From patchwork Sun Jan 17 14:20:03 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Leo-Andres Hofmann X-Patchwork-Id: 3812 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) client-signature RSA-PSS (4096 bits)) (Client CN "mail01.haj.ipfire.org", Issuer "R3" (verified OK)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4DJcWn6Kxvz3wsW for ; Sun, 17 Jan 2021 14:20:21 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [172.28.1.201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) client-signature ECDSA (P-384)) (Client CN "mail02.haj.ipfire.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mail01.ipfire.org (Postfix) with ESMTPS id 4DJcWm0J7kz4ht; Sun, 17 Jan 2021 14:20:20 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [127.0.0.1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4DJcWl2Kb4z2yXq; Sun, 17 Jan 2021 14:20:19 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) server-digest SHA384 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mail01.haj.ipfire.org", Issuer "R3" (verified OK)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4DJcWj42gqz2xKj for ; Sun, 17 Jan 2021 14:20:17 +0000 (UTC) Received: from arche.uberspace.de (arche.uberspace.de [185.26.156.147]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mail01.ipfire.org (Postfix) with ESMTPS id 4DJcWf75X2znn for ; Sun, 17 Jan 2021 14:20:14 +0000 (UTC) Received: (qmail 25257 invoked from network); 17 Jan 2021 14:20:13 -0000 Received: from localhost (HELO localhost) (127.0.0.1) by arche.uberspace.de with SMTP; 17 Jan 2021 14:20:13 -0000 From: Leo-Andres Hofmann To: development@lists.ipfire.org Subject: [PATCH 1/2] Refactor "get_available_network_zones", move to network-functions.pl Date: Sun, 17 Jan 2021 15:20:03 +0100 Message-Id: <20210117142004.984-1-hofmann@leo-andres.de> X-Mailer: git-send-email 2.27.0.windows.1 MIME-Version: 1.0 ARC-Authentication-Results: i=1; mail01.ipfire.org; dkim=none; spf=pass (mail01.ipfire.org: domain of hofmann@leo-andres.de designates 185.26.156.147 as permitted sender) smtp.mailfrom=hofmann@leo-andres.de ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=lists.ipfire.org; s=202003rsa; t=1610893215; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=YyVfwnefA9ycfZ0NiP55I2jioVG5wyB31guptfG/eyg=; b=GGAjiTvfAzwJq9rDXdniw4ZLEk0zPHx2yHplcA3dcxXLW7fIaoGf8i20IwkYbymYBlnak3 9w8ikeSW80GGCGalg/dZ7YGOHAXq18fANuB+46h1gu9pxrBOP+mRY+yrzAWR2e9iHrciHy KGpZhc/ZQsh2/E4i2Jp4U+Cbom3fL9sD+M2HSoMIIxt57nvsXZkSWABbsOJmCZeJaa4Voy HzHXhEs0+p5UgtY/RGkLXrqjW+4XG8DQfvevWKokb54jT/JS+yjkBar2rE9IIHTk8RDTh7 fbECvdMzuRi3Kp8x1NAyIRAyC2JLcvG+P09fW8GlzGDnAF12I+fhVWDV6Wg7Hw== ARC-Seal: i=1; s=202003rsa; d=lists.ipfire.org; t=1610893215; a=rsa-sha256; cv=none; b=pCb7kGY4At9npKTH1LFd+U7eULIUfXa/EOUKNwAh5EMJ2Rt9whWeaaeHYQYPbe6Iox5QTl Rx+daubb8615GH0YHuYMNr6ZV5q0gcOXP9BDu8p+XWpuqHKnXViGTvma44KFNnlQRJ/bLs DFMrxzIITZ307Y0RPcU6nLxUJxoI8nb8qhsLxieeBigs/gzVd9Ry1+viy8RliXtfLDwPMa w+s7DP51E09ROOwY9Sp0SlDp+QkyHGwbvcJ9yK1T+mlgC61Aei68tiZTWRT2HiuSnp8vnS Dtui7U1dmQxr2Nu3azk4RDabUW8i7PYO4+Gj1UqkHCAmBLKutdJbVR4X9TliXQ== X-Rspamd-Server: mail01.haj.ipfire.org X-Spamd-Result: default: False [-0.01 / 11.00]; RCVD_TLS_LAST(0.00)[]; ARC_NA(0.00)[]; FROM_HAS_DN(0.00)[]; R_MISSING_CHARSET(2.50)[]; TO_MATCH_ENVRCPT_ALL(0.00)[]; MIME_GOOD(-0.10)[text/plain]; TO_DN_NONE(0.00)[]; BROKEN_CONTENT_TYPE(1.50)[]; RCPT_COUNT_ONE(0.00)[1]; ARC_SIGNED(0.00)[lists.ipfire.org:s=202003rsa:i=1]; IP_REPUTATION_HAM(-1.71)[asn: 205766(-0.24), country: DE(-0.00), ip: 185.26.156.147(-0.61)]; MID_CONTAINS_FROM(1.00)[]; R_SPF_ALLOW(-0.20)[+mx]; DMARC_NA(0.00)[leo-andres.de]; FROM_EQ_ENVFROM(0.00)[]; R_DKIM_NA(0.00)[]; MIME_TRACE(0.00)[0:+]; ASN(0.00)[asn:205766, ipnet:185.26.156.0/24, country:DE]; RCVD_COUNT_TWO(0.00)[2]; BAYES_HAM(-3.00)[99.99%] X-Rspamd-Queue-Id: 4DJcWf75X2znn Authentication-Results: mail01.ipfire.org; dkim=none; dmarc=none; spf=pass (mail01.ipfire.org: domain of hofmann@leo-andres.de designates 185.26.156.147 as permitted sender) smtp.mailfrom=hofmann@leo-andres.de X-BeenThere: development@lists.ipfire.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IPFire development talk List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: development-bounces@lists.ipfire.org Sender: "Development" This function nicely translates the ethernet/settings "CONFIG_TYPE" into a list of available zones. Therefore it should be more accessible! Signed-off-by: Leo-Andres Hofmann --- config/cfgroot/ids-functions.pl | 39 ++--------------------------- config/cfgroot/network-functions.pl | 36 ++++++++++++++++++++++++++ config/suricata/convert-snort | 3 ++- html/cgi-bin/ids.cgi | 3 ++- 4 files changed, 42 insertions(+), 39 deletions(-) diff --git a/config/cfgroot/ids-functions.pl b/config/cfgroot/ids-functions.pl index d45e1c70a..2fdae4a7a 100644 --- a/config/cfgroot/ids-functions.pl +++ b/config/cfgroot/ids-functions.pl @@ -24,6 +24,7 @@ package IDS; require '/var/ipfire/general-functions.pl'; +require "${General::swroot}/network-functions.pl"; # Location where all config and settings files are stored. our $settingsdir = "${General::swroot}/suricata"; @@ -410,42 +411,6 @@ sub _store_error_message ($) { &set_ownership("$storederrorfile"); } -# -## Function to get a list of all available network zones. -# -sub get_available_network_zones () { - # Get netsettings. - my %netsettings = (); - &General::readhash("${General::swroot}/ethernet/settings", \%netsettings); - - # Obtain the configuration type from the netsettings hash. - my $config_type = $netsettings{'CONFIG_TYPE'}; - - # Hash which contains the conversation from the config mode - # to the existing network interface names. They are stored like - # an array. - # - # Mode "0" red is a modem and green - # Mode "1" red is a netdev and green - # Mode "2" red, green and orange - # Mode "3" red, green and blue - # Mode "4" red, green, blue, orange - my %config_type_to_interfaces = ( - "0" => [ "red", "green" ], - "1" => [ "red", "green" ], - "2" => [ "red", "green", "orange" ], - "3" => [ "red", "green", "blue" ], - "4" => [ "red", "green", "blue", "orange" ] - ); - - # Obtain and dereference the corresponding network interaces based on the read - # network config type. - my @network_zones = @{ $config_type_to_interfaces{$config_type} }; - - # Return them. - return @network_zones; -} - # ## Function to check if the IDS is running. # @@ -613,7 +578,7 @@ sub generate_home_net_file() { &General::readhash("${General::swroot}/ethernet/settings", \%netsettings); # Get available network zones. - my @network_zones = &get_available_network_zones(); + my @network_zones = &Network::get_available_network_zones(); # Temporary array to store network address and prefix of the configured # networks. diff --git a/config/cfgroot/network-functions.pl b/config/cfgroot/network-functions.pl index 3d7f04743..622731f96 100644 --- a/config/cfgroot/network-functions.pl +++ b/config/cfgroot/network-functions.pl @@ -444,6 +444,42 @@ sub get_mac_by_name($) { return $mac; } +# +## Function to get a list of all available network zones. +# +sub get_available_network_zones () { + # Get netsettings. + my %netsettings = (); + &General::readhash("${General::swroot}/ethernet/settings", \%netsettings); + + # Obtain the configuration type from the netsettings hash. + my $config_type = $netsettings{'CONFIG_TYPE'}; + + # Hash which contains the conversation from the config mode + # to the existing network interface names. They are stored like + # an array. + # + # Mode "0" red is a modem and green + # Mode "1" red is a netdev and green + # Mode "2" red, green and orange + # Mode "3" red, green and blue + # Mode "4" red, green, blue, orange + my %config_type_to_interfaces = ( + "0" => [ "red", "green" ], + "1" => [ "red", "green" ], + "2" => [ "red", "green", "orange" ], + "3" => [ "red", "green", "blue" ], + "4" => [ "red", "green", "blue", "orange" ] + ); + + # Obtain and dereference the corresponding network interaces based on the read + # network config type. + my @network_zones = @{ $config_type_to_interfaces{$config_type} }; + + # Return them. + return @network_zones; +} + 1; # Remove the next line to enable the testsuite diff --git a/config/suricata/convert-snort b/config/suricata/convert-snort index 3e938137e..7d75233b4 100644 --- a/config/suricata/convert-snort +++ b/config/suricata/convert-snort @@ -23,6 +23,7 @@ use strict; require '/var/ipfire/general-functions.pl'; require "${General::swroot}/ids-functions.pl"; +require "${General::swroot}/network-functions.pl"; # Snort settings file, which contains the settings from the WUI. my $snort_settings_file = "${General::swroot}/snort/settings"; @@ -129,7 +130,7 @@ my %rulessettings = ( ); # Get all available network zones. -my @network_zones = &IDS::get_available_network_zones(); +my @network_zones = &Network::get_available_network_zones(); # Read-in snort settings file. &General::readhash("$snort_settings_file", \%snortsettings); diff --git a/html/cgi-bin/ids.cgi b/html/cgi-bin/ids.cgi index bc31a341f..83d5f52ba 100644 --- a/html/cgi-bin/ids.cgi +++ b/html/cgi-bin/ids.cgi @@ -29,6 +29,7 @@ require '/var/ipfire/general-functions.pl'; require "${General::swroot}/lang.pl"; require "${General::swroot}/header.pl"; require "${General::swroot}/ids-functions.pl"; +require "${General::swroot}/network-functions.pl"; my %color = (); my %mainsettings = (); @@ -47,7 +48,7 @@ my %ignored=(); # Get the available network zones, based on the config type of the system and store # the list of zones in an array. -my @network_zones = &IDS::get_available_network_zones(); +my @network_zones = &Network::get_available_network_zones(); # Check if openvpn is started and add it to the array of network zones. if ( -e "/var/run/openvpn.pid") { From patchwork Sun Jan 17 14:20:04 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Leo-Andres Hofmann X-Patchwork-Id: 3811 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) server-digest SHA384 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mail01.haj.ipfire.org", Issuer "R3" (verified OK)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4DJcWn5flPz3wsQ for ; Sun, 17 Jan 2021 14:20:21 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [172.28.1.201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) client-signature ECDSA (P-384)) (Client CN "mail02.haj.ipfire.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mail01.ipfire.org (Postfix) with ESMTPS id 4DJcWl72NGz37Y; Sun, 17 Jan 2021 14:20:19 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [127.0.0.1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4DJcWl1cqSz2xcv; Sun, 17 Jan 2021 14:20:19 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) server-digest SHA384 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mail01.haj.ipfire.org", Issuer "R3" (verified OK)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4DJcWj44gGz2xSn for ; Sun, 17 Jan 2021 14:20:17 +0000 (UTC) Received: from arche.uberspace.de (arche.uberspace.de [185.26.156.147]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mail01.ipfire.org (Postfix) with ESMTPS id 4DJcWg07j7z1kl for ; Sun, 17 Jan 2021 14:20:14 +0000 (UTC) Received: (qmail 25258 invoked from network); 17 Jan 2021 14:20:14 -0000 Received: from localhost (HELO localhost) (127.0.0.1) by arche.uberspace.de with SMTP; 17 Jan 2021 14:20:14 -0000 From: Leo-Andres Hofmann To: development@lists.ipfire.org Subject: [PATCH 2/2] network-functions.pl: Improve zone configuration functions Date: Sun, 17 Jan 2021 15:20:04 +0100 Message-Id: <20210117142004.984-2-hofmann@leo-andres.de> X-Mailer: git-send-email 2.27.0.windows.1 In-Reply-To: <20210117142004.984-1-hofmann@leo-andres.de> References: <20210117142004.984-1-hofmann@leo-andres.de> MIME-Version: 1.0 ARC-Authentication-Results: i=1; mail01.ipfire.org; dkim=none; spf=pass (mail01.ipfire.org: domain of hofmann@leo-andres.de designates 185.26.156.147 as permitted sender) smtp.mailfrom=hofmann@leo-andres.de ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=lists.ipfire.org; s=202003rsa; t=1610893215; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=jV6Ha0VZTVq05bUnWXCkKy+gJ+fpvwhjx8QMqIFbN2w=; b=TeC063WHugz5L76ggXDFf3EGrjSgCFoxGon68WSnB51iQIpr3+Pj1zwXtJZtDz0MbV6pHc Nlo6H+cd9eufFAYlaGX28zGInv4W/2hydfOQdJ7yogBF3lIxGGYS4aMa8BQif8REXA+gFp n9k63rSlqtvUs9sxfNeu5Jjm9fqtAHfHZfkoMO4IVVLNFek65gU6AOXivc+KafJ4wQ4nTo 0EOoS1L3cLnT/mwvvYr9L0+tl1/fIZk/V1yhco44l5WJ8e497vjM7k2ra+Vsb45/x7M3uE K+xDZxdBpNaEo6mzX6US8NYapW/9HROCK91Rr7/2BnBqykwRogNhbvyvVmh+Lg== ARC-Seal: i=1; s=202003rsa; d=lists.ipfire.org; t=1610893215; a=rsa-sha256; cv=none; b=PJ3aX90bRSToHjEEOswdSBKzYQ6vCDdVcmZxvcmfOSb4cp4WexdZZkIv+VlSOMZWWAgC8Y VK4zsSv0RoH6g7SfNAfGVwtyGNAN6cL+ya+g/k3vPKMm21Pa9N7+OIidqrjXcQeOXoL4pF 2MfWbdJn2lx0H4TOu/YhYkLNq1H1tPU/85LFTpW3Yz7iu1bJrrU4A+kAG+zUBvva+cqjj6 ahl4lVRZMINUjwaO93bepRuMIBF7A5kWdyj5xrniH28BNoX3x+FaNg6Wg0AHlqG6pDCMb4 LfH0r2LYPSrVcWPzoNqPWJ+zmER0IBV1NobpTBKZiX+IQZ/6DCOo6k+QJJeW7A== X-Rspamd-Server: mail01.haj.ipfire.org X-Spamd-Result: default: False [-0.01 / 11.00]; RCVD_TLS_LAST(0.00)[]; ARC_NA(0.00)[]; FROM_HAS_DN(0.00)[]; R_MISSING_CHARSET(2.50)[]; TO_MATCH_ENVRCPT_ALL(0.00)[]; MIME_GOOD(-0.10)[text/plain]; TO_DN_NONE(0.00)[]; BROKEN_CONTENT_TYPE(1.50)[]; RCPT_COUNT_ONE(0.00)[1]; ARC_SIGNED(0.00)[lists.ipfire.org:s=202003rsa:i=1]; IP_REPUTATION_HAM(-1.71)[asn: 205766(-0.24), country: DE(-0.00), ip: 185.26.156.147(-0.61)]; MID_CONTAINS_FROM(1.00)[]; R_SPF_ALLOW(-0.20)[+mx]; DMARC_NA(0.00)[leo-andres.de]; FROM_EQ_ENVFROM(0.00)[]; R_DKIM_NA(0.00)[]; MIME_TRACE(0.00)[0:+]; ASN(0.00)[asn:205766, ipnet:185.26.156.0/24, country:DE]; RCVD_COUNT_TWO(0.00)[2]; BAYES_HAM(-3.00)[99.99%] X-Rspamd-Queue-Id: 4DJcWg07j7z1kl Authentication-Results: mail01.ipfire.org; dkim=none; dmarc=none; spf=pass (mail01.ipfire.org: domain of hofmann@leo-andres.de designates 185.26.156.147 as permitted sender) smtp.mailfrom=hofmann@leo-andres.de X-BeenThere: development@lists.ipfire.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IPFire development talk List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: development-bounces@lists.ipfire.org Sender: "Development" Cache ethernet configuration in public variable "ethernet_settings", add functions to simplify working with the network configuration. Signed-off-by: Leo-Andres Hofmann --- config/cfgroot/network-functions.pl | 40 +++++++++++++++++++++++++---- 1 file changed, 35 insertions(+), 5 deletions(-) diff --git a/config/cfgroot/network-functions.pl b/config/cfgroot/network-functions.pl index 622731f96..7bd6466e0 100644 --- a/config/cfgroot/network-functions.pl +++ b/config/cfgroot/network-functions.pl @@ -27,6 +27,14 @@ require "/var/ipfire/general-functions.pl"; use Socket; +# System ethernet configuration +our %ethernet_settings = (); +&General::readhash("${General::swroot}/ethernet/settings", \%ethernet_settings); + +# List of all possible network zones that can be configured +our @known_network_zones = ("red", "green", "orange", "blue"); + +# IPv4 netmask CIDR to dotted decimal notation conversion table my %PREFIX2NETMASK = ( 32 => "255.255.255.255", 31 => "255.255.255.254", @@ -448,12 +456,8 @@ sub get_mac_by_name($) { ## Function to get a list of all available network zones. # sub get_available_network_zones () { - # Get netsettings. - my %netsettings = (); - &General::readhash("${General::swroot}/ethernet/settings", \%netsettings); - # Obtain the configuration type from the netsettings hash. - my $config_type = $netsettings{'CONFIG_TYPE'}; + my $config_type = $ethernet_settings{'CONFIG_TYPE'}; # Hash which contains the conversation from the config mode # to the existing network interface names. They are stored like @@ -480,6 +484,32 @@ sub get_available_network_zones () { return @network_zones; } +# +## Function to check if a network zone is available in the current configuration +# +sub is_zone_available() { + my $zone = lc shift; + + # Make sure the zone is valid + die("Unknown network zone '$zone'") unless ($zone ~~ @known_network_zones); + + # Get available zones and return result + my @available_zones = get_available_network_zones(); + return ($zone ~~ @available_zones); +} + +# +## Function to determine if the RED zone is in standard IP (or modem, PPP, VDSL, ...) mode +# +sub is_red_mode_ip() { + # Obtain the settings from the netsettings hash + my $config_type = $ethernet_settings{'CONFIG_TYPE'}; + my $red_type = $ethernet_settings{'RED_TYPE'}; + + # RED must be a network device (configuration 1-4) with dynamic or static IP + return (($config_type ~~ [1..4]) && ($red_type ~~ ["DHCP", "STATIC"])); +} + 1; # Remove the next line to enable the testsuite