Ignore:
Timestamp:
Jan 8, 2016, 11:00:11 PM (9 years ago)
Author:
chronos
Message:
  • Modified: Network configure actions now can be executed through cmd.php interface using "php cmd.php config <action>".
File:
1 edited

Legend:

Unmodified
Added
Removed

  • trunk/Modules/NetworkConfigRouterOS/Generators/FirewallMangle.php

    r766 r781  
    11<?php
    2 if(isset($_SERVER['REMOTE_ADDR'])) die();
    32
    4 $Enabled = 1;
    5 $ClassesEnabled = 1;
    6 $SessionDisable = true;
    7 include_once(dirname(__FILE__).'/../../../Application/System.php');
    8 $System = new System();
    9 $System->ShowPage = false;
    10 $System->Run();
    11 $PathFirewall = array('ip', 'firewall', 'mangle');
     3class ConfigRouterOSFirewallMangle extends NetworkConfigItem
     4{
     5  function Run()
     6  {
     7    $PathFirewall = array('ip', 'firewall', 'mangle');
    128
    13 $Routerboard = new Routerboard();
    14 $Routerboard->UserName = $Config['MainRouter']['UserName'];
    15 $Routerboard->Timeout = $Config['MainRouter']['ConnectTimeout'];
    16 $Routerboard->HostName = $Config['MainRouter']['HostName'];
    17 $Routerboard->Debug = true;
     9    $Routerboard = new Routerboard();
     10    $Routerboard->UserName = $this->System->Config['MainRouter']['UserName'];
     11    $Routerboard->Timeout = $this->System->Config['MainRouter']['ConnectTimeout'];
     12    $Routerboard->HostName = $this->System->Config['MainRouter']['HostName'];
     13    $Routerboard->Debug = true;
    1814
    19 $InetInterface = $Config['MainRouter']['InetInterface'];
     15    $InetInterface = $Config['MainRouter']['InetInterface'];
    2016
    2117
    22 // Generate address tree
    23 $AddressTree = array('Address' => new NetworkAddressIPv4(), 'Name' => 'main', 'Items' => array(), 'ForceMark' => false);
     18    // Generate address tree
     19    $AddressTree = array('Address' => new NetworkAddressIPv4(), 'Name' => 'main', 'Items' => array(), 'ForceMark' => false);
    2420
    25 // Divide rules by subnet number
    26 $DbResult = $System->Database->query('SELECT `Id`, `Name`, `AddressRange`, `Mask` FROM `NetworkSubnet` WHERE `Member` IS NULL');
    27 while($Subnet = $DbResult->fetch_assoc())
    28 {
    29   $NewAddress = new NetworkAddressIPv4();
    30   $NewAddress->AddressFromString($Subnet['AddressRange']);
    31   $NewAddress->Prefix = $Subnet['Mask'];
    32   InsertToAddressTree($AddressTree, $NewAddress, 'subnet-'.RouterOSIdent($Subnet['Name']));
    33 }
     21    // Divide rules by subnet number
     22    $DbResult = $this->System->Database->query('SELECT `Id`, `Name`, `AddressRange`, `Mask` FROM `NetworkSubnet` WHERE `Member` IS NULL');
     23    while($Subnet = $DbResult->fetch_assoc())
     24    {
     25      $NewAddress = new NetworkAddressIPv4();
     26      $NewAddress->AddressFromString($Subnet['AddressRange']);
     27      $NewAddress->Prefix = $Subnet['Mask'];
     28      InsertToAddressTree($AddressTree, $NewAddress, 'subnet-'.RouterOSIdent($Subnet['Name']));
     29    }
    3430
    35 // Process users
    36 $DbResult = $System->Database->query('SELECT `Member`.*, `Subject`.`Name` FROM `Member` '.
    37   'LEFT JOIN `Subject` ON `Subject`.`Id` = `Member`.`Subject` '.
    38   'WHERE `Member`.`Blocked` = 0');
    39 while($Member = $DbResult->fetch_assoc())
    40 {
    41   $Member['Name'] = RouterOSIdent($Member['Name'].'-'.$Member['Id'] );
    42   echo('Uživatel '.$Member['Name'].': ');
     31    // Process users
     32    $DbResult = $this->System->Database->query('SELECT `Member`.*, `Subject`.`Name` FROM `Member` '.
     33        'LEFT JOIN `Subject` ON `Subject`.`Id` = `Member`.`Subject` '.
     34        'WHERE `Member`.`Blocked` = 0');
     35    while($Member = $DbResult->fetch_assoc())
     36    {
     37      $Member['Name'] = RouterOSIdent($Member['Name'].'-'.$Member['Id'] );
     38      echo('Uživatel '.$Member['Name'].': ');
    4339
    44   $DbResult2 = $System->Database->select('NetworkDevice', '*', '`Used` = 1 AND `Member` = '.$Member['Id']);
    45   while($Device = $DbResult2->fetch_assoc())
    46   {
    47     $DbResult3 = $System->Database->select('NetworkInterface', '*', '`Device` = '.$Device['Id'].' AND `LocalIP` != ""');
    48     while($Interface = $DbResult3->fetch_assoc())
     40      $DbResult2 = $this->System->Database->select('NetworkDevice', '*', '`Used` = 1 AND `Member` = '.$Member['Id']);
     41      while($Device = $DbResult2->fetch_assoc())
     42      {
     43        $DbResult3 = $this->Database->select('NetworkInterface', '*', '`Device` = '.$Device['Id'].' AND `LocalIP` != ""');
     44        while($Interface = $DbResult3->fetch_assoc())
     45        {
     46          $Name = $Device['Name'];
     47          if($Interface['Name'] != '') $Name .= '-'.$Interface['Name'];
     48          $Name = RouterOSIdent($Name);
     49          echo($Name.', ');
     50          $NewAddress = new NetworkAddressIPv4();
     51          $NewAddress->AddressFromString($Interface['LocalIP']);
     52          $NewAddress->Prefix = 32;
     53          InsertToAddressTree($AddressTree, $NewAddress, $Name);
     54        }
     55      }
     56
     57      $DbResult2 = $this->Database->select('NetworkSubnet', '*', '`Member`='.$Member['Id']);
     58      while($Subnet = $DbResult2->fetch_assoc())
     59      {
     60        $Subnet['Name'] = RouterOSIdent('subnet-'.$Subnet['Name']);
     61        echo($Subnet['Name'].', ');
     62        $NewAddress = new NetworkAddressIPv4();
     63        $NewAddress->AddressFromString($Subnet['AddressRange']);
     64        $NewAddress->Prefix = $Subnet['Mask'];
     65        if($Subnet['Member'] != 0) $ForceMark = true;
     66        else $ForceMark = false;
     67        echo($ForceMark.', ');
     68        InsertToAddressTree($AddressTree, $NewAddress, $Subnet['Name'], false, $ForceMark);
     69      }
     70      echo("\n");
     71    }
     72
     73    ShowSubnetNode($AddressTree);
     74
     75    function ProcessNode($Node)
    4976    {
    50       $Name = $Device['Name'];
    51       if($Interface['Name'] != '') $Name .= '-'.$Interface['Name'];
    52       $Name = RouterOSIdent($Name);
    53       echo($Name.', ');
    54       $NewAddress = new NetworkAddressIPv4();
    55       $NewAddress->AddressFromString($Interface['LocalIP']);
    56       $NewAddress->Prefix = 32;
    57       InsertToAddressTree($AddressTree, $NewAddress, $Name);
     77      global $InetInterface, $ItemsFirewall;
     78
     79      foreach($Node['Items'] as $Index => $Item)
     80      {
     81        if(count($Item['Items']) == 0)
     82        {
     83          // Hosts
     84          $ParentSubnetId = GetSubgroupByRange($Node['Address']->AddressToString().'/'.$Node['Address']->Prefix);
     85          $Address = $Item['Address']->AddressToString();
     86          if($Item['Address']->Prefix != 32) $Address .= '/'.$Item['Address']->Prefix;
     87
     88          $PacketMark = GetMarkByComment($Item['Name'].'-out');
     89          $ItemsFirewall[] = array('chain' => 'inet-'.$ParentSubnetId.'-out', 'src-address' => $Address, 'out-interface' =>  $InetInterface, 'action' => 'mark-packet', 'new-packet-mark' => $PacketMark, 'passthrough' => 'no', 'comment' => $Item['Name'].'-out');
     90          $PacketMark = GetMarkByComment($Item['Name'].'-in');
     91          $ItemsFirewall[] = array('chain' => 'inet-'.$ParentSubnetId.'-in', 'dst-address' => $Address, 'in-interface' => $InetInterface, 'action' => 'mark-packet', 'new-packet-mark' => $PacketMark, 'passthrough' => 'no', 'comment' => $Item['Name'].'-in');
     92        } else
     93        {
     94          // Subnets
     95          $ParentSubnetId = GetSubgroupByRange($Node['Address']->AddressToString().'/'.$Node['Address']->Prefix);
     96          $SubnetId = GetSubgroupByRange($Item['Address']->AddressToString().'/'.$Item['Address']->Prefix);
     97          $PacketMark = GetMarkByComment($Item['Name'].'-out');
     98
     99          $Address = $Item['Address']->AddressToString();
     100          if($Item['Address']->Prefix != 32) $Address .= '/'.$Item['Address']->Prefix;
     101
     102          $ItemsFirewall[] = array('chain' => 'inet-'.$ParentSubnetId.'-out', 'src-address' => $Address, 'out-interface' => $InetInterface, 'action' => 'jump', 'jump-target' => 'inet-'.$SubnetId.'-out', 'comment' => $Item['Name'].'-out');
     103          $ItemsFirewall[] = array('chain' => 'inet-'.$ParentSubnetId.'-in', 'dst-address' => $Address, 'in-interface' => $InetInterface, 'action' => 'jump', 'jump-target' => 'inet-'.$SubnetId.'-in', 'comment' => $Item['Name'].'-in');
     104
     105          ProcessNode($Item);
     106        }
     107      }
     108      if($Node['ForceMark'] == true)
     109      {
     110        // Mark member subnets
     111        $ParentSubnetId = GetSubgroupByRange($Node['Address']->AddressToString().'/'.$Node['Address']->Prefix);
     112
     113        $PacketMark = GetMarkByComment($Node['Name'].'-out');
     114        $ItemsFirewall[] = array('chain' => 'inet-'.$ParentSubnetId.'-out', 'src-address' => '', 'out-interface' =>  $InetInterface, 'action' => 'mark-packet', 'new-packet-mark' => $PacketMark, 'passthrough' => 'no', 'comment' => $Node['Name'].'-all-out');
     115        $PacketMark = GetMarkByComment($Node['Name'].'-in');
     116        $ItemsFirewall[] = array('chain' => 'inet-'.$ParentSubnetId.'-in', 'dst-address' => '', 'in-interface' => $InetInterface, 'action' => 'mark-packet', 'new-packet-mark' => $PacketMark, 'passthrough' => 'no', 'comment' => $Node['Name'].'-all-in');
     117      }
    58118    }
    59   }
    60119
    61   $DbResult2 = $System->Database->select('NetworkSubnet', '*', '`Member`='.$Member['Id']);
    62   while($Subnet = $DbResult2->fetch_assoc())
    63   {
    64     $Subnet['Name'] = RouterOSIdent('subnet-'.$Subnet['Name']);
    65     echo($Subnet['Name'].', ');
    66     $NewAddress = new NetworkAddressIPv4();
    67     $NewAddress->AddressFromString($Subnet['AddressRange']);
    68     $NewAddress->Prefix = $Subnet['Mask'];
    69     if($Subnet['Member'] != 0) $ForceMark = true;
    70       else $ForceMark = false;
    71     echo($ForceMark.', ');
    72     InsertToAddressTree($AddressTree, $NewAddress, $Subnet['Name'], false, $ForceMark);
    73   }
    74   echo("\n");
    75 }
     120    // Generate firewall rules
     121    $ItemsFirewall = array();
    76122
    77 ShowSubnetNode($AddressTree);
     123    // Root of tree and main limit
     124    $ItemsFirewall[] = array('chain' => 'forward', 'out-interface' => $InetInterface, 'dst-address' => '!77.92.221.0/24', 'action' => 'jump', 'jump-target' => 'inet-1-out', 'comment' => 'main-out');
     125    $ItemsFirewall[] = array('chain' => 'forward', 'in-interface' => $InetInterface, 'src-address' => '!77.92.221.0/24', 'action' => 'jump', 'jump-target' => 'inet-1-in', 'comment' => 'main-in');
    78126
    79 function ProcessNode($Node)
    80 {
    81   global $InetInterface, $ItemsFirewall;
     127    ProcessNode($AddressTree);
    82128
    83   foreach($Node['Items'] as $Index => $Item)
    84   {
    85     if(count($Item['Items']) == 0)
    86     {
    87       // Hosts
    88       $ParentSubnetId = GetSubgroupByRange($Node['Address']->AddressToString().'/'.$Node['Address']->Prefix);
    89       $Address = $Item['Address']->AddressToString();
    90       if($Item['Address']->Prefix != 32) $Address .= '/'.$Item['Address']->Prefix;
     129    // Limited free internet
     130    $PacketMark = GetMarkByComment('free-out');
     131    $ItemsFirewall[] = array('chain' => 'inet-1-out', 'out-interface' => $InetInterface,
     132        'action' => 'mark-packet', 'new-packet-mark' => $PacketMark, 'comment' => 'free-out', 'passthrough' => 'yes');
     133    $PacketMark = GetMarkByComment('free-in');
     134    $ItemsFirewall[] = array('chain' => 'inet-1-in', 'in-interface' => $InetInterface,
     135        'action' => 'mark-packet', 'new-packet-mark' => $PacketMark, 'comment' => 'free-in', 'passthrough' => 'no');
     136    // Unregistred clients add to address list
     137    $ItemsFirewall[] = array('chain' => 'inet-1-out', 'out-interface' => $InetInterface, 'src-address' => '10.145.0.0/16',
     138        'action' => 'add-src-to-address-list', 'address-list' => 'unregistred', 'address-list-timeout' => '1d',
     139        'comment' => 'unregistred-clients');
    91140
    92       $PacketMark = GetMarkByComment($Item['Name'].'-out');
    93       $ItemsFirewall[] = array('chain' => 'inet-'.$ParentSubnetId.'-out', 'src-address' => $Address, 'out-interface' =>  $InetInterface, 'action' => 'mark-packet', 'new-packet-mark' => $PacketMark, 'passthrough' => 'no', 'comment' => $Item['Name'].'-out');
    94       $PacketMark = GetMarkByComment($Item['Name'].'-in');
    95       $ItemsFirewall[] = array('chain' => 'inet-'.$ParentSubnetId.'-in', 'dst-address' => $Address, 'in-interface' => $InetInterface, 'action' => 'mark-packet', 'new-packet-mark' => $PacketMark, 'passthrough' => 'no', 'comment' => $Item['Name'].'-in');
    96     } else
    97     {
    98       // Subnets
    99       $ParentSubnetId = GetSubgroupByRange($Node['Address']->AddressToString().'/'.$Node['Address']->Prefix);
    100       $SubnetId = GetSubgroupByRange($Item['Address']->AddressToString().'/'.$Item['Address']->Prefix);
    101       $PacketMark = GetMarkByComment($Item['Name'].'-out');
    102 
    103       $Address = $Item['Address']->AddressToString();
    104       if($Item['Address']->Prefix != 32) $Address .= '/'.$Item['Address']->Prefix;
    105 
    106       $ItemsFirewall[] = array('chain' => 'inet-'.$ParentSubnetId.'-out', 'src-address' => $Address, 'out-interface' => $InetInterface, 'action' => 'jump', 'jump-target' => 'inet-'.$SubnetId.'-out', 'comment' => $Item['Name'].'-out');
    107       $ItemsFirewall[] = array('chain' => 'inet-'.$ParentSubnetId.'-in', 'dst-address' => $Address, 'in-interface' => $InetInterface, 'action' => 'jump', 'jump-target' => 'inet-'.$SubnetId.'-in', 'comment' => $Item['Name'].'-in');
    108 
    109       ProcessNode($Item);
    110     }
    111   }
    112   if($Node['ForceMark'] == true)
    113   {
    114     // Mark member subnets
    115     $ParentSubnetId = GetSubgroupByRange($Node['Address']->AddressToString().'/'.$Node['Address']->Prefix);
    116 
    117     $PacketMark = GetMarkByComment($Node['Name'].'-out');
    118     $ItemsFirewall[] = array('chain' => 'inet-'.$ParentSubnetId.'-out', 'src-address' => '', 'out-interface' =>  $InetInterface, 'action' => 'mark-packet', 'new-packet-mark' => $PacketMark, 'passthrough' => 'no', 'comment' => $Node['Name'].'-all-out');
    119     $PacketMark = GetMarkByComment($Node['Name'].'-in');
    120     $ItemsFirewall[] = array('chain' => 'inet-'.$ParentSubnetId.'-in', 'dst-address' => '', 'in-interface' => $InetInterface, 'action' => 'mark-packet', 'new-packet-mark' => $PacketMark, 'passthrough' => 'no', 'comment' => $Node['Name'].'-all-in');
     141    //print_r($ItemsFirewall);
     142    $Routerboard->ListUpdate($PathFirewall, array('chain', 'dst-address', 'in-interface', 'action', 'new-packet-mark', 'passthrough', 'comment', 'out-interface', 'src-address', 'jump-target'), $ItemsFirewall, array(), true);
    121143  }
    122144}
    123 
    124 // Generate firewall rules
    125 $ItemsFirewall = array();
    126 
    127 // Root of tree and main limit
    128 $ItemsFirewall[] = array('chain' => 'forward', 'out-interface' => $InetInterface, 'dst-address' => '!77.92.221.0/24', 'action' => 'jump', 'jump-target' => 'inet-1-out', 'comment' => 'main-out');
    129 $ItemsFirewall[] = array('chain' => 'forward', 'in-interface' => $InetInterface, 'src-address' => '!77.92.221.0/24', 'action' => 'jump', 'jump-target' => 'inet-1-in', 'comment' => 'main-in');
    130 
    131 ProcessNode($AddressTree);
    132 
    133 // Limited free internet
    134 $PacketMark = GetMarkByComment('free-out');
    135 $ItemsFirewall[] = array('chain' => 'inet-1-out', 'out-interface' => $InetInterface,
    136   'action' => 'mark-packet', 'new-packet-mark' => $PacketMark, 'comment' => 'free-out', 'passthrough' => 'yes');
    137 $PacketMark = GetMarkByComment('free-in');
    138 $ItemsFirewall[] = array('chain' => 'inet-1-in', 'in-interface' => $InetInterface,
    139   'action' => 'mark-packet', 'new-packet-mark' => $PacketMark, 'comment' => 'free-in', 'passthrough' => 'no');
    140 // Unregistred clients add to address list
    141 $ItemsFirewall[] = array('chain' => 'inet-1-out', 'out-interface' => $InetInterface, 'src-address' => '10.145.0.0/16',
    142   'action' => 'add-src-to-address-list', 'address-list' => 'unregistred', 'address-list-timeout' => '1d',
    143   'comment' => 'unregistred-clients');
    144 
    145 //print_r($ItemsFirewall);
    146 $Routerboard->ListUpdate($PathFirewall, array('chain', 'dst-address', 'in-interface', 'action', 'new-packet-mark', 'passthrough', 'comment', 'out-interface', 'src-address', 'jump-target'), $ItemsFirewall, array(), true);
Note: See TracChangeset for help on using the changeset viewer.