#!/usr/bin/perl

# ipchains-config:
#   Version:        2.0
#   Author:         Eric von Bayer
#   Email:          ebayer@thetesseract.org
#   Dates:          Jan 2000 to Feb 2000
#   License:
#
#     ipchains-config Copyright (C) 2000 Eric von Bayer
#
#     This program is free software; you can redistribute it and/or
#     modify it under the terms of the GNU General Public License
#     as published by the Free Software Foundation; either version 2
#     of the License, or (at your option) any later version.
#
#     This program is distributed in the hope that it will be useful,
#     but WITHOUT ANY WARRANTY; without even the implied warranty of
#     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
#     GNU General Public License for more details.
#
#     You should have received a copy of the GNU General Public License
#     along with this program; if not, write to the Free Software
#     Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307,
#     USA.
#
#   Description:
#
#        IP Chains config tool... makes it easier to maintain an
#   IP chains style firewall.  IP chains are very powerful, but I
#   found the interface kinda clunky, this perl script was my way
#   of making it a bit more user friendly... allowing for comments
#   and a slightly more structured way of defining the chains.
#
#        The grammar is fairly simple:
#
# %% file /etc/ipchains.conf (or specified file) %%
#
#   group <groupname> {
#      entry <group|action> <args>
#      option <option> <args>
#   }
#
# %% end of file %%
#
#   The file is comprised of N groups... each group has any number of
#   entries or options in any order.  There are three special groups
#   that always must be defined: input, output, and forward.  You can
#   define as many supplementary groups beyond that as you wish.
#   (NOTE: group names can't be over 8 characters).  Groups need not
#   be defined before you reference them.  The elements used in the
#   grammar are as follows:
#      
#   option:   MinDelay, MaxThrough, MaxRely, or MinCost
#   group:    input, output, forward, or a user defined group
#   action:   ACCEPT, DENY, REDIRECT, REJECT, RETURN (MASQ is not yet
#             supported)
#   protocol: icmp, tcp, udp
#
#   args:     standard ipchains args, examples:
#     soruce:      [!] -s <ip number>/<ip mask> [!] <port> -p <protocol>
#     destination: [!] -d <ip number>/<ip mask> [!] <port> -p <protocol>
#     interface:   [!] -i <interface name>
#
#   If you have any suggestions, please feel free to send me email.  I
#   may be a working slob, but who knows... I might get around to adding
#   features.  If you find you like it and use it routinely, send me
#   an email... it's always nice to see people happily using your stuff.
#

use strict;

my @targets = (
	"ACCEPT",
	"BALANCE",
	"CLASSIFY",
	"CLUSTERIP",
	"CONNMARK",
	"DNAT",
	"DROP",
	"DSCP".
	"ECN",
	"IPMARK",
	"IPV4OPTSSTRIP",
	"LOG",
	"MARK",
	"MASQUERADE",
	"MIRROR",
	"NETMAP",
	"NFQUEUE",
	"NOTRACK",
	"QUEUE",
	"RETURN",
	"REJECT",
	"REDIRECT",
	"ROUTE",
	"SAME",
	"SET",
	"SNAT",
	"TARPIT",
	"TCPMSS",
	"TOS",
	"TRACE",
	"TTL",
	"ULOG",
	"XOR",
	 );

my @references = (
	"INPUT",
	"OUTPUT",
	"FORWARD"
	);
MAIN:
{
	my $file = "/etc/iptables.conf";

	if( $#ARGV >= 0 ) {
		$file = $ARGV[0];
	}

	open( FILE, $file );

	my $line = 0;
	my $cur_group;

	ipchains_clear();
	my $txt = "";

	while( <FILE> ) {
		$line++;
		chop;

		next if( /^[ \t]*#/ );
		next if( /^[ \t]*$/ );
		s/^[ \t]+//;

		# Deal with split lines
		if( /^(.*)\\[ \t]*$/ ) {
			$txt .= "$1 ";
			next;
		} else {
			$txt .= $_;
		}

		if( $txt =~ /^group[ \t]+(.*?)[ \t]*\{/ ) {
			ipchains_add_group( $1, $line );
			if( defined $cur_group ) {
				print STDERR "Line ${line}: Nested groups aren\'t allowed\n";
				exit 1;
			}
			$cur_group = $1;
		} elsif( defined $cur_group ) {
			if( $txt =~ /^}/ ) {
				undef $cur_group;
			} elsif( $txt =~ /^entry[ \t]+(.*?)([ \t]+.*|);/ ) {
				ipchains_add_entry( $cur_group, $1, $2, $line );
			} elsif( $txt =~ /^option[ \t]+([^ ]+)[ \t]*(.*?);/ ) {
				ipchains_option( $cur_group, $1, $2, $line );
			} else {
				printf( STDERR "Line ${line}: Unknown syntax\n" );
				print STDERR "  \"$_\"\n";
				exit 1;
			}
		}
		$txt = "";
	}

	close( FILE );

	my $bad_ref = 0;
	my $ref;
	my @rref;

	for $ref ( @references ) {
		@rref = grep( /^\Q${ref}\E$/, @targets );
		if( $#rref < 0 ) {
			$bad_ref = 1;
			print STDERR "Error: Referenced group \"${ref}\" never defined.\n";
		}
	}

	exit 1 if( $bad_ref );

	exit 0;
}

sub ipchains_clear {
	system( "iptables -F" );
	system( "iptables -X" );
	system( "iptables -F -t mangle" );
	system( "iptables -X -t mangle" );
	system( "iptables -F -t nat" );
	system( "iptables -X -t nat" );
}

sub ipchains_cmd {
	my( $args, $line ) = @_;

	$args .= " ";
	if( $args =~ s/^(.*)[ \t]+(-p[ \t]*(tcp|udp))[ \t]+(.*)$/$2 $1 $4/ ) {
		$args =~ s/[ \t]+-d[ \t]+(!?[ \t]*[^! \t]+)[ \t]+(?!-)(!?[ \t]*[^! \t]+)[ \t]+/ --dst $1 --destination-port $2 /g;
		$args =~ s/[ \t]+-s[ \t]+(!?[ \t]*[^! \t]+)[ \t]+(?!-)(!?[ \t]*[^! \t]+)[ \t]+/ --src $1 --source-port $2 /g;
	}
	$args =~ s/[ \t]+/ /g;
	$args =~ s/^[ \t]*(.*?)[ \t]*$/$1/;
print "cmd: iptables ${args}\n";
	if( system( "iptables ${args}" ) ) {
		printf STDERR "Line ${line}: Unknown Error with \"" .
			"iptables ${args}\"\n";
		exit 1;
	}
}

sub ipchains_add_entry {
	my( $group, $targ, $args, $line ) = @_;
	$targ =~ /^([^:]+)/;
	ipchains_add_reference( $1, $line );
	$targ =~ s/(REDIRECT):([0-9]+)/$1 --to-port $2/;
	ipchains_cmd( "-A ${group} -j ${targ} ${args}", $line );
}

sub ipchains_option {
	my( $group, $option, $args, $line ) = @_;

	my %option_map = (
		"MinDelay" => "--set-tos Minimize-Delay",
		"MaxThrough" => "--set-tos Maximize-Throughput",
		"MaxRely" => "--set-tos Maximize-Reliability",
		"MinCost" => "--set-tos Minimize-Cost"
	);

	if( !defined( $option_map{$option} ) ) {
		my @opts = keys( %option_map );
		printf( STDERR "Line ${line}: Illegal option \"%s\".\n" .
			"  Legal options are %s\n", $option,
			join( ', ', @opts ) );
		exit 1;
	}
	my $option_str = $option_map{$option};
	ipchains_cmd( "-t mangle -A ${group} ${args} -j TOS ${option_str}", $line );
}

sub ipchains_add_group {
	my( $group, $line ) = @_;

	my @res1 = grep /^\Q${group}\E$/, @targets;
	my @res2 = grep /^\Q${group}\E$/, @references;

	if( $#res1 < 0 ) {
		push @targets, $group;
	}

	if( $#res2 < 0 ) {
		if( $#res1 >= 0 ) {
			print STDERR "Line ${line}: Duplicate group \"${group}\"\n";
			exit 1;
		} else {
			push @targets, $group;
		}
	}

	if( $#res1 < 0 && $#res2 < 0 ) {
		if( system( "iptables -N ${group} >/dev/null 2>&1" ) ) {
			print STDERR "Line ${line}: Error creating group \"${group}\"\n";
			exit 1;
		}
	}	
}

sub ipchains_add_reference {
	my( $group, $line ) = @_;

	my @res = grep /^\Q${group}\E$/, ( @targets, @references );
	if( $#res < 0 ) {
		if( system( "iptables -N ${group} >/dev/null 2>&1" ) ) {
			print STDERR "Line ${line}: Error creating reference to group \"${group}\"\n";
			exit 1;
		}
		push @references, $group;
	}
}