### Copyright (C) 1997 John D. Hardin
### This program is free software; you can redistribute it and/or modify
### it under the terms of the GNU General Public License as published by
### the Free Software Foundation; either version 2 of the License, or
### (at your option) any later version.
###
### This program is distributed in the hope that it will be useful,
### but WITHOUT ANY WARRANTY; without even the implied warranty of
### MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
### GNU General Public License for more details.
###
### You should have received a copy of the GNU General Public License
### along with this program; if not, write to the Free Software
### Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.

### $Id: allowserviceglobal.template,v 2.18 1999-05-24 13:18:54-07 jhardin Exp $


proc allowservicesglobal {} {
    # Allow / Services (Global)

    Desc "Global Services Allowed"

    ShortDesc "Global Services Allowed"

    Header head1 -text "Global Services Allowed"\
	    -background gray\
	    -help "Services are things like Telnet for logins, SMTP for email, FTP for file transfer,"\
	    "HTTP for Webs, and so forth. Certain services you may want to provide even if your default"\
	    "policy is \"deny\", for example, HTTP to serve web pages."\
            "\n\nYou'll also want to allow system-level services, such as domain (DNS name resolution)"\
            "and ntp or time (network time synchronization)."\
	    "\n\nIf your default policy is \"allow\" and you're not blocking Internet traffic by default,"\
            "you don't need to mention any services here, as they're all allowed by default."\
	    "\n\nNote: access to these services will be allowed for ALL hosts on the Internet."\
            "See \"Allow Hosts\" to limit access to specific hosts only."

    Label label1 -text "Firewall support"\
            -textafter "compiled into the kernel."\
	    -default "is"\
	    -packFrame:anchor center \
	    -help "Firewall support must be compiled into the kernel. If it is not,"\
	    "then you must configure and build a new kernel; see the Kernel HOWTO for"\
	    "instructions."

    CheckBox allowoutboundtcpallports -text "Allow outbound TCP to all ports?"\
            -default 0\
	    -packFrame:anchor center \
	    -help "\nIf you don't wish to list the specific services you allow, you can check this box."\
	          "This will allow users on the local network to initiate a connection to ANY service on ANY"\
	          "port."\
                  "\n\nThis option does not enable UDP traffic, which must be explicitly listed."\

    CheckBox allowoutboundtcpwellknownports -text "Allow outbound TCP to well-known ports?"\
            -default 0\
	    -packFrame:anchor center \
	    -help "\"Well-Known\" ports are standardized port numbers (1-1024) assigned to specific services"\
	          "by a central authority, the Internet Assigned Numbers Authority (IANA)."\
	          "\n\nIf you don't wish to list the specific services you allow, you can check this box."\
	          "This will allow users on the local network to initiate a connection to any service on a well-known"\
	          "port.\n\nNOTE: Some HTTP servers run on port numbers in the 8000 range. Checking this checkbox"\
                  "WILL NOT allow such traffic through. If you wish to access a HTTP server running on a port"\
                  "number in the 8000 range, you'll have to explicitly add that port or range (using the tcp protocol)"\
                  "to the list of allowed services - for example, add \"8000:8080/tcp (alternate HTTP)\"."\
                  "\n\nThis option does not enable UDP traffic, which must be explicitly listed by service."\

    Line line1

    global ServiceList
    ComboBox allowservice -text "Service to allow"\
	    -count 10\
	    -help "Select a service from the list, or enter one in the form port#(:port#)/\[tcp|udp\]."\
	      "For example, to allow inbound HTTP requests, enter \"80/tcp\". See the file"\
	      "/etc/services (from which this list was generated) for a list of services with some comments,"\
	      "or consult your ISP."\
	      "\nNote: access to these services will be allowed for ALL hosts on the Internet."\
              "See \"Allow Hosts\" to limit access to specific hosts only."\
            -entries $ServiceList

    Radio direction -defaultIndex 0\
	    -entryhelp {\
	    "Inbound" "Service requests coming in from the Intenet."\
	    "Outbound" "Service requests going out to the Internet."\
	    }

    ExtEntry allowedservices -entries {allowservice direction} -count 10

    ShowPage {
      global FirewallInKernel
      if {$FirewallInKernel == 0} {
	set label1 "is not"
	Disable allowoutboundtcpallports
	Disable allowoutboundtcpwellknownports
	Disable allowedservices
      } else {
	set label1 "is"
	Enable allowedservices
	Enable allowoutboundtcpallports
	if {$allowoutboundtcpallports} {
	  Disable allowoutboundtcpwellknownports
        } else {
	  Enable allowoutboundtcpwellknownports
        }
      }
    }

    Change {
      global FirewallInKernel
      if {$FirewallInKernel == 0} {
	set label1 "is not"
	Disable allowoutboundtcpallports
	Disable allowoutboundtcpwellknownports
	Disable allowedservices
      } else {
	set label1 "is"
	Enable allowedservices
	Enable allowoutboundtcpallports
	if {$allowoutboundtcpallports} {
	  Disable allowoutboundtcpwellknownports
        } else {
	  Enable allowoutboundtcpwellknownports
        }
      }
    }

    Save {
      global IPFWADM
      global ISPPort
      global LocalNetIP
      global LocalNetMask
      global PERL
      global ParseIP
      global MatchService
      global MatchPort
      if {$IPFWADM == "" || $ISPPort == ""} {
        # nothing
      } else {

        if {$allowoutboundtcpallports} {
          print "# allow anyone on the local net to request any tcp port from any Internet host"
          print $IPFWADM "-O -a accept \$INET -P tcp -S \$INET_IP -D \$ANY 1:65535"
          print $IPFWADM "-I -a accept \$INET -P tcp \$ConnEstablished -D \$INET_IP -S \$ANY 1:65535"
          if {${isp@on_internet}} {
            if {$LocalNetIP != "" && ${masq@masquerade} == 0} {
              print $IPFWADM "-I -a accept \$LETH -P tcp -S \$LNET -D \$ANY 1:65535"
              print $IPFWADM "-F -a accept \$INET -P tcp -S \$LNET -D \$ANY 1:65535"
              print $IPFWADM "-O -a accept \$INET -P tcp -S \$LNET -D \$ANY 1:65535"
              print $IPFWADM "-I -a accept \$INET -P tcp \$ConnEstablished -D \$LNET -S \$ANY 1:65535"
              print $IPFWADM "-F -a accept \$LETH -P tcp \$ConnEstablished -D \$LNET -S \$ANY 1:65535"
              print $IPFWADM "-O -a accept \$LETH -P tcp \$ConnEstablished -D \$LNET -S \$ANY 1:65535"
            }
          }
        } else {
          if {$allowoutboundtcpwellknownports} {
            print "# allow anyone on the local net to request any well-known tcp port from any Internet host"
            print $IPFWADM "-O -a accept \$INET -P tcp -S \$INET_IP -D \$ANY 1:1024"
            print $IPFWADM "-I -a accept \$INET -P tcp \$ConnEstablished -D \$INET_IP -S \$ANY 1:1024"
            if {${isp@on_internet}} {
              if {$LocalNetIP != "" && ${masq@masquerade} == 0} {
                print $IPFWADM "-I -a accept \$LETH -P tcp -S \$LNET -D \$ANY 1:1024"
                print $IPFWADM "-F -a accept \$INET -P tcp -S \$LNET -D \$ANY 1:1024"
                print $IPFWADM "-O -a accept \$INET -P tcp -S \$LNET -D \$ANY 1:1024"
                print $IPFWADM "-I -a accept \$INET -P tcp \$ConnEstablished -D \$LNET -S \$ANY 1:1024"
                print $IPFWADM "-F -a accept \$LETH -P tcp \$ConnEstablished -D \$LNET -S \$ANY 1:1024"
                print $IPFWADM "-O -a accept \$LETH -P tcp \$ConnEstablished -D \$LNET -S \$ANY 1:1024"
              }
            }
          }
        }

        if {$allowoutboundtcpallports || $allowoutboundtcpwellknownports} {
          print "# allow ftp-data connection back in to anyone on the local net from any Internet host"
          print $IPFWADM "-I -a accept \$INET -P tcp -S \$ANY 20 -D \$INET_IP 1025:65535 -t 0xE1 0x08"
          print $IPFWADM "-O -a accept \$INET -P tcp \$ConnEstablished -D \$ANY 20 -S \$INET_IP 1025:65535 -t 0xE1 0x08"
          if {${isp@on_internet}} {
            if {$LocalNetIP != "" && ${masq@masquerade} == 0} {
              print $IPFWADM "-I -a accept \$INET -P tcp -S \$ANY 20 -D \$LNET 1025:65535"
              print $IPFWADM "-F -a accept \$LETH -P tcp -S \$ANY 20 -D \$LNET 1025:65535"
              print $IPFWADM "-O -a accept \$LETH -P tcp -S \$ANY 20 -D \$LNET 1025:65535"
              print $IPFWADM "-I -a accept \$LETH -P tcp \$ConnEstablished -D \$ANY 20 -S \$LNET 1025:65535"
              print $IPFWADM "-F -a accept \$INET -P tcp \$ConnEstablished -D \$ANY 20 -S \$LNET 1025:65535"
              print $IPFWADM "-O -a accept \$INET -P tcp \$ConnEstablished -D \$ANY 20 -S \$LNET 1025:65535"
            }
          }
        }

        forevery allowedservices {

          set service $allowservice
          if {[regexp "$MatchPort" $service junk port junk prot]} {
            set ACK [pick {$prot == "tcp"} " \$ConnEstablished" ""]
            # if there's a description before or after the port spec, retrieve it.
            set descr ""
            if {![regexp "^(\[ A-Za-z0-9\\-_\]+)\[ \t\]+" $service junk descr]} {
              # not before. try after.
              regexp "\[ \t(\]+(\[ A-Za-z0-9\\-_\]+)" $service junk descr
            }
            if {$descr != ""} {
              set descr " ($descr)"
            }

            if {$direction(index) == 0} {	# inbound (specified host is SOURCE)
              if {$prot == "icmp"} {
                print "# Allow ICMP message $port$descr from any Internet host to anyone on the local net"
                print $IPFWADM "-I -a accept \$INET -P $prot -S \$ANY $port -D \$INET_IP"
                if {${isp@on_internet}} {
                  if {$LocalNetIP != "" && ${masq@masquerade} == 0} {
                    print $IPFWADM "-I -a accept \$INET -P $prot -S \$ANY $port -D \$LNET"
                    print $IPFWADM "-F -a accept \$LETH -P $prot -S \$ANY $port -D \$LNET"
                    print $IPFWADM "-O -a accept \$LETH -P $prot -S \$ANY $port -D \$LNET"
                  }
                }
              } else {
                # TCP or UDP
                print "# Allow any Internet host to request $prot port $port$descr from anyone on the local net"
                print $IPFWADM "-I -a accept \$INET -P $prot -S \$ANY -D \$INET_IP $port"
                print $IPFWADM "-O -a accept \$INET -P $prot$ACK -D \$ANY -S \$INET_IP $port"
                if {${isp@on_internet}} {
                  if {$LocalNetIP != "" && ${masq@masquerade} == 0} {
                    print $IPFWADM "-I -a accept \$INET -P $prot -S \$ANY -D \$LNET $port"
                    print $IPFWADM "-F -a accept \$LETH -P $prot -S \$ANY -D \$LNET $port"
                    print $IPFWADM "-O -a accept \$LETH -P $prot -S \$ANY -D \$LNET $port"
                    print $IPFWADM "-I -a accept \$LETH -P $prot$ACK -D \$ANY -S \$LNET $port"
                    print $IPFWADM "-F -a accept \$INET -P $prot$ACK -D \$ANY -S \$LNET $port"
                    print $IPFWADM "-O -a accept \$INET -P $prot$ACK -D \$ANY -S \$LNET $port"
                  }
                }
              }
            } else {	# outbound (specified host is DEST)
              if {$prot == "icmp"} {
                print "# Allow anyone on the local net to send ICMP message $port$descr to any Internet host"
                print $IPFWADM "-O -a accept \$INET -P $prot -S \$INET_IP $port -D \$ANY"
                if {${isp@on_internet}} {
                  if {$LocalNetIP != "" && ${masq@masquerade} == 0} {
                    print $IPFWADM "-I -a accept \$LETH -P $prot -S \$LNET $port -D \$ANY"
                    print $IPFWADM "-F -a accept \$INET -P $prot -S \$LNET $port -D \$ANY"
                    print $IPFWADM "-O -a accept \$INET -P $prot -S \$LNET $port -D \$ANY"
                  }
                }
              } else {
                # TCP or UDP
                print "# Allow anyone on the local net to request $prot port $port$descr from any Internet host"
                print $IPFWADM "-O -a accept \$INET -P $prot -S \$INET_IP -D \$ANY $port"
                print $IPFWADM "-I -a accept \$INET -P $prot$ACK -D \$INET_IP -S \$ANY $port"
                if {${isp@on_internet}} {
                  if {$LocalNetIP != "" && ${masq@masquerade} == 0} {
                    print $IPFWADM "-I -a accept \$LETH -P $prot -S \$LNET -D \$ANY $port"
                    print $IPFWADM "-F -a accept \$INET -P $prot -S \$LNET -D \$ANY $port"
                    print $IPFWADM "-O -a accept \$INET -P $prot -S \$LNET -D \$ANY $port"
                    print $IPFWADM "-I -a accept \$INET -P $prot$ACK -D \$LNET -S \$ANY $port"
                    print $IPFWADM "-F -a accept \$LETH -P $prot$ACK -D \$LNET -S \$ANY $port"
                    print $IPFWADM "-O -a accept \$LETH -P $prot$ACK -D \$LNET -S \$ANY $port"
                  }
                }
              }
            }

            if {$prot == "tcp" && $port == "21"} {
              # ftp service...
              # add special handling for ftp-data "reverse connection"
              # with type-of-service adjustment for bulk data
              print "#  The previous was an FTP control channel - permit the FTP data channel,"
              print "#  with Type-of-Service set to bulk data"
              if {$direction(index) == 0} {	# inbound (specified host is SOURCE)
                print $IPFWADM "-O -a accept \$INET -P $prot -S \$INET_IP 20 -D \$ANY 1025:65535 -t 0xE1 0x08"
                print $IPFWADM "-I -a accept \$INET -P $prot$ACK -D \$INET_IP 20 -S \$ANY 1025:65535 -t 0xE1 0x08"
                if {${isp@on_internet}} {
                  if {$LocalNetIP != "" && ${masq@masquerade} == 0} {
                    print $IPFWADM "-I -a accept \$LETH -P $prot -S \$LNET 20 -D \$ANY 1025:65535 -t 0xE1 0x08"
                    print $IPFWADM "-F -a accept \$INET -P $prot -S \$LNET 20 -D \$ANY 1025:65535"
                    print $IPFWADM "-O -a accept \$INET -P $prot -S \$LNET 20 -D \$ANY 1025:65535"
                    print $IPFWADM "-I -a accept \$INET -P $prot$ACK -D \$LNET 20 -S \$ANY 1025:65535 -t 0xE1 0x08"
                    print $IPFWADM "-F -a accept \$LETH -P $prot$ACK -D \$LNET 20 -S \$ANY 1025:65535"
                    print $IPFWADM "-O -a accept \$LETH -P $prot$ACK -D \$LNET 20 -S \$ANY 1025:65535"
                  }
                }
              } else {	# outbound (specified host is DEST)
                print $IPFWADM "-I -a accept \$INET -P $prot -S \$ANY 20 -D \$INET_IP 1025:65535 -t 0xE1 0x08"
                print $IPFWADM "-O -a accept \$INET -P $prot$ACK -D \$ANY 20 -S \$INET_IP 1025:65535 -t 0xE1 0x08"
                if {${isp@on_internet}} {
                  if {$LocalNetIP != "" && ${masq@masquerade} == 0} {
                    print $IPFWADM "-I -a accept \$INET -P $prot -S \$ANY 20 -D \$LNET 1025:65535 -t 0xE1 0x08"
                    print $IPFWADM "-F -a accept \$LETH -P $prot -S \$ANY 20 -D \$LNET 1025:65535"
                    print $IPFWADM "-O -a accept \$LETH -P $prot -S \$ANY 20 -D \$LNET 1025:65535"
                    print $IPFWADM "-I -a accept \$LETH -P $prot$ACK -D \$ANY 20 -S \$LNET 1025:65535 -t 0xE1 0x08"
                    print $IPFWADM "-F -a accept \$INET -P $prot$ACK -D \$ANY 20 -S \$LNET 1025:65535"
                    print $IPFWADM "-O -a accept \$INET -P $prot$ACK -D \$ANY 20 -S \$LNET 1025:65535"
                  }
                }
              }
            }

          } else {
            print "# Syntax error: service \"$service\" unparseable."
            tk_dialog .warning "Warning" "Syntax error: service \"$service\" unparseable." info 0 OK
          }

        }
      }
    }
}

