### Copyright (C) 1997 John D. Hardin
### This program is free software; you can redistribute it and/or modify
### it under the terms of the GNU General Public License as published by
### the Free Software Foundation; either version 2 of the License, or
### (at your option) any later version.
###
### This program is distributed in the hope that it will be useful,
### but WITHOUT ANY WARRANTY; without even the implied warranty of
### MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
### GNU General Public License for more details.
###
### You should have received a copy of the GNU General Public License
### along with this program; if not, write to the Free Software
### Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.

### $Id: allowserviceglobal.template,v 1.1.1.1 1998/11/01 16:46:25 blackie Exp $


proc allowservicesglobal {} {
    # Allow / Services (Global)

    Desc "Global Services Allowed"

    ShortDesc "Global Services Allowed"

    Header head1 -text "Global Services Allowed"\
	    -background gray\
	    -help "Services are things like Telnet for logins, SMTP for email, FTP for file transfer,"\
	    "HTTP for Webs, and so forth. Certain services you may want to provide even if your default"\
	    "policy is \"deny\", for example, HTTP to serve web pages."\
            "\n\nYou'll also want to allow system-level services, such as domain (DNS name resolution)"\
            "and ntp or time (network time synchronization)."\
	    "\n\nIf your default policy is \"allow\" and you're not blocking Internet traffic by default,"\
            "you don't need to mention any services here, as they're all allowed by default."\
	    "\n\nNote: access to these services will be allowed for ALL hosts on the Internet."\
            "See \"Allow Hosts\" to limit access to specific hosts only."

    Label label1 -text "Firewall support"\
            -textafter "compiled into the kernel."\
	    -default "is"\
	    -packFrame:anchor center \
	    -help "Firewall support must be compiled into the kernel. If it is not,"\
	    "then you must configure and build a new kernel; see the Kernel HOWTO for"\
	    "instructions."

    CheckBox allowoutboundtcpallports -text "Allow outbound TCP to all ports?"\
            -default 0\
	    -packFrame:anchor center \
	    -help "\nIf you don't wish to list the specific services you allow, you can check this box."\
	          "This will allow users on the local network to initiate a connection to ANY service on ANY"\
	          "port."\
                  "\n\nThis option does not enable UDP traffic, which must be explicitly listed."\

    CheckBox allowoutboundtcpwellknownports -text "Allow outbound TCP to well-known ports?"\
            -default 0\
	    -packFrame:anchor center \
	    -help "\"Well-Known\" ports are standardized port numbers (1-1024) assigned to specific services"\
	          "by a central authority, the Internet Assigned Numbers Authority (IANA)."\
	          "\n\nIf you don't wish to list the specific services you allow, you can check this box."\
	          "This will allow users on the local network to initiate a connection to any service on a well-known"\
	          "port.\n\nNOTE: Some HTTP servers run on port numbers in the 8000 range. Checking this checkbox"\
                  "WILL NOT allow such traffic through. If you wish to access a HTTP server running on a port"\
                  "number in the 8000 range, you'll have to explicitly add that port or range (using the tcp protocol)"\
                  "to the list of allowed services - for example, add \"8000:8080/tcp (alternate HTTP)\"."\
                  "\n\nThis option does not enable UDP traffic, which must be explicitly listed."\

    Line line1

    global ServiceList
    ComboBox allowservice -text "Service to allow"\
	    -count 10\
	    -help "Select a service from the list, or enter one in the form port#(:port#)/\[tcp|udp\]."\
	      "For example, to allow inbound HTTP requests, enter \"80/tcp\". See the file"\
	      "/etc/services (from which this list was generated) for a list of services with some comments,"\
	      "or consult your ISP."\
	      "\nNote: access to these services will be allowed for ALL hosts on the Internet."\
              "See \"Allow Hosts\" to limit access to specific hosts only."\
            -entries $ServiceList

    Radio direction -defaultIndex 0\
	    -entryhelp {\
	    "Inbound" "Service requests coming in from the Intenet."\
	    "Outbound" "Service requests going out to the Internet."\
	    }

    ExtEntry allowedservices -entries {allowservice direction} -count 10

    ShowPage {
      global FirewallInKernel
      if {$FirewallInKernel == 0} {
	set label1 "is not"
	Disable allowoutboundtcpallports
	Disable allowoutboundtcpwellknownports
	Disable allowedservices
      } else {
	set label1 "is"
	Enable allowedservices
	Enable allowoutboundtcpallports
	if {$allowoutboundtcpallports} {
	  Disable allowoutboundtcpwellknownports
        } else {
	  Enable allowoutboundtcpwellknownports
        }
      }
    }

    Change {
      global FirewallInKernel
      if {$FirewallInKernel == 0} {
	set label1 "is not"
	Disable allowoutboundtcpallports
	Disable allowoutboundtcpwellknownports
	Disable allowedservices
      } else {
	set label1 "is"
	Enable allowedservices
	Enable allowoutboundtcpallports
	if {$allowoutboundtcpallports} {
	  Disable allowoutboundtcpwellknownports
        } else {
	  Enable allowoutboundtcpwellknownports
        }
      }
    }

    Save {
      global IPFWADM
      global ISPPort
      global MatchService
      global LocalNetIP
      if {$IPFWADM == "" || $ISPPort == ""} {
        # nothing
      } else {

	if {$allowoutboundtcpallports} {
	  print "# allow anyone on the local net to request any tcp port from any Internet host"
          print $IPFWADM "-O -a accept \$INET -P tcp -S \$INET_IP -D \$ANY 1:65535"
          print $IPFWADM "-I -a accept \$INET -P tcp \$ConnEstablished -D \$INET_IP -S \$ANY 1:65535"
          if {${isp@on_internet}} {
	    if {$LocalNetIP != "" && ${masq@masquerade} == 0} {
              print $IPFWADM "-F -a accept \$INET -P tcp -S \$LNET -D \$ANY 1:65535"
              print $IPFWADM "-O -a accept \$INET -P tcp -S \$LNET -D \$ANY 1:65535"
              print $IPFWADM "-I -a accept \$INET -P tcp \$ConnEstablished -D \$LNET -S \$ANY 1:65535"
              print $IPFWADM "-F -a accept \$LETH -P tcp \$ConnEstablished -D \$LNET -S \$ANY 1:65535"
	    }
          }
	} else {
	  if {$allowoutboundtcpwellknownports} {
	    print "# allow anyone on the local net to request any well-known tcp port from any Internet host"
            print $IPFWADM "-O -a accept \$INET -P tcp -S \$INET_IP -D \$ANY 1:1024"
            print $IPFWADM "-I -a accept \$INET -P tcp \$ConnEstablished -D \$INET_IP -S \$ANY 1:1024"
            if {${isp@on_internet}} {
	      if {$LocalNetIP != "" && ${masq@masquerade} == 0} {
                print $IPFWADM "-F -a accept \$INET -P tcp -S \$LNET -D \$ANY 1:1024"
                print $IPFWADM "-O -a accept \$INET -P tcp -S \$LNET -D \$ANY 1:1024"
                print $IPFWADM "-I -a accept \$INET -P tcp \$ConnEstablished -D \$LNET -S \$ANY 1:1024"
                print $IPFWADM "-F -a accept \$LETH -P tcp \$ConnEstablished -D \$LNET -S \$ANY 1:1024"
	      }
	    }
	  }
        }

	if {$allowoutboundtcpallports || $allowoutboundtcpwellknownports} {
	  print "# allow ftp-data connection back in to anyone on the local net from any Internet host"
          print $IPFWADM "-I -a accept \$INET -P tcp -S \$ANY ftp-data -D \$INET_IP 1024:65535 -t 0x00 0x08"
          print $IPFWADM "-O -a accept \$INET -P tcp \$ConnEstablished -D \$ANY ftp-data -S \$INET_IP 1024:65535 -t 0x00 0x08"
          if {${isp@on_internet}} {
	    if {$LocalNetIP != "" && ${masq@masquerade} == 0} {
              print $IPFWADM "-I -a accept \$INET -P tcp -S \$ANY ftp-data -D \$LNET 1024:65535"
              print $IPFWADM "-F -a accept \$LETH -P tcp -S \$ANY ftp-data -D \$LNET 1024:65535"
              print $IPFWADM "-F -a accept \$INET -P tcp \$ConnEstablished -D \$ANY ftp-data -S \$LNET 1024:65535"
              print $IPFWADM "-O -a accept \$INET -P tcp \$ConnEstablished -D \$ANY ftp-data -S \$LNET 1024:65535"
	    }
	  }
	}

        forevery allowedservices {
	
	  if {[regexp "$MatchService" $allowservice junk serv port prot]} {
	    # retrieved from /etc/services

	    set ACK [pick {$prot == "tcp"} " \$ConnEstablished" ""]

	    if {$direction(index) == 0} {	# inbound
              if {$prot == "icmp"} {
                print "# Allow ICMP message $port ($serv) traffic from any Internet host to anyone on the local net"
                print $IPFWADM "-I -a accept \$INET -P $prot -S \$ANY $port -D \$INET_IP"
                if {${isp@on_internet}} {
	          if {$LocalNetIP != "" && ${masq@masquerade} == 0} {
                    print $IPFWADM "-I -a accept \$INET -P $prot -S \$ANY $port -D \$LNET"
                    print $IPFWADM "-F -a accept \$LETH -P $prot -S \$ANY $port -D \$LNET"
                  }
                }
              } else {
	        print "# allow any Internet host to request $prot service $serv (port $port) from anyone on the local net"
                print $IPFWADM "-I -a accept \$INET -P $prot -S \$ANY -D \$INET_IP" $serv
                print $IPFWADM "-O -a accept \$INET -P $prot$ACK -D \$ANY -S \$INET_IP" $serv
                if {${isp@on_internet}} {
	          if {$LocalNetIP != "" && ${masq@masquerade} == 0} {
                    print $IPFWADM "-I -a accept \$INET -P $prot -S \$ANY -D \$LNET" $serv
                    print $IPFWADM "-F -a accept \$LETH -P $prot -S \$ANY -D \$LNET" $serv
                    print $IPFWADM "-F -a accept \$INET -P $prot$ACK -D \$ANY -S \$LNET" $serv
                    print $IPFWADM "-O -a accept \$INET -P $prot$ACK -D \$ANY -S \$LNET" $serv
	          }
	        }
              }
	    } else {				# outbound
              if {$prot == "icmp"} {
	        print "# Allow anyone on the local net to send ICMP message $port ($serv) traffic to any Internet host"
                print $IPFWADM "-O -a accept \$INET -P $prot -S \$INET_IP $port -D \$ANY"
                if {${isp@on_internet}} {
	          if {$LocalNetIP != "" && ${masq@masquerade} == 0} {
                    print $IPFWADM "-F -a accept \$INET -P $prot -S \$LNET $port -D \$ANY"
                    print $IPFWADM "-O -a accept \$INET -P $prot -S \$LNET $port -D \$ANY"
                  }
                }
              } else {
	        if {$prot != "tcp" || !$allowoutboundtcpallports} {
	          print "# allow anyone on the local net to request $prot service $serv (port $port) from any Internet host"
                  print $IPFWADM "-O -a accept \$INET -P $prot -S \$INET_IP -D \$ANY" $serv
                  print $IPFWADM "-I -a accept \$INET -P $prot$ACK -D \$INET_IP -S \$ANY" $serv
                  if {${isp@on_internet}} {
	            if {$LocalNetIP != "" && ${masq@masquerade} == 0} {
                      print $IPFWADM "-F -a accept \$INET -P $prot -S \$LNET -D \$ANY" $serv
                      print $IPFWADM "-O -a accept \$INET -P $prot -S \$LNET -D \$ANY" $serv
                      print $IPFWADM "-I -a accept \$INET -P $prot$ACK -D \$LNET -S \$ANY" $serv
                      print $IPFWADM "-F -a accept \$LETH -P $prot$ACK -D \$LNET -S \$ANY" $serv
	            }
                  }
                }
              }
	    }

	    if {$serv == "ftp"} {
	      # special handling for ftp-data "reverse connection"
	      if {$direction(index) == 0} {	# inbound
                print $IPFWADM "-O -a accept \$INET -P $prot -S \$INET_IP ftp-data -D \$ANY 1024:65535 -t 0x00 0x08"
                print $IPFWADM "-I -a accept \$INET -P $prot$ACK -D \$INET_IP ftp-data -S \$ANY 1024:65535 -t 0x00 0x08"
                if {${isp@on_internet}} {
	          if {$LocalNetIP != "" && ${masq@masquerade} == 0} {
                    print $IPFWADM "-F -a accept \$INET -P $prot -S \$LNET ftp-data -D \$ANY 1024:65535"
                    print $IPFWADM "-O -a accept \$INET -P $prot -S \$LNET ftp-data -D \$ANY 1024:65535"
                    print $IPFWADM "-I -a accept \$INET -P $prot$ACK -D \$LNET ftp-data -S \$ANY 1024:65535"
                    print $IPFWADM "-F -a accept \$LETH -P $prot$ACK -D \$LNET ftp-data -S \$ANY 1024:65535"
	          }
                }
	      } else {				# outbound
	        if {!$allowoutboundtcpallports} {
                  print $IPFWADM "-I -a accept \$INET -P $prot -S \$ANY ftp-data -D \$INET_IP 1024:65535 -t 0x00 0x08"
                  print $IPFWADM "-O -a accept \$INET -P $prot$ACK -D \$ANY ftp-data -S \$INET_IP 1024:65535 -t 0x00 0x08"
                  if {${isp@on_internet}} {
	            if {$LocalNetIP != "" && ${masq@masquerade} == 0} {
                      print $IPFWADM "-I -a accept \$INET -P $prot -S \$ANY ftp-data -D \$LNET 1024:65535"
                      print $IPFWADM "-F -a accept \$LETH -P $prot -S \$ANY ftp-data -D \$LNET 1024:65535"
                      print $IPFWADM "-F -a accept \$INET -P $prot$ACK -D \$ANY ftp-data -S \$LNET 1024:65535"
                      print $IPFWADM "-O -a accept \$INET -P $prot$ACK -D \$ANY ftp-data -S \$LNET 1024:65535"
	            }
	          }
	        }
	      }
	    }

          } else {

	    if {[regexp {([0-9:]+)/(tcp|udp|icmp)} $allowservice junk port prot]} {
	      # typed in by user
	      if {[regexp {\( *([ A-Za-z0-9_\-]+) *\)} $allowservice junk serv]} {
                set serv " ($serv)"
              } else {
                set serv ""
              }

	      set ACK [pick {$prot == "tcp"} " \$ConnEstablished" ""]

	      if {$direction(index) == 0} {	# inbound (specified host is SOURCE)
                if {$prot == "icmp"} {
                  print "# Allow ICMP message $port traffic from any Internet host to anyone on the local net"
                  print $IPFWADM "-I -a accept \$INET -P $prot -S \$ANY $port -D \$INET_IP"
                  if {${isp@on_internet}} {
	            if {$LocalNetIP != "" && ${masq@masquerade} == 0} {
                      print $IPFWADM "-I -a accept \$INET -P $prot -S \$ANY $port -D \$LNET"
                      print $IPFWADM "-F -a accept \$LETH -P $prot -S \$ANY $port -D \$LNET"
                    }
                  }
                } else {
	          print "# allow any Internet host to request $prot port $port$serv from anyone on the local net"
                  print $IPFWADM "-I -a accept \$INET -P $prot -S \$ANY -D \$INET_IP" $port
                  print $IPFWADM "-O -a accept \$INET -P $prot$ACK -D \$ANY -S \$INET_IP" $port
                  if {${isp@on_internet}} {
	            if {$LocalNetIP != "" && ${masq@masquerade} == 0} {
                      print $IPFWADM "-I -a accept \$INET -P $prot -S \$ANY -D \$LNET" $port
                      print $IPFWADM "-F -a accept \$LETH -P $prot -S \$ANY -D \$LNET" $port
                      print $IPFWADM "-F -a accept \$INET -P $prot$ACK -D \$ANY -S \$LNET" $port
                      print $IPFWADM "-O -a accept \$INET -P $prot$ACK -D \$ANY -S \$LNET" $port
	            }
                  }
	        }
	      } else {				# outbound (specified host is DEST)
                if {$prot == "icmp"} {
	          print "# Allow anyone on the local net to send ICMP message $port traffic to any Internet host"
                  print $IPFWADM "-O -a accept \$INET -P $prot -S \$INET_IP $port -D \$ANY"
                  if {${isp@on_internet}} {
		    if {$LocalNetIP != "" && ${masq@masquerade} == 0} {
                      print $IPFWADM "-F -a accept \$INET -P $prot -S \$LNET $port -D \$ANY"
                      print $IPFWADM "-O -a accept \$INET -P $prot -S \$LNET $port -D \$ANY"
                    }
                  }
                } else {
	          print "# allow anyone on the local net to request $prot port $port$serv from any Internet host"
                  print $IPFWADM "-O -a accept \$INET -P $prot -S \$INET_IP -D \$ANY" $port
                  print $IPFWADM "-I -a accept \$INET -P $prot$ACK -D \$INET_IP -S \$ANY" $port
                  if {${isp@on_internet}} {
		    if {$LocalNetIP != "" && ${masq@masquerade} == 0} {
                      print $IPFWADM "-F -a accept \$INET -P $prot -S \$LNET -D \$ANY" $port
                      print $IPFWADM "-O -a accept \$INET -P $prot -S \$LNET -D \$ANY" $port
                      print $IPFWADM "-I -a accept \$INET -P $prot$ACK -D \$LNET -S \$ANY" $port
                      print $IPFWADM "-F -a accept \$LETH -P $prot$ACK -D \$LNET -S \$ANY" $port
	            }
	          }
	        }
	      }

            } else {
	      if {$allowservice != ""} {
                print "# Syntax error: service \"$allowservice\" unparseable."
	      }
            }
	  }
        }
      }
    }
}
