### Copyright (C) 1997 John D. Hardin
### This program is free software; you can redistribute it and/or modify
### it under the terms of the GNU General Public License as published by
### the Free Software Foundation; either version 2 of the License, or
### (at your option) any later version.
###
### This program is distributed in the hope that it will be useful,
### but WITHOUT ANY WARRANTY; without even the implied warranty of
### MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
### GNU General Public License for more details.
###
### You should have received a copy of the GNU General Public License
### along with this program; if not, write to the Free Software
### Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.

### $Id: denyptp.template,v 1.1.1.1 1998/11/01 16:46:25 blackie Exp $


proc denyptp {} {
    # Deny / Services (Point-to-Point)

    Desc "Point-to-Point Servicexs Blocking"

    ShortDesc "Point-to-Point Service Blocking"

    Header head1 -text "Point-to-Point Service Blocking"\
	    -background gray\
	    -help "Services are things like Telnet for logins, SMTP for email, FTP for file transfer,"\
	    "HTTP for Webs, and so forth. Certain services you may want to provide even if your default"\
	    "policy is \"deny\", for example, HTTP to serve web pages."\

    Label label1 -text "Firewall support"\
            -textafter "compiled into the kernel."\
	    -default "is"\
	    -packFrame:anchor center \
	    -help "Firewall support must be compiled into the kernel. If it is not,"\
	    "then you must configure and build a new kernel; see the Kernel HOWTO for"\
	    "instructions."

    Entry hostIP -text "Internet Host"\
            -help "The name or unique IP address of a computer on the Internet,"\
	    "or a network address (to match all hosts on a particular network).\n"\
	    "WARNING: If you enter a name then that name should probably be in your /etc/hosts file."\
	    "If you access the Internet via dialup there is no guarantee that the ipfwadm"\
	    "command will be able to look up the name using DNS."

    global MaskList
    ComboBox hostnetmask -text "Network Mask"\
	    -count 8 -noedit 1\
            -entries $MaskList\
	    -help "If you entered the IP address or name for a specific host, select \"32: 255.255.255.255\" -"\
	    "this means that the address must match exactly for the packet to be accepted.\n"\
	    "If you entered a network address, or if you entered a host IP or name and want to match all of the"\
	    "hosts on the same network as that host, select the appropriate netmask for that network.\n"\
	    "WARNING: If you select \"0: 0.0.0.0\" then this rule will apply to *all* hosts on the Internet."

    Entry localhostIP -text "Local Host"\
            -help "The unique IP address of a computer on the local network."

    global ServiceList
    ComboBox denyservice -text "Service to block"\
	    -count 10\
	    -help "Select a service from the list, or enter one in the form port#(:port#)/\[tcp|udp\]."\
	      "For example, to block HTTP requests, enter \"80/tcp\". See the file"\
	      "/etc/services (from which this list was generated) for a list of services with some comments,"\
	      "or consult your ISP."\
            -entries $ServiceList

    Radio direction -defaultIndex 0\
	    -entryhelp {\
	    "Inbound" "Service requests coming in from host(s) on the Internet."\
	    "Outbound" "Service requests going out to host(s) on the Internet."\
	    }

    Line line1

    Frame frame1 -entries {hostIP hostnetmask}
    Frame frame2 -entries {denyservice direction}
    Frame frame3 -entries {frame1 localhostIP frame2 line1} -orient top

    ExtEntry deniedhosts -entries frame3 -count 5

    ShowPage {
      global FirewallInKernel
      if {$FirewallInKernel == 0} {
	set label1 "is not"
	Disable deniedhosts
      } else {
	set label1 "is"
	Enable deniedhosts
      }
    }

    Save {
      global IPFWADM
      global ISPPort
      global MatchService
      if {$IPFWADM == "" || $ISPPort == "" || ${isp@on_internet} == 0} {
        # nothing
      } else {

        forevery deniedhosts {

	  # get the net mask for the host
	  regexp {([0-9]+): } $hostnetmask junk maskbits

	  if {[regexp "$MatchService" $denyservice junk serv port prot]} {
	    # retrieved from /etc/services
	    
	    set ACK [pick {$prot == "tcp"} " \$ConnEstablished" ""]

	    if {$direction(index) == 0} {	# inbound (specified host is SOURCE)
              if {$prot == "icmp"} {
                print "# Block ICMP message $port ($serv) traffic from Internet network/host $hostIP to host $localhostIP on the local net"
                print $IPFWADM "-I -a deny -o \$INET -P $prot -S $hostIP/$maskbits $port -D $localhostIP/32"
                print $IPFWADM "-F -a deny \$LETH -P $prot -S $hostIP/$maskbits $port -D $localhostIP/32"
              } else {
	        print "# Block Internet network/host $hostIP requests for $prot service $serv (port $port) from host $localhostIP on the local net"
                print $IPFWADM "-I -a deny -o \$INET -P $prot -S $hostIP/$maskbits -D $localhostIP/32" $serv
                print $IPFWADM "-F -a deny -o \$LETH -P $prot -S $hostIP/$maskbits -D $localhostIP/32" $serv
                print $IPFWADM "-F -a reject -o \$INET -P $prot$ACK -D $hostIP/$maskbits -S $localhostIP/32" $serv
                print $IPFWADM "-O -a reject -o \$INET -P $prot$ACK -D $hostIP/$maskbits -S $localhostIP/32" $serv
              }
	    } else {				# outbound (specified host is DEST)
              if {$prot == "icmp"} {
	        print "# Block host $localhostIP on the local net sending ICMP message $port traffic ($serv) to Internet network/host $hostIP"
                print $IPFWADM "-O -a reject \$INET -P $prot -S $localhostIP/32 $port -D $hostIP/$maskbits"
                print $IPFWADM "-F -a reject \$INET -P $prot -S $localhostIP/32 $port -D $hostIP/$maskbits"
              } else {
	        print "# Block host $localhostIP on the local net requesting $prot service $serv (port $port) from Internet network/host $hostIP"
                print $IPFWADM "-F -a reject \$INET -P $prot -S $localhostIP/32 -D $hostIP/$maskbits" $serv
                print $IPFWADM "-O -a reject \$INET -P $prot -S $localhostIP/32 -D $hostIP/$maskbits" $serv
                print $IPFWADM "-I -a deny -o \$INET -P $prot$ACK -D $localhostIP/32 -S $hostIP/$maskbits" $serv
                print $IPFWADM "-F -a deny -o \$LETH -P $prot$ACK -D $localhostIP/32 -S $hostIP/$maskbits" $serv
	      }
	    }

	    if {$serv == "ftp"} {
	      # special handling for ftp-data "reverse connection"
	      if {$direction(index) == 0} {	# inbound (specified host is SOURCE)
                print $IPFWADM "-F -a reject \$INET -P $prot -S $localhostIP/32 ftp-data -D $hostIP/$maskbits"
                print $IPFWADM "-O -a reject \$INET -P $prot -S $localhostIP/32 ftp-data -D $hostIP/$maskbits"
                print $IPFWADM "-I -a deny -o \$INET -P $prot$ACK -D $localhostIP/32 ftp-data -S $hostIP/$maskbits"
                print $IPFWADM "-F -a deny -o \$LETH -P $prot$ACK -D $localhostIP/32 ftp-data -S $hostIP/$maskbits"
	      } else {				# outbound (specified host is DEST)
                print $IPFWADM "-I -a deny -o \$INET -P $prot -S $hostIP/$maskbits ftp-data -D $localhostIP/32"
                print $IPFWADM "-F -a deny -o \$LETH -P $prot -S $hostIP/$maskbits ftp-data -D $localhostIP/32"
                print $IPFWADM "-F -a reject \$INET -P $prot$ACK -D $hostIP/$maskbits ftp-data -S $localhostIP/32"
                print $IPFWADM "-O -a reject \$INET -P $prot$ACK -D $hostIP/$maskbits ftp-data -S $localhostIP/32"
	      }
	    }

          } else {

	    if {[regexp {([0-9:]+)/(tcp|udp|icmp)} $denyservice junk port prot]} {
	      # typed in by user

	      set ACK [pick {$prot == "tcp"} " \$ConnEstablished" ""]

	      if {$direction(index) == 0} {	# inbound (specified host is SOURCE)
                if {$prot == "icmp"} {
                  print "# Block ICMP message $port traffic from Internet network/host $hostIP to host $localhostIP on the local net"
                  print $IPFWADM "-I -a deny -o \$INET -P $prot -S $hostIP/$maskbits $port -D $localhostIP/32"
                  print $IPFWADM "-F -a deny -o \$LETH -P $prot -S $hostIP/$maskbits $port -D $localhostIP/32"
                } else {
	          print "# Block Internet network/host $hostIP requests for $prot service on port $port from host $localhostIP on the local net"
                  print $IPFWADM "-I -a deny -o \$INET -P $prot -S $hostIP/$maskbits -D $localhostIP/32" $port
                  print $IPFWADM "-F -a deny -o \$LETH -P $prot -S $hostIP/$maskbits -D $localhostIP/32" $port
                  print $IPFWADM "-F -a reject \$INET -P $prot$ACK -D $hostIP/$maskbits -S $localhostIP/32" $port
                  print $IPFWADM "-O -a reject \$INET -P $prot$ACK -D $hostIP/$maskbits -S $localhostIP/32" $port
	        }
	      } else {				# outbound (specified host is DEST)
                if {$prot == "icmp"} {
	          print "# Block host $localhostIP on the local net ICMP message $port traffic to Internet network/host $hostIP"
                  print $IPFWADM "-O -a reject \$INET -P $prot -S $localhostIP/32 $port -D $hostIP/$maskbits"
                  print $IPFWADM "-F -a reject \$INET -P $prot -S $localhostIP/32 $port -D $hostIP/$maskbits"
                } else {
	          print "# Block host $localhostIP on the local net requests for $prot service on port $port from Internet network/host $hostIP"
                  print $IPFWADM "-F -a reject \$INET -P $prot -S $localhostIP/32 -D $hostIP/$maskbits" $port
                  print $IPFWADM "-O -a reject \$INET -P $prot -S $localhostIP/32 -D $hostIP/$maskbits" $port
                  print $IPFWADM "-I -a deny -o \$INET -P $prot$ACK -D $localhostIP/32 -S $hostIP/$maskbits" $port
                  print $IPFWADM "-F -a deny -o \$LETH -P $prot$ACK -D $localhostIP/32 -S $hostIP/$maskbits" $port
	        }
	      }

            } else {
              print "# Syntax error on host $hostIP: service \"$denyservice\" unparseable."
            }
	  }
        }
      }
    }
}
