE.
52
 */
53

    
54

    
55
if (empty($common_name)) {
56
	$common_name = getenv("common_name");
57
	if (empty($common_name)) {
58
		$common_name = getenv("username");
59
	}
60
}
61

    
62
$devname = getenv("dev");
63
if (empty($devname)) {
64
	$devname = "openvpn";
65
}
66

    
67
function cisco_to_cidr($addr) {
68
	if (!is_ipaddr($addr)) {
69
		return 0;
70
	}
71
	$mask = decbin(~ip2long($addr));
72
	$mask = substr($mask, -32);
73
	$k = 0;
74
	for ($i = 0; $i <= 32; $i++) {
75
		$k += intval($mask[$i]);
76
	}
77
	return $k;
78
}
79

    
80
function cisco_extract_index($prule) {
81

    
82
	$index = explode("#", $prule);
83
	if (is_numeric($index[1])) {
84
		return intval($index[1]);
85
	} else {
86
		syslog(LOG_WARNING, "Error parsing rule {$prule}: Could not extract index");
87
	}
88
	return -1;;
89
}
90

    
91
function parse_cisco_acl($attribs) {
92
	global $devname, $attributes;
93
	if (!is_array($attribs)) {
94
		return "";
95
	}
96
	$finalrules = "";
97
	if (is_array($attribs['ciscoavpair'])) {
98
		$inrules = array();
99
		$outrules = array();
100
		foreach ($attribs['ciscoavpair'] as $avrules) {
101
			$rule = explode("=", $avrules);
102
			$dir = "";
103
			if (strstr($rule[0], "inacl")) {
104
				$dir = "in";
105
			} else if (strstr($rule[0], "outacl")) {
106
				$dir = "out";
107
			} else if (strstr($rule[0], "dns-servers")) {
108
				$attributes['dns-servers'] = explode(" ", $rule[1]);
109
				continue;
110
			} else if (strstr($rule[0], "route")) {
111
				if (!is_array($attributes['routes'])) {
112
					$attributes['routes'] = array();
113
				}
114
				$attributes['routes'][] = $rule[1];
115
				continue;
116
			}
117
			$rindex = cisco_extract_index($rule[0]);
118
			if ($rindex < 0) {
119
				continue;
120
			}
121

    
122
			$rule = $rule[1];
123
			$rule = explode(" ", $rule);
124
			$tmprule = "";
125
			$index = 0;
126
			$isblock = false;
127
			if ($rule[$index] == "permit") {
128
				$tmprule = "pass {$dir} quick on {$devname} ";
129
			} else if ($rule[$index] == "deny") {
130
				//continue;
131
				$isblock = true;
132
				$tmprule = "block {$dir} quick on {$devname} ";
133
			} else {
134
				continue;
135
			}
136

    
137
			$index++;
138

    
139
			switch ($rule[$index]) {
140
				case "tcp":
141
				case "udp":
142
					$tmprule .= "proto {$rule[$index]} ";
143
					break;
144
			}
145

    
146
			$index++;
147
			/* Source */
148
			if (trim($rule[$index]) == "host") {
149
				$index++;
150
				$tmprule .= "from {$rule[$index]} ";
151
				$index++;
152
				if ($isblock == true) {
153
					$isblock = false;
154
				}
155
			} else if (trim($rule[$index]) == "any") {
156
				$tmprule .= "from any ";
157
				$index++;
158
			} else {
159
				$tmprule .= "from {$rule[$index]}";
160
				$index++;
161
				$netmask = cisco_to_cidr($rule[$index]);
162
				$tmprule .= "/{$netmask} ";
163
				$index++;
164
				if ($isblock == true) {
165
					$isblock = false;
166
				}
167
			}
168
			/* Destination */
169
			if (trim($rule[$index]) == "host") {
170
				$index++;
171
				$tmprule .= "to {$rule[$index]} ";
172
				$index++;
173
				if ($isblock == true) {
174
					$isblock = false;
175
				}
176
			} else if (trim($rule[$index]) == "any") {
177
				$index++;
178
				$tmprule .= "to any";
179
			} else {
180
				$tmprule .= "to {$rule[$index]}";
181
				$index++;
182
				$netmask = cisco_to_cidr($rule[$index]);
183
				$tmprule .= "/{$netmask} ";
184
				$index++;
185
				if ($isblock == true) {
186
					$isblock = false;
187
				}
188
			}
189

    
190
			if ($isblock == true) {
191
				continue;
192
			}
193

    
194
			if ($dir == "in") {
195
				$inrules[$rindex] = $tmprule;
196
			} else if ($dir == "out") {
197
				$outrules[$rindex] = $tmprule;
198
			}
199
		}
200

    
201

    
202
		$state = "";
203
		if (!empty($outrules)) {
204
			$state = "no state";
205
		}
206
		ksort($inrules, SORT_NUMERIC);
207
		foreach ($inrules as $inrule) {
208
			$finalrules .= "{$inrule} {$state}\n";
209
		}
210
		if (!empty($outrules)) {
211
			ksort($outrules, SORT_NUMERIC);
212
			foreach ($outrules as $outrule) {
213
				$finalrules .= "{$outrule} {$state}\n";
214
			}
215
		}
216
	}
217
	return $finalrules;
218
}
219

    
220
$rules = parse_cisco_acl($attributes);
221
if (!empty($rules)) {
222
	$pid = posix_getpid();
223
	@file_put_contents("/tmp/ovpn_{$pid}{$common_name}.rules", $rules);
224
	mwexec("/sbin/pfctl -a " . escapeshellarg("openvpn/{$common_name}") . " -f {$g['tmp_path']}/ovpn_{$pid}" . escapeshellarg($common_name) . ".rules");
225
	@unlink("{$g['tmp_path']}/ovpn_{$pid}{$common_name}.rules");
226
}
227

    
228
?>
(35-35/65)