### Copyright (C) 1998 John D. Hardin
### This program is free software; you can redistribute it and/or modify
### it under the terms of the GNU General Public License as published by
### the Free Software Foundation; either version 2 of the License, or
### (at your option) any later version.
###
### This program is distributed in the hope that it will be useful,
### but WITHOUT ANY WARRANTY; without even the implied warranty of
### MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
### GNU General Public License for more details.
###
### You should have received a copy of the GNU General Public License
### along with this program; if not, write to the Free Software
### Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.

### $Id: main.template,v 1.1.1.1 1998/11/01 16:46:25 blackie Exp $

set module(language) "english"
set module(creator) "John D. Hardin"
set module(email) "jhardin@wolfenet.com"
set module(name) "ipfwadm"
set module(version) "0.25b"
set module(overAllDesc) "\nFirewall configuration file\n\\\$Id\\\$\nGenerated by: dotfile ipfwadm\nsee http://www.wolfenet.com/~jhardin/ipfwadm.html for details\n"

set setup(dotfile) {
  {ipfw "firewall configuration file" ~/ipfw.dotfile \#}
}
set setup(whatToGenerate) "all"

# set up some things for the widgets

# regular expression to match services retrieved from /etc/services
# where the format is: service_name port_number/protocol
# retrieve the name, port number and protocol
set MatchService "^(\[A-Za-z0-9\\-_\]+)\[ \t\]+(\[0-9\]+)/(tcp|udp|icmp)"

# read /etc/services for menu lists
# note: we can't get this list from any other file, since ipfwadm
# resolves service names from /etc/services
# add entries to your /etc/services file if you want to use service names
set ServiceList ""
catch {
  set Services [open /etc/services]
  while {![eof $Services]} {
    gets $Services line
  
    if {[regexp $MatchService $line match]} {
      set ServiceList [concat $ServiceList "\"$match\""]
    }
  }
  close $Services

  # add ICMP message types to the services list
  set ServiceList [concat $ServiceList "\"Echo_Request 8/icmp\""]
  set ServiceList [concat $ServiceList "\"Router_Advertisement 9/icmp\""]
  set ServiceList [concat $ServiceList "\"Router_Solicitation 10/icmp\""]
  set ServiceList [concat $ServiceList "\"Timestamp_Req 13/icmp\""]
  set ServiceList [concat $ServiceList "\"Addr_Mask_Req 17/icmp\""]
}

# the IP mask list is defined here:
source [lindex $argv 1]/iputil.tcl

# read in the screen files
# do **not** change the order these are processed!
# deny is processed before allow for security reasons -
# better too restrictive than too loose...
foreach template {
  general isp masq \
  denyptp allowptp \
  denyhost denylocalhost allowhost allowlocalhost \
  denyserviceglobal allowserviceglobal defaultinetpolicy
} {
  import $template.template
}

# End User: Change these to reflect your local reality.
# We automatically swap them if the Internet is on eth0
# and your local network on eth1 is in a Private IP range.
set LocalEth "eth0"
set InetEth "eth1"

# define the rest of the global variables
set ethconfig ""
set LocalNetIP "Unknown"
set LocalNetMask "Unknown"
set iethconfig ""
set InternetIP "Unknown"
set InternetMask "Unknown"
catch {
  set ethconfig [exec /sbin/ifconfig $LocalEth]
}
catch {
  set iethconfig [exec /sbin/ifconfig $InetEth]
}

# the following will break, of course, should the output of ifconfig change radically
# this script is based on the ifconfig in net-tools-1.32.alpha-2

if {[regexp {[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+} $ethconfig]} {
  regexp {inet addr:([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+)} $ethconfig junk LocalNetIP
  regexp {Mask:([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+)} $ethconfig junk LocalNetMask
} else {
  # No local network on $LocalEth, can't masquerade
  set LocalNetIP ""
  set LocalNetMask ""
}

if {[regexp {[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+} $iethconfig]} {
  regexp {inet addr:([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+)} $iethconfig junk InternetIP
  regexp {Mask:([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+)} $ethconfig junk InternetMask

  # see if InetEth and LocalEeth need to be swapped
  if { [IsAddressPrivate "$InternetIP/$InternetMask"] && ! [IsAddressPrivate "$LocalNetIP/$LocalNetMask"] } {
    # Inet IP is private and Lnet IP is valid  - swap them
    set tmp $InetEth
    set InetEth $LocalEth
    set LocalEth $tmp
    set tmp $InternetIP
    set InternetIP $LocalNetIP
    set LocalNetIP $tmp
    set tmp $InternetMask
    set InternetMask $LocalNetMask
    set LocalNetMask $tmp
  }
} else {
  # No interface on InetEth
  set InternetIP ""
  set InternetMask ""
}

set FirewallInKernel [file exists /proc/net/ip_input]
set ForwardInKernel [file exists /proc/net/ip_forward]
set MasqInKernel [file exists /proc/net/ip_masquerade]

set IPFWADM ""
if {[file exists /sbin/ipfwadm]} {
  set IPFWADM "/sbin/ipfwadm"
} else {
  # go looking for it
  catch {
    set IPFWADM [exec /bin/bash -c "type -path ipfwadm"]
  }
}

set MODPROBE ""
if {[file exists /sbin/modprobe]} {
  set MODPROBE "/sbin/modprobe"
} else {
  catch {
    set MODPROBE [exec /bin/bash -c "type -path modprobe"]
  }
}

set PERL ""
catch {
  set PERL [exec /bin/bash -c "type -path perl"]
}

set PS ""
catch {
  set PS [exec /bin/ps -ax]
}

set ISPPort ""
set DialdPort ""
if {[regexp {[0-9]:[0-9][0-9] diald} $PS]} {
  set DialdPort "sl0"
}
set UseIPUP 0
set InetIP ""
set InetIPValid 0

# a little perl script to parse IP address/mask pairs, one per line, from a text file
set ParseIP "if ( /(\[0-9]+\\.\[0-9]+\\.\[0-9]+\\.\[0-9]+\\/((\[0-9]+\\.\[0-9]+\\.\[0-9]+\\.\[0-9]+)|(3\[012])|(\[12]\[0-9])|\[1-9]))\\D?/ ) {print \"\$1\\n\";}"


