### Copyright (C) 1997 John D. Hardin
### This program is free software; you can redistribute it and/or modify
### it under the terms of the GNU General Public License as published by
### the Free Software Foundation; either version 2 of the License, or
### (at your option) any later version.
###
### This program is distributed in the hope that it will be useful,
### but WITHOUT ANY WARRANTY; without even the implied warranty of
### MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
### GNU General Public License for more details.
###
### You should have received a copy of the GNU General Public License
### along with this program; if not, write to the Free Software
### Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.

### $Id: denyserviceglobal.template,v 2.11 1998-09-14 17:06:18-07 jhardin Exp $


proc denyservicesglobal {} {
    # Deny / Services (Global)

    Desc "Global Service Blocking"

    ShortDesc "Global Service Blocks"

    Header head1 -text "Global Service Blocking"\
	    -background gray\
	    -help "Services are things like Telnet for logins, SMTP for email, FTP for file transfer,"\
	    "HTTP for Webs, and so forth.\nSince you are probably not providing services to the"\
	    "Internet at large, it is a good idea to block any packets requesting them. This makes it"\
	    "more difficult to crack your system through a service that you may not know you are running"\
	    "or that you are providing for your local network but that the Internet should not have access"\
	    "to (like NetBIOS or IPX traffic)."\
	    "\nIf your default policy is \"deny\", you don't need to mention"\
	    "any services here, they're all blocked by default."\
	    "\nNote: these services will be blocked for ALL hosts on the Internet. See \"Deny Hosts\""\
	    "to block only specific hosts."\

    Label label1 -text "Firewall support"\
            -textafter "compiled into the kernel."\
	    -default "is"\
	    -packFrame:anchor center \
	    -help "Firewall support must be compiled into the kernel. If it is not,"\
	    "then you must configure and build a new kernel; see the Kernel HOWTO for"\
	    "instructions."

    global ServiceList
    ComboBox denyservice -text "Service to block"\
	    -count 10\
	    -help "Select a service from the list, or enter one in the form port#(:port#)/\[tcp|udp\]."\
	      "For example, to block inbound HTTP requests, enter \"80/tcp\". See the file"\
	      "/etc/services (from which this list was generated) for a list of services with some comments,"\
	      "or consult your ISP."\
	      "\nNote: these services will be blocked for ALL hosts on the Internet. See \"Deny Hosts\""\
	      "to block only specific hosts."\
            -entries $ServiceList

    Radio direction -defaultIndex 0\
	    -entryhelp {\
	    "Inbound" "Service requests coming in from the Intenet."\
	    "Outbound" "Service requests going out to the Internet."\
	    }

    ExtEntry deniedservices -entries {denyservice direction} -count 10

    ShowPage {
      global FirewallInKernel
      if {$FirewallInKernel == 0} {
	set label1 "is not"
	Disable deniedservices
      } else {
	set label1 "is"
	Enable deniedservices
      }
    }

    Save {
      global IPFWADM
      global ISPPort
      global LocalNetIP
      global LocalNetMask
      global PERL
      global ParseIP
      global MatchService
      global MatchPort
      if {$IPFWADM == "" || $ISPPort == ""} {
        # nothing
      } else {

        forevery deniedservices {

          set service $denyservice
          if {[regexp "$MatchPort" $service junk port junk prot]} {
            set ACK [pick {$prot == "tcp"} " \$ConnEstablished" ""]
            # if there's a description before or after the port spec, retrieve it.
            set descr ""
            if {![regexp "^(\[ A-Za-z0-9\\-_\]+)\[ \t\]+" $service junk descr]} {
              # not before. try after.
              regexp "\[ \t(\]+(\[ A-Za-z0-9\\-_\]+)" $service junk descr
            }
            if {$descr != ""} {
              set descr " ($descr)"
            }

            if {$direction(index) == 0} {	# inbound
              if {$prot == "icmp"} {
                print "# Block inbound ICMP message $port$descr traffic"
                print $IPFWADM "-I -a deny -o \$INET -P $prot -S \$ANY $port -D \$ANY"
              } else {
	        if {$prot == "tcp"} {
                  print "# Allow established inbound $prot port $port$descr traffic"
                  print $IPFWADM "-I -a accept \$INET -P $prot \$ConnEstablished -S \$ANY -D \$ANY $port"
	        }
                print "# Block new inbound $prot port $port$descr traffic"
                print $IPFWADM "-I -a deny -o \$INET -P $prot -S \$ANY -D \$ANY $port"
              }
	    } else {				# outbound
              if {$prot == "icmp"} {
                print "# Block outbound ICMP message $port$descr traffic"
                print $IPFWADM "-O -a reject \$INET -P $prot -S \$ANY $port -D \$ANY"
              } else {
	        if {$prot == "tcp"} {
                  print "# Allow established outbound $prot port $port$descr traffic"
                  print $IPFWADM "-O -a accept \$INET -P $prot \$ConnEstablished -S \$ANY -D \$ANY $port"
	        }
                print "# Block new outbound $prot port $port$descr traffic"
                print $IPFWADM "-O -a reject \$INET -P $prot -S \$ANY -D \$ANY $port"
              }
	    }

          } else {
            print "# Syntax error on host $host: service \"$denyservice\" unparseable."
            tk_dialog .warning "Warning" "Syntax error on host $host: service \"$denyservice\" unparseable." info 0 OK
          }
        }
      }
    }
}
