### Copyright (C) 1997 John D. Hardin
### This program is free software; you can redistribute it and/or modify
### it under the terms of the GNU General Public License as published by
### the Free Software Foundation; either version 2 of the License, or
### (at your option) any later version.
###
### This program is distributed in the hope that it will be useful,
### but WITHOUT ANY WARRANTY; without even the implied warranty of
### MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
### GNU General Public License for more details.
###
### You should have received a copy of the GNU General Public License
### along with this program; if not, write to the Free Software
### Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.

### $Id: allowlocalhost.template,v 1.1.1.1 1998/11/01 16:46:25 blackie Exp $


proc allowlocalhosts {} {
    # Allow / Services (Per-Host, Local Hosts)

    Desc "Per-Local-Host Services Allowed"

    ShortDesc "Per-Local-Host Services Allowed"

    Header head1 -text "Per-Local-Host Services Allowed"\
	    -background gray\
	    -help "Services are things like Telnet for logins, SMTP for email, FTP for file transfer,"\
	    "HTTP for Webs, and so forth. Certain services you may want to provide even if your default"\
	    "policy is \"deny\", for example, HTTP to serve web pages."\

    Label label1 -text "Firewall support"\
            -textafter "compiled into the kernel."\
	    -default "is"\
	    -packFrame:anchor center \
	    -help "Firewall support must be compiled into the kernel. If it is not,"\
	    "then you must configure and build a new kernel; see the Kernel HOWTO for"\
	    "instructions."

    Label label4 -text "IP Forwarding support"\
            -textafter "compiled into the kernel."\
	    -default "is"\
	    -packFrame:anchor center \
	    -help "Forwarding support must be compiled into the kernel if you wish to transfer"\
	    "packets between the local network and the Internet. If it is not,"\
	    "then you must configure and build a new kernel; see the Kernel HOWTO for"\
	    "instructions."

    Label label5 -text "Masquerading"\
            -textafter "been enabled."\
	    -default "has not"\
	    -packFrame:anchor center \
	    -help "If IP Masquerade is in use, then all local-net host controls must be configured in the"\
	    "Masquerade screen."

    Label label6 -text "A local network"\
            -textafter "been detected."\
	    -default "has not"\
	    -packFrame:anchor center \
	    -help "You must have a local network to control access permissions for computers on the local network..."

    Entry hostIP -text "Local Host"\
            -help "The name or unique IP address of a computer on the local network."

    global ServiceList
    ComboBox allowservice -text "Service to allow"\
	    -count 10\
	    -help "Select a service from the list, or enter one in the form port#(:port#)/\[tcp|udp\]."\
	      "For example, to allow HTTP requests, enter \"80/tcp\". See the file"\
	      "/etc/services (from which this list was generated) for a list of services with some comments,"\
	      "or consult your ISP."\
            -entries $ServiceList

    Radio direction -defaultIndex 0\
	    -entryhelp {\
	    "Inbound" "Service requests coming in from host(s) on the Intenet."\
	    "Outbound" "Service requests going out to host(s) on the Internet."\
	    }

    Line line1

    Frame frame1 -entries {hostIP}
    Frame frame2 -entries {allowservice direction}
    Frame frame3 -entries {frame1 frame2 line1} -orient top

    ExtEntry allowedhosts -entries frame3 -count 5

    ShowPage {
      Enable allowedhosts
      global FirewallInKernel
      if {$FirewallInKernel == 0} {
	set label1 "is not"
	Disable allowedhosts
      } else {
	set label1 "is"
      }
      global ForwardInKernel
      if {$ForwardInKernel == 0} {
	set label4 "is not"
	Disable allowedhosts
      } else {
        set label4 "is"
      }
      if {${masq@masquerade} && ${isp@on_internet}} {
        set label5 "has"
	Disable allowedhosts
      } else {
        set label5 "has not"
      }
      global LocalNetIP
      if {$LocalNetIP == ""} {
        set label6 "has not"
        Disable allowedhosts
      } else {
        set label6 "has"
      }
    }

    Save {
      global IPFWADM
      global ISPPort
      global LocalNetIP
      global MatchService
      if {$IPFWADM == "" || $ISPPort == ""} {
        # nothing
      } else {
	if {${masq@masquerade} && ${isp@on_internet}} {
	  print "# Masquerading is in use. Hosts on the local net will be controlled through"
	  print "# the masquerade options."
	} else {
	  if {$LocalNetIP == ""} {
	    print "# No local network has been detected."
	  } else {

            forevery allowedhosts {

	      if {[regexp "$MatchService" $allowservice junk serv port prot]} {
	        # retrieved from /etc/services

	        set ACK [pick {$prot == "tcp"} " \$ConnEstablished" ""]

	        if {$direction(index) == 0} {		# inbound (specified host is DEST)
                  if {$prot == "icmp"} {
	            print "# Allow any Internet host to send ICMP message $port trafffic ($serv) to $hostIP on the local net"
                    print $IPFWADM "-I -a accept \$INET -P $prot -S \$ANY $port -D $hostIP/32"
                    if {${isp@on_internet}} {
                      print $IPFWADM "-F -a accept \$LETH -P $prot -S \$ANY $port -D $hostIP/32"
                    }
                  } else {
	            print "# allow any Internet host to request $prot service $serv (port $port) from $hostIP on the local net"
                    print $IPFWADM "-I -a accept \$INET -P $prot -S \$ANY -D $hostIP/32" $serv
                    if {${isp@on_internet}} {
                      print $IPFWADM "-F -a accept \$LETH -P $prot -S \$ANY -D $hostIP/32" $serv
                      print $IPFWADM "-F -a accept \$INET -P $prot$ACK -D \$ANY -S $hostIP/32" $serv
                    }
                    print $IPFWADM "-O -a accept \$INET -P $prot$ACK -D \$ANY -S $hostIP/32" $serv
                  }
	        } else {				# outbound (specified host is SOURCE)
                  if {$prot == "icmp"} {
	            print "# Allow $hostIP on the local net to send ICMP message $port traffic ($serv) to any Internet host"
                    if {${isp@on_internet}} {
                      print $IPFWADM "-F -a accept \$INET -P $prot -S $hostIP/32 $port -D \$ANY"
                    }
                    print $IPFWADM "-O -a accept \$INET -P $prot -S $hostIP/32 $port -D \$ANY"
                  } else {
	            print "# allow $hostIP on the local net to request $prot service $serv (port $port) from any Internet host"
                    if {${isp@on_internet}} {
                      print $IPFWADM "-F -a accept \$INET -P $prot -S $hostIP/32 -D \$ANY" $serv
                    }
                    print $IPFWADM "-O -a accept \$INET -P $prot -S $hostIP/32 -D \$ANY" $serv
                    print $IPFWADM "-I -a accept \$INET -P $prot$ACK -D $hostIP/32 -S \$ANY" $serv
                    if {${isp@on_internet}} {
                      print $IPFWADM "-F -a accept \$LETH -P $prot$ACK -D $hostIP/32 -S \$ANY" $serv
                    }
	          }
	        }

	        if {$serv == "ftp"} {
	          # special handling for ftp-data "reverse connection"
	          if {$direction(index) == 0} {		# inbound (specified host is DEST)
                    if {${isp@on_internet}} {
                      print $IPFWADM "-F -a accept \$INET -P $prot -S $hostIP/32 ftp-data -D \$ANY 1024:65535"
                    }
                    print $IPFWADM "-O -a accept \$INET -P $prot -S $hostIP/32 ftp-data -D \$ANY 1024:65535 -t 0x00 0x08"
                    print $IPFWADM "-I -a accept \$INET -P $prot$ACK -D $hostIP/32 ftp-data -S \$ANY 1024:65535 -t 0x00 0x08"
                    if {${isp@on_internet}} {
                      print $IPFWADM "-F -a accept \$LETH -P $prot$ACK -D $hostIP/32 ftp-data -S \$ANY 1024:65535"
                    }
	          } else {				# outbound (specified host is SOURCE)
                    print $IPFWADM "-I -a accept \$INET -P $prot -S \$ANY ftp-data -D $hostIP/32 1024:65535 -t 0x00 0x08"
                    if {${isp@on_internet}} {
                      print $IPFWADM "-F -a accept \$LETH -P $prot -S \$ANY ftp-data -D $hostIP/32 1024:65535"
                      print $IPFWADM "-F -a accept \$INET -P $prot$ACK -D \$ANY ftp-data -S $hostIP/32 1024:65535"
                    }
                    print $IPFWADM "-O -a accept \$INET -P $prot$ACK -D \$ANY ftp-data -S $hostIP/32 1024:65535 -t 0x00 0x08"
	          }
	        }

              } else {

	        if {[regexp {([0-9:]+)/(tcp|udp|icmp)} $allowservice junk port prot]} {
	          # typed in by user

	          set ACK [pick {$prot == "tcp"} " \$ConnEstablished" ""]

	          if {$direction(index) == 0} {		# inbound (specified host is DEST)
                    if {$prot == "icmp"} {
	              print "# Allow any Internet host to send ICMP message $port traffic to $hostIP on the local net"
                      print $IPFWADM "-I -a accept \$INET -P $prot -S \$ANY $port -D $hostIP/32"
                      if {${isp@on_internet}} {
                        print $IPFWADM "-F -a accept \$LETH -P $prot -S \$ANY $port -D $hostIP/32"
                      }
                    } else {
	              print "# allow any Internet host to request $prot service on port $port from $hostIP on the local net"
                      print $IPFWADM "-I -a accept \$INET -P $prot -S \$ANY -D $hostIP/32" $port
                      if {${isp@on_internet}} {
                        print $IPFWADM "-F -a accept \$LETH -P $prot -S \$ANY -D $hostIP/32" $port
                        print $IPFWADM "-F -a accept \$INET -P $prot$ACK -D \$ANY -S $hostIP/32" $port
                      }
                      print $IPFWADM "-O -a accept \$INET -P $prot$ACK -D \$ANY -S $hostIP/32" $port
                    }
	          } else {				# outbound (specified host is SOURCE)
                    if {$prot == "icmp"} {
	              print "# Allow $hostIP on the local net to send ICMP message $port traffic to any Internet host"
                      if {${isp@on_internet}} {
                        print $IPFWADM "-F -a accept \$INET -P $prot -S $hostIP/32 $port -D \$ANY"
                      }
                      print $IPFWADM "-O -a accept \$INET -P $prot -S $hostIP/32 $port -D \$ANY"
                    } else {
	              print "# allow $hostIP on the local net to request $prot service on port $port from any Internet host"
                      if {${isp@on_internet}} {
                        print $IPFWADM "-F -a accept \$INET -P $prot -S $hostIP/32 -D \$ANY" $port
                      }
                      print $IPFWADM "-O -a accept \$INET -P $prot -S $hostIP/32 -D \$ANY" $port
                      print $IPFWADM "-I -a accept \$INET -P $prot$ACK -D $hostIP/32 -S \$ANY" $port
                      if {${isp@on_internet}} {
                        print $IPFWADM "-F -a accept \$LETH -P $prot$ACK -D $hostIP/32 -S \$ANY" $port
                      }
	            }
	          }

                } else {
                  print "# Syntax error on host $hostIP: service \"$allowservice\" unparseable."
                }
	      }
	    }
          }
        }
      }
    }
}
