### Copyright (C) 1998 John D. Hardin
### This program is free software; you can redistribute it and/or modify
### it under the terms of the GNU General Public License as published by
### the Free Software Foundation; either version 2 of the License, or
### (at your option) any later version.
###
### This program is distributed in the hope that it will be useful,
### but WITHOUT ANY WARRANTY; without even the implied warranty of
### MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
### GNU General Public License for more details.
###
### You should have received a copy of the GNU General Public License
### along with this program; if not, write to the Free Software
### Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.

### $Id: main.template,v 2.38 1999-09-14 21:55:14-07 jhardin Exp $

set module(language) "english"
set module(creator) "John D. Hardin"
set module(email) "jhardin@wolfenet.com"
set module(name) "ipfwadm"
set module(version) "1.00"
set module(overAllDesc) "\nFirewall configuration file\n\\\$Id\\\$\nGenerated by: dotfile ipfwadm\nsee http://www.wolfenet.com/~jhardin/ipfwadm.html for details\n"

set setup(dotfile) {
  {ipfw "firewall configuration file" ~/ipfw.dotfile \#}
}
set setup(whatToGenerate) "all"

# Reset the locale to english, to prevent breaking the parsing routines
catch {
  unset env(LANG)
}
catch {
  unset env(LC_ALL)
}

# set up some things for the widgets

# regular expression to match services retrieved from a file
# where the format is: service_name port_number(:port_number)/protocol
# retrieve the name, port number and protocol
set MatchService "^(\[A-Za-z0-9\\-_\]+) +(\[0-9\]+(:\[0-9\]+)?)/(tcp|udp|icmp)"
# and one for just the port(s) and protocol
set MatchPort "(\[0-9\]+(:\[0-9\]+)?)/(tcp|udp|icmp)"

# read /etc/services for menu lists
# if port-numbers exists in the CWD use it instead (it's more complete)
# (see ftp://ftp.isi.edu/in-notes/iana/assignments/port-numbers)
set ServiceList ""

set EXPAND ""
catch {
  set EXPAND [exec /bin/bash -c "type -path expand"]
}
if {$EXPAND == ""} {
  tk_dialog .warning "Warning" "Cannot find the \"expand\" program. Please edit your services file and change tabs into spaces." info 0 OK
} else {
  # found expand, can strip tabs
  set EXPAND "| $EXPAND "
}

catch {
  if {[file exists port-numbers]} {
    set Services [open "${EXPAND}port-numbers" RDONLY]
  } else {
    set Services [open "${EXPAND}/etc/services" RDONLY]
  }

  while {![eof $Services]} {
    gets $Services line
  
    if {[regexp $MatchService $line match]} {
      set ServiceList [concat $ServiceList "\"$match\""]
    }
  }
  close $Services
}
unset EXPAND

# add traceroute to the services list
set ServiceList [concat $ServiceList "\"Traceroute 33434:33523/udp\""]

# add ICMP message types to the services list
set ServiceList [concat $ServiceList "\"Echo_Request 8/icmp\""]
set ServiceList [concat $ServiceList "\"Router_Advertisement 9/icmp\""]
set ServiceList [concat $ServiceList "\"Router_Solicitation 10/icmp\""]
set ServiceList [concat $ServiceList "\"Timestamp_Req 13/icmp\""]
set ServiceList [concat $ServiceList "\"Addr_Mask_Req 17/icmp\""]

# the IP mask list is defined here:
source [lindex $argv 1]/iputil.tcl

# read in the screen files
# do **not** change the order these are processed!
# deny is processed before allow for security reasons -
# better too restrictive than too loose...
foreach template {
  general isp \
  allowlocalfirewall \
  masq \
  denyptp allowptp \
  denyhost denylocalhost allowhost allowlocalhost \
  denyserviceglobal allowserviceglobal defaultinetpolicy
} {
  import $template.template
}

# End User: Change these to reflect your local reality if necessary.
# We automatically swap them if the Internet is on eth0
# and your local network on eth1 is in a Private IP range.
set LocalEth "eth0"
set InetEth "eth1"

# define the rest of the global variables
set ethconfig ""
set LocalNetIP "Unknown"
set LocalNetMask "Unknown"
set iethconfig ""
set InternetIP "Unknown"
set InternetMask "Unknown"

catch {
  set ethconfig [exec /sbin/ifconfig $LocalEth]
}
catch {
  set iethconfig [exec /sbin/ifconfig $InetEth]
}

# the following will break, of course, should the output of ifconfig change radically
# this script is based on the ifconfig in net-tools-1.32.alpha-2

if {[regexp {[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+} $ethconfig]} {
  regexp {inet addr:([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+)} $ethconfig junk LocalNetIP
  regexp {Mask:([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+)} $ethconfig junk LocalNetMask
} else {
  # No local network on $LocalEth, can't masquerade
  set LocalNetIP ""
  set LocalNetMask ""
}

if {[regexp {[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+} $iethconfig]} {
  regexp {inet addr:([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+)} $iethconfig junk InternetIP
  regexp {Mask:([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+)} $iethconfig junk InternetMask

  # see if InetEth and LocalEeth need to be swapped
  if { [IsAddressPrivate "$InternetIP/$InternetMask"] && ! [IsAddressPrivate "$LocalNetIP/$LocalNetMask"] } {
    # Inet IP is private and Lnet IP is valid  - swap them
    set tmp $InetEth
    set InetEth $LocalEth
    set LocalEth $tmp
    set tmp $InternetIP
    set InternetIP $LocalNetIP
    set LocalNetIP $tmp
    set tmp $InternetMask
    set InternetMask $LocalNetMask
    set LocalNetMask $tmp
  }
} else {
  # No interface on InetEth
  set InternetIP ""
  set InternetMask ""
}

set FirewallInKernel [file exists /proc/net/ip_input]
set ForwardInKernel [file exists /proc/net/ip_forward]
set MasqInKernel [file exists /proc/net/ip_masquerade]

set IPFWADM ""
if {[file exists /sbin/ipfwadm]} {
  set IPFWADM "/sbin/ipfwadm"
} else {
  # go looking for it
  catch {
    set IPFWADM [exec /bin/bash -c "type -path ipfwadm"]
  }
}

set MODPROBE ""
if {[file exists /sbin/modprobe]} {
  set MODPROBE "/sbin/modprobe"
} else {
  catch {
    set MODPROBE [exec /bin/bash -c "type -path modprobe"]
  }
}

set PERL ""
catch {
  set PERL [exec /bin/bash -c "type -path perl"]
}

set PS ""
catch {
  set PS [exec /bin/ps -ax]
}

set ISPPort ""
set DialdPort ""
if {[regexp {[0-9]:[0-9][0-9] diald} $PS]} {
  set DialdPort "sl0"
}
set UseIPUP 0
set InetIP ""
set InetIPValid 0

# a little perl script to parse IP address/mask pairs, one per line, from a text file
set ParseIP "if ( /^\\s*(\[0-9]+\\.\[0-9]+\\.\[0-9]+\\.\[0-9]+\\/((\[0-9]+\\.\[0-9]+\\.\[0-9]+\\.\[0-9]+)|(3\[012])|(\[12]\[0-9])|\[1-9]))\\D?/ ) {print \"\$1\\n\";}"

#eof
