/src/etc/inc/openvpn.attributes.php - Annotate - pfSense - pfSense bugtracker

| Branch: | Tag: | Revision:

root/src/etc/inc/openvpn.attributes.php @ 44c64da1

1	5b4ee05e	Ermal	<?php
2			/*
3	ac24dc24	Renato Botelho	* openvpn.attributes.php
4			*
5			* part of pfSense (https://www.pfsense.org)
6	81299b5c	Renato Botelho	* Copyright (c) 2011-2016 Rubicon Communications, LLC (Netgate)
7	ac24dc24	Renato Botelho	* All rights reserved.
8			*
9	b12ea3fb	Renato Botelho	* Licensed under the Apache License, Version 2.0 (the "License");
10			* you may not use this file except in compliance with the License.
11			* You may obtain a copy of the License at
12	ac24dc24	Renato Botelho	*
13	b12ea3fb	Renato Botelho	* http://www.apache.org/licenses/LICENSE-2.0
14	ac24dc24	Renato Botelho	*
15	b12ea3fb	Renato Botelho	* Unless required by applicable law or agreed to in writing, software
16			* distributed under the License is distributed on an "AS IS" BASIS,
17			* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
18			* See the License for the specific language governing permissions and
19			* limitations under the License.
20	ac24dc24	Renato Botelho	*/
21	09221bc3	Renato Botelho
22	5b4ee05e	Ermal
23			if (empty($common_name)) {
24			$common_name = getenv("common_name");
25	b37a2e8c	Phil Davis	if (empty($common_name)) {
26	5b4ee05e	Ermal	$common_name = getenv("username");
27	b37a2e8c	Phil Davis	}
28	5b4ee05e	Ermal	}
29
30			$devname = getenv("dev");
31	b37a2e8c	Phil Davis	if (empty($devname)) {
32	5b4ee05e	Ermal	$devname = "openvpn";
33	b37a2e8c	Phil Davis	}
34	5b4ee05e	Ermal
35			function cisco_to_cidr($addr) {
36	b37a2e8c	Phil Davis	if (!is_ipaddr($addr)) {
37	5b4ee05e	Ermal	return 0;
38	b37a2e8c	Phil Davis	}
39	5b4ee05e	Ermal	$mask = decbin(~ip2long($addr));
40			$mask = substr($mask, -32);
41			$k = 0;
42			for ($i = 0; $i <= 32; $i++) {
43			$k += intval($mask[$i]);
44			}
45			return $k;
46			}
47
48			function cisco_extract_index($prule) {
49	b37a2e8c	Phil Davis
50	5b4ee05e	Ermal	$index = explode("#", $prule);
51	b37a2e8c	Phil Davis	if (is_numeric($index[1])) {
52	5b4ee05e	Ermal	return intval($index[1]);
53	b37a2e8c	Phil Davis	} else {
54	5b4ee05e	Ermal	syslog(LOG_WARNING, "Error parsing rule {$prule}: Could not extract index");
55	b37a2e8c	Phil Davis	}
56	5b4ee05e	Ermal	return -1;;
57			}
58
59			function parse_cisco_acl($attribs) {
60			global $devname, $attributes;
61	b37a2e8c	Phil Davis	if (!is_array($attribs)) {
62	5b4ee05e	Ermal	return "";
63	b37a2e8c	Phil Davis	}
64	5b4ee05e	Ermal	$finalrules = "";
65			if (is_array($attribs['ciscoavpair'])) {
66			$inrules = array();
67			$outrules = array();
68			foreach ($attribs['ciscoavpair'] as $avrules) {
69			$rule = explode("=", $avrules);
70			$dir = "";
71			if (strstr($rule[0], "inacl")) {
72			$dir = "in";
73	b37a2e8c	Phil Davis	} else if (strstr($rule[0], "outacl")) {
74	5b4ee05e	Ermal	$dir = "out";
75	b37a2e8c	Phil Davis	} else if (strstr($rule[0], "dns-servers")) {
76	5b4ee05e	Ermal	$attributes['dns-servers'] = explode(" ", $rule[1]);
77			continue;
78			} else if (strstr($rule[0], "route")) {
79	b37a2e8c	Phil Davis	if (!is_array($attributes['routes'])) {
80	5b4ee05e	Ermal	$attributes['routes'] = array();
81	b37a2e8c	Phil Davis	}
82	9f293b1c	jim-p	$attributes['routes'][] = $rule[1];
83	5b4ee05e	Ermal	continue;
84	b37a2e8c	Phil Davis	}
85	5b4ee05e	Ermal	$rindex = cisco_extract_index($rule[0]);
86	b37a2e8c	Phil Davis	if ($rindex < 0) {
87	5b4ee05e	Ermal	continue;
88	b37a2e8c	Phil Davis	}
89	5b4ee05e	Ermal
90			$rule = $rule[1];
91			$rule = explode(" ", $rule);
92			$tmprule = "";
93			$index = 0;
94			$isblock = false;
95	b37a2e8c	Phil Davis	if ($rule[$index] == "permit") {
96	5b4ee05e	Ermal	$tmprule = "pass {$dir} quick on {$devname} ";
97	b37a2e8c	Phil Davis	} else if ($rule[$index] == "deny") {
98	5b4ee05e	Ermal	//continue;
99			$isblock = true;
100			$tmprule = "block {$dir} quick on {$devname} ";
101			} else {
102			continue;
103			}
104
105			$index++;
106
107			switch ($rule[$index]) {
108	b37a2e8c	Phil Davis	case "tcp":
109			case "udp":
110			$tmprule .= "proto {$rule[$index]} ";
111			break;
112	5b4ee05e	Ermal	}
113
114			$index++;
115			/* Source */
116			if (trim($rule[$index]) == "host") {
117			$index++;
118			$tmprule .= "from {$rule[$index]} ";
119			$index++;
120	b37a2e8c	Phil Davis	if ($isblock == true) {
121	5b4ee05e	Ermal	$isblock = false;
122	b37a2e8c	Phil Davis	}
123	5b4ee05e	Ermal	} else if (trim($rule[$index]) == "any") {
124	b0ccc67b	Phil Davis	$tmprule .= "from any ";
125	5b4ee05e	Ermal	$index++;
126			} else {
127	8340d956	Renato Botelho	$tmprule .= "from {$rule[$index]}";
128	5b4ee05e	Ermal	$index++;
129			$netmask = cisco_to_cidr($rule[$index]);
130			$tmprule .= "/{$netmask} ";
131			$index++;
132	b37a2e8c	Phil Davis	if ($isblock == true) {
133	5b4ee05e	Ermal	$isblock = false;
134	b37a2e8c	Phil Davis	}
135	5b4ee05e	Ermal	}
136			/* Destination */
137			if (trim($rule[$index]) == "host") {
138			$index++;
139	b0ccc67b	Phil Davis	$tmprule .= "to {$rule[$index]} ";
140	5b4ee05e	Ermal	$index++;
141	b37a2e8c	Phil Davis	if ($isblock == true) {
142	5b4ee05e	Ermal	$isblock = false;
143	b37a2e8c	Phil Davis	}
144	5b4ee05e	Ermal	} else if (trim($rule[$index]) == "any") {
145			$index++;
146	b0ccc67b	Phil Davis	$tmprule .= "to any";
147	5b4ee05e	Ermal	} else {
148	b0ccc67b	Phil Davis	$tmprule .= "to {$rule[$index]}";
149	5b4ee05e	Ermal	$index++;
150			$netmask = cisco_to_cidr($rule[$index]);
151			$tmprule .= "/{$netmask} ";
152			$index++;
153	b37a2e8c	Phil Davis	if ($isblock == true) {
154	5b4ee05e	Ermal	$isblock = false;
155	b37a2e8c	Phil Davis	}
156	5b4ee05e	Ermal	}
157
158	b37a2e8c	Phil Davis	if ($isblock == true) {
159	5b4ee05e	Ermal	continue;
160	b37a2e8c	Phil Davis	}
161	5b4ee05e	Ermal
162	b37a2e8c	Phil Davis	if ($dir == "in") {
163	5b4ee05e	Ermal	$inrules[$rindex] = $tmprule;
164	b37a2e8c	Phil Davis	} else if ($dir == "out") {
165	5b4ee05e	Ermal	$outrules[$rindex] = $tmprule;
166	b37a2e8c	Phil Davis	}
167	5b4ee05e	Ermal	}
168
169
170			$state = "";
171	b37a2e8c	Phil Davis	if (!empty($outrules)) {
172	5b4ee05e	Ermal	$state = "no state";
173	b37a2e8c	Phil Davis	}
174	5b4ee05e	Ermal	ksort($inrules, SORT_NUMERIC);
175	b37a2e8c	Phil Davis	foreach ($inrules as $inrule) {
176	5b4ee05e	Ermal	$finalrules .= "{$inrule} {$state}\n";
177	b37a2e8c	Phil Davis	}
178	5b4ee05e	Ermal	if (!empty($outrules)) {
179			ksort($outrules, SORT_NUMERIC);
180	b37a2e8c	Phil Davis	foreach ($outrules as $outrule) {
181	5b4ee05e	Ermal	$finalrules .= "{$outrule} {$state}\n";
182	b37a2e8c	Phil Davis	}
183	5b4ee05e	Ermal	}
184			}
185			return $finalrules;
186			}
187
188			$rules = parse_cisco_acl($attributes);
189			if (!empty($rules)) {
190	7b95ffdd	Ermal	$pid = posix_getpid();
191			@file_put_contents("/tmp/ovpn_{$pid}{$common_name}.rules", $rules);
192	7b27b18b	Renato Botelho	mwexec("/sbin/pfctl -a " . escapeshellarg("openvpn/{$common_name}") . " -f {$g['tmp_path']}/ovpn_{$pid}" . escapeshellarg($common_name) . ".rules");
193	7b95ffdd	Ermal	@unlink("{$g['tmp_path']}/ovpn_{$pid}{$common_name}.rules");
194	5b4ee05e	Ermal	}
195
196			?>

Project

General

Profile

pfSense