/src/etc/inc/openvpn.attributes.php - Annotate - pfSense - pfSense bugtracker

| Branch: | Tag: | Revision:

root/src/etc/inc/openvpn.attributes.php @ e85efdca

1	5b4ee05e	Ermal	<?php
2			/*
3	ac24dc24	Renato Botelho	* openvpn.attributes.php
4			*
5			* part of pfSense (https://www.pfsense.org)
6	b8f91b7c	Luiz Souza	* Copyright (c) 2011-2018 Rubicon Communications, LLC (Netgate)
7	ac24dc24	Renato Botelho	* All rights reserved.
8			*
9	b12ea3fb	Renato Botelho	* Licensed under the Apache License, Version 2.0 (the "License");
10			* you may not use this file except in compliance with the License.
11			* You may obtain a copy of the License at
12	ac24dc24	Renato Botelho	*
13	b12ea3fb	Renato Botelho	* http://www.apache.org/licenses/LICENSE-2.0
14	ac24dc24	Renato Botelho	*
15	b12ea3fb	Renato Botelho	* Unless required by applicable law or agreed to in writing, software
16			* distributed under the License is distributed on an "AS IS" BASIS,
17			* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
18			* See the License for the specific language governing permissions and
19			* limitations under the License.
20	ac24dc24	Renato Botelho	*/
21	09221bc3	Renato Botelho
22	a2e92e18	jim-p	global $username;
23	5b4ee05e	Ermal
24			$devname = getenv("dev");
25	b37a2e8c	Phil Davis	if (empty($devname)) {
26	5b4ee05e	Ermal	$devname = "openvpn";
27	b37a2e8c	Phil Davis	}
28	5b4ee05e	Ermal
29			function cisco_to_cidr($addr) {
30	b37a2e8c	Phil Davis	if (!is_ipaddr($addr)) {
31	5b4ee05e	Ermal	return 0;
32	b37a2e8c	Phil Davis	}
33	5b4ee05e	Ermal	$mask = decbin(~ip2long($addr));
34			$mask = substr($mask, -32);
35			$k = 0;
36			for ($i = 0; $i <= 32; $i++) {
37			$k += intval($mask[$i]);
38			}
39			return $k;
40			}
41
42			function cisco_extract_index($prule) {
43	b37a2e8c	Phil Davis
44	5b4ee05e	Ermal	$index = explode("#", $prule);
45	b37a2e8c	Phil Davis	if (is_numeric($index[1])) {
46	5b4ee05e	Ermal	return intval($index[1]);
47	b37a2e8c	Phil Davis	} else {
48	5b4ee05e	Ermal	syslog(LOG_WARNING, "Error parsing rule {$prule}: Could not extract index");
49	b37a2e8c	Phil Davis	}
50	5b4ee05e	Ermal	return -1;;
51			}
52
53			function parse_cisco_acl($attribs) {
54			global $devname, $attributes;
55	b37a2e8c	Phil Davis	if (!is_array($attribs)) {
56	5b4ee05e	Ermal	return "";
57	b37a2e8c	Phil Davis	}
58	5b4ee05e	Ermal	$finalrules = "";
59			if (is_array($attribs['ciscoavpair'])) {
60			$inrules = array();
61			$outrules = array();
62			foreach ($attribs['ciscoavpair'] as $avrules) {
63			$rule = explode("=", $avrules);
64			$dir = "";
65			if (strstr($rule[0], "inacl")) {
66			$dir = "in";
67	b37a2e8c	Phil Davis	} else if (strstr($rule[0], "outacl")) {
68	5b4ee05e	Ermal	$dir = "out";
69	b37a2e8c	Phil Davis	} else if (strstr($rule[0], "dns-servers")) {
70	5b4ee05e	Ermal	$attributes['dns-servers'] = explode(" ", $rule[1]);
71			continue;
72			} else if (strstr($rule[0], "route")) {
73	b37a2e8c	Phil Davis	if (!is_array($attributes['routes'])) {
74	5b4ee05e	Ermal	$attributes['routes'] = array();
75	b37a2e8c	Phil Davis	}
76	9f293b1c	jim-p	$attributes['routes'][] = $rule[1];
77	5b4ee05e	Ermal	continue;
78	b37a2e8c	Phil Davis	}
79	5b4ee05e	Ermal	$rindex = cisco_extract_index($rule[0]);
80	b37a2e8c	Phil Davis	if ($rindex < 0) {
81	5b4ee05e	Ermal	continue;
82	b37a2e8c	Phil Davis	}
83	5b4ee05e	Ermal
84			$rule = $rule[1];
85			$rule = explode(" ", $rule);
86			$tmprule = "";
87			$index = 0;
88			$isblock = false;
89	b37a2e8c	Phil Davis	if ($rule[$index] == "permit") {
90	5b4ee05e	Ermal	$tmprule = "pass {$dir} quick on {$devname} ";
91	b37a2e8c	Phil Davis	} else if ($rule[$index] == "deny") {
92	5b4ee05e	Ermal	//continue;
93			$isblock = true;
94			$tmprule = "block {$dir} quick on {$devname} ";
95			} else {
96			continue;
97			}
98
99			$index++;
100
101			switch ($rule[$index]) {
102	b37a2e8c	Phil Davis	case "tcp":
103			case "udp":
104			$tmprule .= "proto {$rule[$index]} ";
105			break;
106	5b4ee05e	Ermal	}
107
108			$index++;
109			/* Source */
110			if (trim($rule[$index]) == "host") {
111			$index++;
112			$tmprule .= "from {$rule[$index]} ";
113			$index++;
114	b37a2e8c	Phil Davis	if ($isblock == true) {
115	5b4ee05e	Ermal	$isblock = false;
116	b37a2e8c	Phil Davis	}
117	5b4ee05e	Ermal	} else if (trim($rule[$index]) == "any") {
118	b0ccc67b	Phil Davis	$tmprule .= "from any ";
119	5b4ee05e	Ermal	$index++;
120			} else {
121	8340d956	Renato Botelho	$tmprule .= "from {$rule[$index]}";
122	5b4ee05e	Ermal	$index++;
123			$netmask = cisco_to_cidr($rule[$index]);
124			$tmprule .= "/{$netmask} ";
125			$index++;
126	b37a2e8c	Phil Davis	if ($isblock == true) {
127	5b4ee05e	Ermal	$isblock = false;
128	b37a2e8c	Phil Davis	}
129	5b4ee05e	Ermal	}
130			/* Destination */
131			if (trim($rule[$index]) == "host") {
132			$index++;
133	b0ccc67b	Phil Davis	$tmprule .= "to {$rule[$index]} ";
134	5b4ee05e	Ermal	$index++;
135	b37a2e8c	Phil Davis	if ($isblock == true) {
136	5b4ee05e	Ermal	$isblock = false;
137	b37a2e8c	Phil Davis	}
138	5b4ee05e	Ermal	} else if (trim($rule[$index]) == "any") {
139			$index++;
140	b0ccc67b	Phil Davis	$tmprule .= "to any";
141	5b4ee05e	Ermal	} else {
142	b0ccc67b	Phil Davis	$tmprule .= "to {$rule[$index]}";
143	5b4ee05e	Ermal	$index++;
144			$netmask = cisco_to_cidr($rule[$index]);
145			$tmprule .= "/{$netmask} ";
146			$index++;
147	b37a2e8c	Phil Davis	if ($isblock == true) {
148	5b4ee05e	Ermal	$isblock = false;
149	b37a2e8c	Phil Davis	}
150	5b4ee05e	Ermal	}
151
152	b37a2e8c	Phil Davis	if ($isblock == true) {
153	5b4ee05e	Ermal	continue;
154	b37a2e8c	Phil Davis	}
155	5b4ee05e	Ermal
156	b37a2e8c	Phil Davis	if ($dir == "in") {
157	5b4ee05e	Ermal	$inrules[$rindex] = $tmprule;
158	b37a2e8c	Phil Davis	} else if ($dir == "out") {
159	5b4ee05e	Ermal	$outrules[$rindex] = $tmprule;
160	b37a2e8c	Phil Davis	}
161	5b4ee05e	Ermal	}
162
163
164			$state = "";
165	b37a2e8c	Phil Davis	if (!empty($outrules)) {
166	5b4ee05e	Ermal	$state = "no state";
167	b37a2e8c	Phil Davis	}
168	5b4ee05e	Ermal	ksort($inrules, SORT_NUMERIC);
169	b37a2e8c	Phil Davis	foreach ($inrules as $inrule) {
170	5b4ee05e	Ermal	$finalrules .= "{$inrule} {$state}\n";
171	b37a2e8c	Phil Davis	}
172	5b4ee05e	Ermal	if (!empty($outrules)) {
173			ksort($outrules, SORT_NUMERIC);
174	b37a2e8c	Phil Davis	foreach ($outrules as $outrule) {
175	5b4ee05e	Ermal	$finalrules .= "{$outrule} {$state}\n";
176	b37a2e8c	Phil Davis	}
177	5b4ee05e	Ermal	}
178			}
179			return $finalrules;
180			}
181
182			$rules = parse_cisco_acl($attributes);
183			if (!empty($rules)) {
184	7b95ffdd	Ermal	$pid = posix_getpid();
185	a2e92e18	jim-p	$filename = "{$g['tmp_path']}/ovpn_{$pid}{$username}.rules";
186			@file_put_contents($filename, $rules);
187			mwexec("/sbin/pfctl -a " . escapeshellarg("openvpn/{$username}") . " -f " . escapeshellarg($filename));
188			@unlink($filename);
189	5b4ee05e	Ermal	}
190
191			?>

Project

General

Profile

pfSense