ClearOS API

Class Firewall

Description

Firewall base class.

author: Point Clark Networks
copyright: Copyright 2003-2006, Point Clark Networks
license: GNU Public License

Located in /api/Firewall.class.php (line 87)

Engine
   |
   --Software
      |
      --Daemon
         |
         --Firewall

Direct descendents

Class	Description
FirewallRedirect	Firewall redirect class.
FirewallMultiWan	Firewall MultiWAN support class.
FirewallForward	Firewall forward connections config.
FirewallLayer7Filter	Firewall l7-filter support class.
Bandwidth	Bandwidth manager
FirewallOutgoing	Firewall outgoing connections config.
FirewallIncoming	Firewall incoming connections config.
FirewallOneToOneNat	Firewall 1:1 NAT config.
FirewallDmz	Firewall DMZ connections config.
FirewallWifi	Firewall Wifi base class.

Class Constant Summary

CONSTANT_ALL_PORTS = 0

CONSTANT_ALL_PROTOCOLS = "ALL"

CONSTANT_AUTO = 1

CONSTANT_DISABLED = "disabled"

CONSTANT_DMZ = "DMZIF"

CONSTANT_ENABLED = "enabled"

CONSTANT_EXTERNAL = "EXTIF"

CONSTANT_GATEWAY = "gateway"

CONSTANT_HOT_LAN = "HOTIF"

CONSTANT_LAN = "LANIF"

CONSTANT_MULTIPATH = "MULTIPATH"

CONSTANT_NORMAL = "normal"

CONSTANT_NOT_CONFIGURED = "notconfigured"

CONSTANT_OFF = "off"

CONSTANT_ON = "on"

CONSTANT_ONE_TO_ONE_NAT_START = 200

CONSTANT_PORT_RANGE = "portrange"

CONSTANT_PROTOCOL_TCP = "TCP"

CONSTANT_PROTOCOL_UDP = "UDP"

CONSTANT_SPECIAL = "special"

CONSTANT_STANDALONE = "standalone"

CONSTANT_TRUSTEDGATEWAY = "trustedgateway"

CONSTANT_TRUSTEDSTANDALONE = "trustedstandalone"

FILE_CONFIG = "/etc/firewall"

FILE_CUSTOM_RULES = "/etc/rc.d/rc.firewall.local"

Method Summary

Firewall __construct ()

void AddHost (string $host, string $key)

void AddMac (string $mac, string $key)

void AddPort (string $protocol, string $port, string $key)

void AddPortRange (string $protocol, string $from, string $to, string $key)

void AddRule (object val $val)

void AddStandardService (string $service, string $key)

void DeleteHost (string $host, $key)

void DeleteMac (string $mac, $key)

void DeletePort (string $protocol, string $port, $key)

void DeletePortRange (string $protocol, string $from, string $to, $key)

void DeleteRule (object val $val)

object Matching FindRule (object val $val)

array GetHosts (string $key)

string GetInterfaceDefinition (string $role)

string GetInterfaceRole (string $device)

string GetInterfaceRoleText (string $device)

array GetMacs (string $key)

string GetMode ()

array GetPortRanges (string $key)

array GetPorts (string $key)

array GetRules ()

array GetStandardServiceList ()

boolean GetState (string $key)

string GetValue (string $key)

boolean IsValidIp (string $ip)

boolean IsValidMac (string $mac)

boolean IsValidMode (string $mode)

boolean IsValidPort (int $port)

boolean IsValidPortRange (int $from, int $to)

boolean IsValidProtocol (string $protocol)

boolean IsValidServer (boolean $ipsecserver)

boolean IsValidService (string $service)

string LookupHostMetainfo (string $host)

string LookupService (string $protocol, int $port)

void RemoveInterfaceRole (string $device)

void SetInterface (string $interface, string $key)

void SetInterfaceRole (string $device, string $role)

void SetMode (string $mode)

void SetRules (array $rules)

void SetState (boolean $state, string $key)

void SetValue (string $value, string $key)

Variables

Inherited Variables

Inherited from Daemon

Daemon::$initscript
Daemon::$package
Daemon::$processname
Daemon::$reloadable
Daemon::$title

Inherited from Software

Software::$copyright
Software::$description
Software::$installsize
Software::$installtime
Software::$packager
Software::$pkgname
Software::$release
Software::$summary
Software::$version

Inherited from Engine

Engine::$errors

Methods

Constructor __construct (line 132)

Firewall constructor.

access: public

Firewall __construct ()

Redefinition of:

Daemon::__construct(): Daemon constructor.

Redefined in descendants as:

FirewallRedirect::__construct() : Firewall redirect constructor.
FirewallMultiWan::__construct() : Class constructor.
FirewallForward::__construct() : FirewallForward constructor.
FirewallLayer7Filter::__construct() : FirewallLayer7Filter constructor.
Bandwidth::__construct() : Bandwidth constructor.
FirewallOutgoing::__construct() : Firewall constructor.
FirewallIncoming::__construct() : FirewallIncoming constructor.
FirewallOneToOneNat::__construct() : FirewallOneToOneNat constructor.
FirewallDmz::__construct() : Firewall DMZ constructor.
FirewallWifi::__construct() : FirewallWifi constructor.

AddHost (line 884)

Generic add for host, IP or network list.

throws: EngineException
access: protected

void AddHost (string $host, string $key)

string $host: host domain name, IP, or network address
string $key: key key for the list

AddMac (line 821)

Generic add MAC list.

throws: EngineException
access: protected

void AddMac (string $mac, string $key)

string $mac: mac MAC address
string $key: key key for the list

AddPort (line 949)

Generic add for a protocol/port list.

throws: EngineException
access: protected

void AddPort (string $protocol, string $port, string $key)

string $protocol: protocol the protocol - UDP/TCP
string $port: port service name, port number
string $key: key key for the list

Redefined in descendants as:

FirewallOneToOneNat::AddPort() : Adds a port only 1:1 NAT rule.

AddPortRange (line 1017)

Generic add for a protocol/port-range list.

throws: EngineException
access: protected

void AddPortRange (string $protocol, string $from, string $to, string $key)

string $protocol: protocol the protocol - UDP/TCP
string $from: from from service name, port number
string $to: to to service name, port number
string $key: key key for the list

Redefined in descendants as:

FirewallOneToOneNat::AddPortRange() : Adds a port range 1:1 NAT rule.

AddRule (line 738)

Add firewall rule.

throws: EngineException
access: public

void AddRule (object val $val)

object val $val: FirewallRule object to add

AddStandardService (line 1083)

Generic add for a protocol/port list - specified by service name.

throws: EngineException
access: protected

void AddStandardService (string $service, string $key)

string $service: service service name eg HTTP, FTP, SMTP
string $key: key key for the list

DeleteHost (line 1122)

Generic delete for a host/IP/network list.

throws: EngineException
access: protected

void DeleteHost (string $host, $key)

string $host: host host, IP or network
$key

DeleteMac (line 1183)

Generic delete for a MAC address.

throws: EngineException
access: protected

void DeleteMac (string $mac, $key)

string $mac: mac MAC address
$key

DeletePort (line 1245)

Generic delete for a protocol/port list.

throws: EngineException
access: protected

void DeletePort (string $protocol, string $port, $key)

string $protocol: protocol the protocol - UDP/TCP
string $port: port service name, port number
$key

Redefined in descendants as:

FirewallOneToOneNat::DeletePort() : Delete an existing 1:1 NAT port rule.

DeletePortRange (line 1313)

Generic delete for a protocol/port-range list.

throws: EngineException
access: protected

void DeletePortRange (string $protocol, string $from, string $to, $key)

string $protocol: protocol the protocol - UDP/TCP
string $from: port service name, port number
string $to: key key for the list
$key

Redefined in descendants as:

FirewallOneToOneNat::DeletePortRange() : Delete an existing 1:1 NAT port range rule.

DeleteRule (line 773)

Delete firewall rule.

throws: EngineException
access: public

void DeleteRule (object val $val)

object val $val: FirewallRule object to delete

FindRule (line 717)

Find firewall rule.

return: rule
access: public

object Matching FindRule (object val $val)

object val $val: FirewallRule object to search for

GetHosts (line 1379)

Generic get list for a hosts or networks.

return: list of hosts
throws: EngineException
access: protected

array GetHosts (string $key)

string $key: key key for the list

GetInterfaceDefinition (line 278)

Get network interface definition. The firewall needs to know which

interface performs which function. If you pass the interface role into this method, it will return the interface (eg eth0). The interface roles are defined as follows:

Firewall::CONSTANT_EXTERNAL Firewall::CONSTANT_LAN Firewall::CONSTANT_HOT_LAN Firewall::CONSTANT_DMZ

Example: GetInterfaceDefinition(Firewall::CONSTANT_LAN) returns eth1 in most cases -- since this is the default.

TODO: with multiple interfaces now allowed, we have to add a new method that will return a list. For now, just return the first interface found.

return: interface Interface name
throws: EngineException, ValidationException
access: public

string GetInterfaceDefinition (string $role)

string $role: role Interface role

GetInterfaceRole (line 341)

Get network interface role. The firewall needs to know which

interface performs which function. If you pass the interface device into this method, it will return the interface's role. The interface roles are defined as follows:

Firewall::CONSTANT_EXTERNAL Firewall::CONSTANT_HOT_LAN Firewall::CONSTANT_LAN Firewall::CONSTANT_DMZ

Example: GetInterfaceRole("eth0") returns Firewall::CONSTANT_LAN in most cases -- since this is the default.

return: interface Interface role
throws: EngineException
access: public

string GetInterfaceRole (string $device)

string $device: device Interface name

GetInterfaceRoleText (line 400)

Returns network interface role in text.

return: interface role
see: Firewall::GetInterfaceRole()
throws: EngineException
access: public

string GetInterfaceRoleText (string $device)

string $device: interface name

GetMacs (line 1427)

Generic get list for MAC addresses.

return: list of MACs
throws: EngineException
access: protected

array GetMacs (string $key)

string $key: key key for the list

GetMode (line 222)

Returns the current firewall mode.

return: firewall mode Firewall::CONSTANT_(AUTO, GATEWAY, or STANDALONE)
throws: EngineException
access: public

string GetMode ()

GetPortRanges (line 1466)

Generic get list for a protocol/port-range list.

The information is an array with the following hash array entries:

info[protocol] info[from] info[to]

return: allowed incoming port ranges
access: protected

array GetPortRanges (string $key)

string $key: key key for the list

GetPorts (line 1517)

Generic get list for a protocol/port list.

The information is an array with the following hash array entries:

info[protocol] info[port] info[service] (FTP, HTTP, etc.)

return: allowed incoming ports
access: protected

array GetPorts (string $key)

string $key: key key for the list

GetRules (line 617)

Get array of firewall rules.

return: rules FirewallRule objects
throws: EngineException
access: public

array GetRules ()

GetStandardServiceList (line 148)

Returns the pre-defined list of ports/and services.

return: list of pre-defined ports
access: public

array GetStandardServiceList ()

GetState (line 1569)

Generic get state for a on/off key.

return: state of the key
throws: EngineException
access: protected

boolean GetState (string $key)

string $key: key key for the list

Redefined in descendants as:

Bandwidth::GetState() : Returns the state of the bandwidth manager.

GetValue (line 1601)

Generic get value for a key.

return: value of the key
throws: EngineException
access: protected

string GetValue (string $key)

string $key: key key for the list

IsValidIp (line 1760)

Validation routine for IPs

return: true if IP address is valid
access: public

boolean IsValidIp (string $ip)

string $ip: ip IP address

IsValidMac (line 1807)

Validation routine for MACs

return: true if MAC address is valid
access: public

boolean IsValidMac (string $mac)

string $mac: mac MAC address

IsValidMode (line 1784)

Validation routine for firewall mode.

return: true if mode is valid
access: public

boolean IsValidMode (string $mode)

string $mode: mode Firewall mode

IsValidPort (line 1831)

Validation routine for integer port address

return: true if port is valid
access: public

boolean IsValidPort (int $port)

int $port: port Numeric port address

IsValidPortRange (line 1854)

Validation routine for integer port range

return: true if port range is valid
access: public

boolean IsValidPortRange (int $from, int $to)

int $from: from Low port address
int $to: to High port address

IsValidProtocol (line 1878)

Validation routine for protocol (TCP, UDP, ALL)

return: true if protocl is valid
access: public

boolean IsValidProtocol (string $protocol)

string $protocol: protocol Protocol (TCP, UDP, or ALL)

IsValidServer (line 1915)

Validation routine for IPSec Server

return: true if ipsecserver is valid
access: public

boolean IsValidServer (boolean $ipsecserver)

boolean $ipsecserver: ipsecserver IPSec server toggle setting (true/false)

IsValidService (line 1896)

Validation routine for service.

return: true if service is valid
access: public

boolean IsValidService (string $service)

string $service: service service eg HTTP

LookupHostMetainfo (line 202)

Returns the special name for a given host (eg ICQ servers).

return: name
access: public

string LookupHostMetainfo (string $host)

string $host: host

LookupService (line 180)

Returns the service defined by the given port/protocol.

return: service
access: public

string LookupService (string $protocol, int $port)

string $protocol: protocol
int $port: port

RemoveInterfaceRole (line 569)

Remove interface role. The interface is removed from any role variables if it has been previously assigned a role.

throws: EngineException, FirewallUndefinedRoleException
access: public

void RemoveInterfaceRole (string $device)

string $device: device Interface name

SetInterface (line 1650)

Generic set state for a on/off key.

throws: EngineException
access: protected

void SetInterface (string $interface, string $key)

string $interface: interface device name
string $key: value of the key

SetInterfaceRole (line 430)

Set network interface role. The interface is first removed from it's previous role (if any).

throws: EngineException, FirewallUndefinedRoleException
access: public

void SetInterfaceRole (string $device, string $role)

string $device: device Interface name
string $role: role Interface role

SetMode (line 1630)

Generic set firewall mode.

throws: EngineException
access: public

void SetMode (string $mode)

string $mode: mode Firewall mode

SetRules (line 664)

Set firewall rules from array.

throws: EngineException
access: public

void SetRules (array $rules)

array $rules: rules Array of FirewallRule objects

SetState (line 1690)

Generic set state for a on/off key.

throws: EngineException
access: protected

void SetState (boolean $state, string $key)

boolean $state: state true or false
string $key: key value of the key

SetValue (line 1730)

Generic set for a miscelleanous value.

throws: EngineException
access: protected

void SetValue (string $value, string $key)

string $value: value of the key
string $key: key name

Inherited Methods

Inherited From Daemon

Daemon::__construct()
Daemon::GetBootState()
Daemon::GetProcessName()
Daemon::GetRunningState()
Daemon::GetTitle()
Daemon::Reset()
Daemon::Restart()
Daemon::SetBootState()
Daemon::SetRunningState()
Daemon::__destruct()

Inherited From Software

Software::__construct()
Software::GetCopyright()
Software::GetDescription()
Software::GetInstallSize()
Software::GetInstallTime()
Software::GetPackageName()
Software::GetPackager()
Software::GetRelease()
Software::GetRpmInfo()
Software::GetSummary()
Software::GetVersion()
Software::IsInstalled()
Software::__destruct()

Inherited From Engine

Engine::__construct()
Engine::AddValidationError()
Engine::CheckValidationErrors()
Engine::CopyValidationErrors()
Engine::GetValidationErrors()
Engine::Log()
Engine::__destruct()

Class Constants

CONSTANT_ALL_PORTS = 0 (line 112)

CONSTANT_ALL_PROTOCOLS = "ALL" (line 113)

CONSTANT_AUTO = 1 (line 103)

CONSTANT_DISABLED = "disabled" (line 97)

CONSTANT_DMZ = "DMZIF" (line 109)

CONSTANT_ENABLED = "enabled" (line 96)

CONSTANT_EXTERNAL = "EXTIF" (line 108)

CONSTANT_GATEWAY = "gateway" (line 104)

CONSTANT_HOT_LAN = "HOTIF" (line 111)

CONSTANT_LAN = "LANIF" (line 110)

CONSTANT_MULTIPATH = "MULTIPATH" (line 114)

CONSTANT_NORMAL = "normal" (line 100)

CONSTANT_NOT_CONFIGURED = "notconfigured" (line 95)

CONSTANT_OFF = "off" (line 99)

CONSTANT_ON = "on" (line 98)

CONSTANT_ONE_TO_ONE_NAT_START = 200 (line 118)

CONSTANT_PORT_RANGE = "portrange" (line 102)

CONSTANT_PROTOCOL_TCP = "TCP" (line 116)

CONSTANT_PROTOCOL_UDP = "UDP" (line 115)

CONSTANT_SPECIAL = "special" (line 101)

CONSTANT_STANDALONE = "standalone" (line 105)

CONSTANT_TRUSTEDGATEWAY = "trustedgateway" (line 107)

CONSTANT_TRUSTEDSTANDALONE = "trustedstandalone" (line 106)

FILE_CONFIG = "/etc/firewall" (line 93)

FILE_CUSTOM_RULES = "/etc/rc.d/rc.firewall.local" (line 94)

Inherited Constants

Inherited from Daemon

Daemon::CMD_CHKCONFIG
Daemon::CMD_LS
Daemon::CMD_PIDOF
Daemon::CMD_SERVICE
Daemon::PATH_INITD

Inherited from Software

Software::COMMAND_RPM

Inherited from Engine

Engine::COMMAND_API

Documentation generated on Fri, 28 Aug 2009 20:32:05 -0400 by phpDocumentor 1.3.2

ClearFoundation

Class Firewall

Inherited Variables

Inherited Methods

Inherited Constants

Foundation

Software

Community

Contribute