Ignore:
Timestamp:
Dec 21, 2009, 10:48:41 AM (15 years ago)
Author:
george
Message:
  • Upraveno: Nově přepracován systém generování značkovacích pravidel mangle firewallu. Pro snížení počtu pravidel procházených při značkování packetu, jsou adresy rozdělovány do podskupin. Díky tomu je snížen rozptyl mezi nejmenším a nejvyšším početem procházených pravidel.
  • Upraveno: Přepracovány funkce pro práci s IP adresami typu IPv4. Přehledněji zpracováno jako třída.
  • Přidáno: Tabulka v databázi pro persistentní přiřazení Id čísla podsítě pro generování pravidel mangle firewallu.
File:
1 edited

Legend:

Unmodified
Added
Removed

  • trunk/system/generators/firewall_mangle.php

    r266 r267  
    1616$Routerboard->Debug = true;
    1717
    18 $Finance = &$System->Modules['Finance'];
    19 $Finance->LoadMonthParameters(0);
    20 
    2118$InetInterface = $Config['MainRouter']['InetInterface'];
    2219
    23 $ItemsMangle = array();
    2420
    25 // Root of tree and main limit
    26 $ItemsFirewall[] = array('chain' => 'forward', 'out-interface' => $InetInterface, 'action' => 'jump', 'jump-target' => 'inet-out', 'comment' => 'main-out');
    27 $ItemsFirewall[] = array('chain' => 'forward', 'in-interface' => $InetInterface, 'action' => 'jump', 'jump-target' => 'inet-in', 'comment' => 'main-in');
     21// Generate address tree
     22$AddressTree = array('Address' => new NetworkAddressIPv4(), 'Name' => 'main', 'Items' => array());
    2823
    2924// Divide rules by subnet number
    30 $DbResult = $Database->query('SELECT `Id`, `Name`, `AddressRange`, `Mask` FROM `NetworkSubnet`');
     25$DbResult = $Database->query('SELECT `Id`, `Name`, `AddressRange`, `Mask` FROM `NetworkSubnet` WHERE Member=0');
    3126while($Subnet = $DbResult->fetch_assoc())
    3227{
    33   $SubnetParts = explode('.', $Subnet['AddressRange']);
    34   $SubnetNumber = $SubnetParts[2];
    35   $ItemsFirewall[] = array('chain' => 'inet-out', 'src-address' => $Subnet['AddressRange'].'/'.$Subnet['Mask'], 'out-interface' => $InetInterface, 'action' => 'jump', 'jump-target' => 'inet-out-'.$SubnetNumber, 'comment' => 'subnet-'.RouterOSIdent($Subnet['Name']).'-out');
    36   $ItemsFirewall[] = array('chain' => 'inet-in', 'dst-address' => $Subnet['AddressRange'].'/'.$Subnet['Mask'], 'in-interface' => $InetInterface, 'action' => 'jump', 'jump-target' => 'inet-in-'.$SubnetNumber, 'comment' => 'subnet-'.RouterOSIdent($Subnet['Name']).'-in');
     28  $NewAddress = new NetworkAddressIPv4();
     29  $NewAddress->AddressFromString($Subnet['AddressRange']);
     30  $NewAddress->Prefix = $Subnet['Mask'];
     31  InsertToAddressTree($AddressTree, $NewAddress, 'subnet-'.RouterOSIdent($Subnet['Name']));
    3732}
    38 
    39 // Slow free internet
    40 $PacketMark = GetMarkByComment('free-out');
    41 $ItemsFirewall[] = array('chain' => 'inet-out', 'out-interface' => $InetInterface, 'action' => 'mark-packet', 'new-packet-mark' => $PacketMark, 'comment' => 'free-out', 'passthrough' => 'no');
    42 $PacketMark = GetMarkByComment('free-in');
    43 $ItemsFirewall[] = array('chain' => 'inet-in', 'in-interface' => $InetInterface, 'action' => 'mark-packet', 'new-packet-mark' => $PacketMark, 'comment' => 'free-in', 'passthrough' => 'no');
    4433
    4534// Process users
    … …  
    4938  $Member['Name'] = RouterOSIdent($Member['Name'].'-'.$Member['Id'] );
    5039  echo('Uživatel '.$Member['Name'].': ');
    51 
    52   $DbResult2 = $Database->select('NetworkDevice', 'COUNT(*)', 'Used = 1 AND Member='.$Member['Id']);
    53   $Row = $DbResult2->fetch_row();
    54   $HostCount = $Row[0];
    5540
    5641  $DbResult2 = $Database->select('NetworkDevice', '*', '`Used` = 1 AND `Member` = '.$Member['Id']);
    … …  
    6449      $Name = RouterOSIdent($Name);
    6550      echo($Name.', ');
    66       $IPParts = explode('.', $Interface['LocalIP']);
    67       $Subnet = $IPParts[2];
    68       $PacketMark = GetMarkByComment($Name.'-out');
    69       $ItemsFirewall[] = array('chain' => 'inet-out-'.$Subnet, 'src-address' => $Interface['LocalIP'], 'out-interface' => $InetInterface, 'action' => 'mark-packet', 'new-packet-mark' => $PacketMark, 'passthrough' => 'no', 'comment' => $Name.'-out');
    70       $PacketMark = GetMarkByComment($Name.'-in');
    71       $ItemsFirewall[] = array('chain' => 'inet-in-'.$Subnet, 'dst-address' => $Interface['LocalIP'], 'in-interface' => $InetInterface, 'action' => 'mark-packet', 'new-packet-mark' => $PacketMark, 'passthrough' => 'no', 'comment' => $Name.'-in');
     51      $NewAddress = new NetworkAddressIPv4();
     52      $NewAddress->AddressFromString($Interface['LocalIP']);
     53      $NewAddress->Prefix = 32;
     54      InsertToAddressTree($AddressTree, $NewAddress, $Name);
    7255    }
    7356  }
    … …  
    7861    $Subnet['Name'] = RouterOSIdent('subnet-'.$Subnet['Name']);
    7962    echo($Subnet['Name'].', ');
    80     $IPParts = explode('.', $Subnet['AddressRange']);
    81     $SubnetNumber = $IPParts[2];
    82     $PacketMark = GetMarkByComment($Subnet['Name'].'-out');
    83     $ItemsFirewall[] = array('chain' => 'inet-out-'.$SubnetNumber, 'src-address' => $Subnet['AddressRange'].'/'.$Subnet['Mask'], 'out-interface' =>  $InetInterface, 'action' => 'mark-packet', 'new-packet-mark' => $PacketMark, 'passthrough' => 'no', 'comment' => $Subnet['Name'].'-out');
    84     $PacketMark = GetMarkByComment($Subnet['Name'].'-in');
    85     $ItemsFirewall[] = array('chain' => 'inet-in-'.$SubnetNumber, 'dst-address' => $Subnet['AddressRange'].'/'.$Subnet['Mask'], 'in-interface' => $InetInterface, 'action' => 'mark-packet', 'new-packet-mark' => $PacketMark, 'passthrough' => 'no', 'comment' => $Subnet['Name'].'-in');
     63    $NewAddress = new NetworkAddressIPv4();
     64    $NewAddress->AddressFromString($Subnet['AddressRange']);
     65    $NewAddress->Prefix = $Subnet['Mask'];
     66    InsertToAddressTree($AddressTree, $NewAddress, $Subnet['Name']);
    8667  }
    8768  echo("\n");
    8869}
    8970
    90 //print_r($ItemsFirewall);
    91 $Routerboard->ListUpdate($PathFirewall, array('chain', 'dst-address', 'in-interface', 'action', 'new-packet-mark', 'passthrough', 'comment', 'out-interface', 'src-address', 'jump-target'), $ItemsFirewall, array(), true);
     71ShowSubnetNode($AddressTree);
     72
     73function ProcessNode($Node)
     74{
     75  global $InetInterface, $ItemsFirewall;
     76 
     77  foreach($Node['Items'] as $Index => $Item)
     78  {
     79    if(count($Item['Items']) == 0)
     80    {
     81      // Hosts
     82      $ParentSubnetId = GetSubgroupByRange($Node['Address']->AddressToString().'/'.$Node['Address']->Prefix);
     83      $PacketMark = GetMarkByComment($Item['Name'].'-out');
     84      $ItemsFirewall[] = array('chain' => 'inet-'.$ParentSubnetId.'-out', 'src-address' => $Item['Address']->AddressToString().'/'.$Item['Address']->Prefix, 'out-interface' =>  $InetInterface, 'action' => 'mark-packet', 'new-packet-mark' => $PacketMark, 'passthrough' => 'no', 'comment' => $Item['Name'].'-out');
     85      $PacketMark = GetMarkByComment($Item['Name'].'-in');
     86      $ItemsFirewall[] = array('chain' => 'inet-'.$ParentSubnetId.'-in', 'dst-address' => $Item['Address']->AddressToString().'/'.$Item['Address']->Prefix, 'in-interface' => $InetInterface, 'action' => 'mark-packet', 'new-packet-mark' => $PacketMark, 'passthrough' => 'no', 'comment' => $Item['Name'].'-in');
     87    } else
     88    {
     89      // Subnets
     90      $ParentSubnetId = GetSubgroupByRange($Node['Address']->AddressToString().'/'.$Node['Address']->Prefix);
     91      $SubnetId = GetSubgroupByRange($Item['Address']->AddressToString().'/'.$Item['Address']->Prefix);
     92      $PacketMark = GetMarkByComment($Item['Name'].'-out');
     93     
     94      $ItemsFirewall[] = array('chain' => 'inet-'.$ParentSubnetId.'-out', 'src-address' => $Item['Address']->AddressToString().'/'.$Item['Address']->Prefix, 'out-interface' => $InetInterface, 'action' => 'jump', 'jump-target' => 'inet-'.$SubnetId.'-out', 'comment' => $Item['Name'].'-out');   
     95      $ItemsFirewall[] = array('chain' => 'inet-'.$ParentSubnetId.'-in', 'dst-address' => $Item['Address']->AddressToString().'/'.$Item['Address']->Prefix, 'in-interface' => $InetInterface, 'action' => 'jump', 'jump-target' => 'inet-'.$SubnetId.'-in', 'comment' => $Item['Name'].'-in');   
     96     
     97      ProcessNode($Item);     
     98    }   
     99  }
     100}
     101
     102// Generate firewall rules
     103$ItemsFirewall = array();
     104
     105// Root of tree and main limit
     106$ItemsFirewall[] = array('chain' => 'forward', 'out-interface' => $InetInterface, 'action' => 'jump', 'jump-target' => 'inet-1-out', 'comment' => 'main-out');
     107$ItemsFirewall[] = array('chain' => 'forward', 'in-interface' => $InetInterface, 'action' => 'jump', 'jump-target' => 'inet-1-in', 'comment' => 'main-in');
     108
     109ProcessNode($AddressTree);
     110
     111// Slow free internet
     112$PacketMark = GetMarkByComment('free-out');
     113$ItemsFirewall[] = array('chain' => 'inet-1-out', 'out-interface' => $InetInterface, 'action' => 'mark-packet', 'new-packet-mark' => $PacketMark, 'comment' => 'free-out', 'passthrough' => 'no');
     114$PacketMark = GetMarkByComment('free-in');
     115$ItemsFirewall[] = array('chain' => 'inet-1-in', 'in-interface' => $InetInterface, 'action' => 'mark-packet', 'new-packet-mark' => $PacketMark, 'comment' => 'free-in', 'passthrough' => 'no');
     116
     117
     118print_r($ItemsFirewall);
     119//$Routerboard->ListUpdate($PathFirewall, array('chain', 'dst-address', 'in-interface', 'action', 'new-packet-mark', 'passthrough', 'comment', 'out-interface', 'src-address', 'jump-target'), $ItemsFirewall, array(), true);
    92120
    93121?>
Note: See TracChangeset for help on using the changeset viewer.