/src/usr/local/bin/easyrule - Annotate - pfSense - pfSense bugtracker

| Branch: | Tag: | Revision:

root/src/usr/local/bin/easyrule @ 865e0153

1	cb7d18d5	Renato Botelho	#!/usr/local/bin/php-cgi -q
2	865ff9b4	jim-p	<?php
3			/*
4			easyrule CLI Program
5
6			Copyright (C) 2010 Jim Pingle (jpingle@gmail.com)
7			All rights reserved.
8
9			Redistribution and use in source and binary forms, with or without
10			modification, are permitted provided that the following conditions are met:
11
12			1. Redistributions of source code must retain the above copyright notice,
13	7d61beba	Phil Davis	this list of conditions and the following disclaimer.
14	865ff9b4	jim-p
15			2. Redistributions in binary form must reproduce the above copyright
16	7d61beba	Phil Davis	notice, this list of conditions and the following disclaimer in the
17			documentation and/or other materials provided with the distribution.
18	865ff9b4	jim-p
19			THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
20			INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
21			AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
22			AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
23			OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
24			SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
25			INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
26			CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
27			ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
28			POSSIBILITY OF SUCH DAMAGE.
29			*/
30
31			require_once("pfsense-utils.inc");
32			require_once("easyrule.inc");
33			require_once("filter.inc");
34			require_once("shaper.inc");
35
36			$message = "";
37			$specialsrcdst = explode(" ", "any pptp pppoe l2tp openvpn");
38	0c305760	jim-p	$ifdisp = get_configured_interface_with_descr();
39			foreach ($ifdisp as $kif => $kdescr) {
40			$specialsrcdst[] = "{$kif}";
41			$specialsrcdst[] = "{$kif}ip";
42			}
43	865ff9b4	jim-p
44			/* Borrow this function from guiconfig.inc since we can't include it for use at the CLI
45
46			- Maybe these need to be moved to util.inc or pfsense-utils.inc?
47
48			*/
49			function pconfig_to_address(&$adr, $padr, $pmask, $pnot=false, $pbeginport=0, $pendport=0) {
50
51			$adr = array();
52
53	7d61beba	Phil Davis	if ($padr == "any") {
54	865ff9b4	jim-p	$adr['any'] = true;
55	7d61beba	Phil Davis	} else if (is_specialnet($padr)) {
56	865ff9b4	jim-p	$adr['network'] = $padr;
57	7d61beba	Phil Davis	} else {
58	865ff9b4	jim-p	$adr['address'] = $padr;
59	7d61beba	Phil Davis	if ($pmask != 32) {
60	865ff9b4	jim-p	$adr['address'] .= "/" . $pmask;
61	7d61beba	Phil Davis	}
62	865ff9b4	jim-p	}
63
64	7d61beba	Phil Davis	if ($pnot) {
65	865ff9b4	jim-p	$adr['not'] = true;
66	7d61beba	Phil Davis	} else {
67	865ff9b4	jim-p	unset($adr['not']);
68	7d61beba	Phil Davis	}
69	865ff9b4	jim-p
70			if (($pbeginport != 0) && ($pbeginport != "any")) {
71	7d61beba	Phil Davis	if ($pbeginport != $pendport) {
72	865ff9b4	jim-p	$adr['port'] = $pbeginport . "-" . $pendport;
73	7d61beba	Phil Davis	} else {
74	865ff9b4	jim-p	$adr['port'] = $pbeginport;
75	7d61beba	Phil Davis	}
76	865ff9b4	jim-p	}
77
78	7d61beba	Phil Davis	if (is_alias($pbeginport)) {
79	865ff9b4	jim-p	$adr['port'] = $pbeginport;
80			}
81			}
82
83			/* Borrow this one from guiconfig.inc also */
84			function is_specialnet($net) {
85			global $specialsrcdst;
86
87	7d61beba	Phil Davis	if (!$net) {
88	865ff9b4	jim-p	return false;
89	7d61beba	Phil Davis	}
90			if (in_array($net, $specialsrcdst)) {
91	865ff9b4	jim-p	return true;
92	7d61beba	Phil Davis	} else {
93	865ff9b4	jim-p	return false;
94	7d61beba	Phil Davis	}
95	865ff9b4	jim-p	}
96
97
98			if (($argc > 1) && !empty($argv[1])) {
99	50242425	Oliver Welter
100	a6f973a1	Oliver Welter	/* Automagically derive an alternate alias name from the scripts name
101			* This allows for using alternate alias lists with just a symlink */
102	50242425	Oliver Welter	if (($alias = basename($argv[0])) != 'easyrule') {
103			$blockaliasname = ucfirst($alias).'Rules';
104			}
105
106	865ff9b4	jim-p	$message = "";
107			switch ($argv[1]) {
108			case 'block':
109			$message = easyrule_parse_block($argv[2], $argv[3]);
110			break;
111	4dedce6d	Oliver Welter	case 'unblock':
112			$message = easyrule_parse_unblock($argv[2], $argv[3]);
113			break;
114			case 'showblock':
115			$message = easyrule_parse_getblock($argv[2]);
116			break;
117	865ff9b4	jim-p	case 'pass':
118			$message = easyrule_parse_pass($argv[2], $argv[3], $argv[4], $argv[5], $argv[6]);
119			break;
120			}
121			echo $message . "\n";
122			} else {
123			// Print usage:
124			echo "usage:\n";
125	4dedce6d	Oliver Welter	echo " Blocking only requires an IP to block, block rules can be shown with showblock and revoked using unblock\n";
126	865ff9b4	jim-p	echo " " . basename($argv[0]) . " block <interface> <source IP>\n";
127			echo "\n";
128			echo " Passing requires more detail, as it must be as specific as possible. The destination port is optional if you're using a protocol without a port (e.g. ICMP, OSPF, etc).\n";
129			echo " " . basename($argv[0]) . " pass <interface> <protocol> <source IP> <destination ip> [destination port]\n";
130			echo "\n";
131			echo " Block example:\n";
132			echo " " . basename($argv[0]) . " block wan 1.2.3.4\n";
133			echo "\n";
134	4dedce6d	Oliver Welter	echo " Show active blocks example:\n";
135			echo " " . basename($argv[0]) . " showblock wan\n";
136			echo "\n";
137			echo " Unblock example:\n";
138			echo " " . basename($argv[0]) . " unblock wan 1.2.3.4\n";
139			echo "\n";
140	865ff9b4	jim-p	echo " Pass example (protocol with port):\n";
141			echo " " . basename($argv[0]) . " pass wan tcp 1.2.3.4 192.168.0.4 80\n";
142			echo "\n";
143	633136b8	jim-p	echo " Pass example (protocol without port):\n";
144	865ff9b4	jim-p	echo " " . basename($argv[0]) . " pass wan icmp 1.2.3.4 192.168.0.4\n";
145			echo "\n";
146			}
147	a6f973a1	Oliver Welter	?>

Project

General

Profile

pfSense