397 lines
10 KiB
Bash
Executable File
397 lines
10 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -Eeuo pipefail
|
|
|
|
SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
|
|
PROJECT_DIR="$(cd -- "${SCRIPT_DIR}/.." && pwd)"
|
|
|
|
die() {
|
|
printf 'Erreur: %s\n' "$*" >&2
|
|
exit 1
|
|
}
|
|
|
|
usage() {
|
|
cat <<'USAGE'
|
|
Usage:
|
|
./scripts/add-port-forward.sh --external-port PORT --target IP --target-port PORT [options]
|
|
|
|
Options:
|
|
--external-port PORT Port expose sur l'adresse WAN pfSense.
|
|
--target IP IP de la machine interne.
|
|
--target-port PORT Port de destination sur la machine interne.
|
|
--protocol PROTO tcp, udp ou tcp/udp. Defaut: tcp
|
|
--interface IFACE Interface pfSense. Defaut: wan
|
|
--description TEXT Description de la regle.
|
|
--associated-rule MODE new, pass ou none. Defaut: new
|
|
--no-apply Cree la regle sans appliquer les changements.
|
|
-h, --help Affiche cette aide.
|
|
|
|
Exemple:
|
|
./scripts/add-port-forward.sh --external-port 8443 --target 192.168.1.50 --target-port 443 --protocol tcp
|
|
|
|
Sans argument, le script demande les valeurs manquantes en interactif.
|
|
USAGE
|
|
}
|
|
|
|
require_command() {
|
|
command -v "$1" >/dev/null 2>&1 || die "commande requise introuvable: $1"
|
|
}
|
|
|
|
load_env_file() {
|
|
if [[ -f "${PROJECT_DIR}/.env" ]]; then
|
|
set -a
|
|
# shellcheck disable=SC1091
|
|
. "${PROJECT_DIR}/.env"
|
|
set +a
|
|
fi
|
|
}
|
|
|
|
require_var() {
|
|
local name="$1"
|
|
[[ -n "${!name:-}" ]] || die "variable obligatoire manquante: $name"
|
|
}
|
|
|
|
is_interactive() {
|
|
[[ -t 0 && -t 1 ]]
|
|
}
|
|
|
|
arg_value() {
|
|
local option="$1"
|
|
local value="${2:-}"
|
|
|
|
[[ -n "$value" && "$value" != --* ]] || die "valeur manquante pour $option"
|
|
printf '%s' "$value"
|
|
}
|
|
|
|
prompt_required() {
|
|
local var_name="$1"
|
|
local label="$2"
|
|
local value=""
|
|
|
|
[[ -n "${!var_name:-}" ]] && return 0
|
|
is_interactive || die "variable obligatoire manquante: $var_name"
|
|
|
|
while [[ -z "$value" ]]; do
|
|
read -r -p "${label}: " value
|
|
done
|
|
|
|
printf -v "$var_name" '%s' "$value"
|
|
}
|
|
|
|
prompt_secret() {
|
|
local var_name="$1"
|
|
local label="$2"
|
|
local value=""
|
|
|
|
[[ -n "${!var_name:-}" ]] && return 0
|
|
is_interactive || die "variable obligatoire manquante: $var_name"
|
|
|
|
while [[ -z "$value" ]]; do
|
|
read -r -s -p "${label}: " value
|
|
printf '\n'
|
|
done
|
|
|
|
printf -v "$var_name" '%s' "$value"
|
|
}
|
|
|
|
prompt_default() {
|
|
local var_name="$1"
|
|
local label="$2"
|
|
local default_value="$3"
|
|
local value=""
|
|
|
|
[[ -n "${!var_name:-}" ]] && return 0
|
|
|
|
if ! is_interactive; then
|
|
printf -v "$var_name" '%s' "$default_value"
|
|
return 0
|
|
fi
|
|
|
|
read -r -p "${label} [${default_value}]: " value
|
|
printf -v "$var_name" '%s' "${value:-$default_value}"
|
|
}
|
|
|
|
prompt_bool() {
|
|
local var_name="$1"
|
|
local label="$2"
|
|
local default_value="$3"
|
|
local answer=""
|
|
|
|
[[ -n "${!var_name:-}" ]] && return 0
|
|
|
|
if ! is_interactive; then
|
|
printf -v "$var_name" '%s' "$default_value"
|
|
return 0
|
|
fi
|
|
|
|
while true; do
|
|
read -r -p "${label} [${default_value}]: " answer
|
|
answer="${answer:-$default_value}"
|
|
|
|
case "$answer" in
|
|
true|t|yes|y|oui|o|1)
|
|
printf -v "$var_name" 'true'
|
|
return 0
|
|
;;
|
|
false|f|no|n|non|0)
|
|
printf -v "$var_name" 'false'
|
|
return 0
|
|
;;
|
|
*)
|
|
printf 'Reponse attendue: true/false, oui/non ou y/n.\n' >&2
|
|
;;
|
|
esac
|
|
done
|
|
}
|
|
|
|
normalize_url() {
|
|
printf '%s' "${1%/}"
|
|
}
|
|
|
|
is_port() {
|
|
[[ "$1" =~ ^[0-9]+$ ]] && (( "$1" >= 1 && "$1" <= 65535 ))
|
|
}
|
|
|
|
is_ipv4() {
|
|
local ip="$1"
|
|
local IFS=.
|
|
local -a octets
|
|
|
|
[[ "$ip" =~ ^[0-9]+(\.[0-9]+){3}$ ]] || return 1
|
|
read -r -a octets <<< "$ip"
|
|
for octet in "${octets[@]}"; do
|
|
(( octet >= 0 && octet <= 255 )) || return 1
|
|
done
|
|
}
|
|
|
|
parse_args() {
|
|
PFSENSE_NAT_EXTERNAL_PORT="${PFSENSE_NAT_EXTERNAL_PORT:-}"
|
|
PFSENSE_NAT_TARGET="${PFSENSE_NAT_TARGET:-}"
|
|
PFSENSE_NAT_TARGET_PORT="${PFSENSE_NAT_TARGET_PORT:-}"
|
|
PFSENSE_NAT_PROTOCOL="${PFSENSE_NAT_PROTOCOL:-}"
|
|
PFSENSE_NAT_INTERFACE="${PFSENSE_NAT_INTERFACE:-}"
|
|
PFSENSE_NAT_DESCRIPTION="${PFSENSE_NAT_DESCRIPTION:-}"
|
|
PFSENSE_NAT_ASSOCIATED_RULE="${PFSENSE_NAT_ASSOCIATED_RULE:-}"
|
|
PFSENSE_NAT_APPLY="${PFSENSE_NAT_APPLY:-}"
|
|
|
|
while (($#)); do
|
|
case "$1" in
|
|
--external-port)
|
|
PFSENSE_NAT_EXTERNAL_PORT="$(arg_value "$1" "${2:-}")"
|
|
shift 2
|
|
;;
|
|
--target)
|
|
PFSENSE_NAT_TARGET="$(arg_value "$1" "${2:-}")"
|
|
shift 2
|
|
;;
|
|
--target-port)
|
|
PFSENSE_NAT_TARGET_PORT="$(arg_value "$1" "${2:-}")"
|
|
shift 2
|
|
;;
|
|
--protocol)
|
|
PFSENSE_NAT_PROTOCOL="$(arg_value "$1" "${2:-}")"
|
|
shift 2
|
|
;;
|
|
--interface)
|
|
PFSENSE_NAT_INTERFACE="$(arg_value "$1" "${2:-}")"
|
|
shift 2
|
|
;;
|
|
--description)
|
|
PFSENSE_NAT_DESCRIPTION="$(arg_value "$1" "${2:-}")"
|
|
shift 2
|
|
;;
|
|
--associated-rule)
|
|
PFSENSE_NAT_ASSOCIATED_RULE="$(arg_value "$1" "${2:-}")"
|
|
shift 2
|
|
;;
|
|
--no-apply)
|
|
PFSENSE_NAT_APPLY=false
|
|
shift
|
|
;;
|
|
-h|--help)
|
|
usage
|
|
exit 0
|
|
;;
|
|
*)
|
|
die "argument inconnu: $1"
|
|
;;
|
|
esac
|
|
done
|
|
}
|
|
|
|
prompt_missing_inputs() {
|
|
prompt_required PFSENSE_URL "URL pfSense, ex: https://pfsense.example.local"
|
|
prompt_required PFSENSE_USER "Utilisateur API pfSense"
|
|
prompt_secret PFSENSE_PASSWORD "Mot de passe API pfSense"
|
|
|
|
prompt_required PFSENSE_NAT_EXTERNAL_PORT "Port externe sur WAN"
|
|
prompt_required PFSENSE_NAT_TARGET "IP de la machine interne"
|
|
prompt_default PFSENSE_NAT_TARGET_PORT "Port interne cible" "$PFSENSE_NAT_EXTERNAL_PORT"
|
|
prompt_default PFSENSE_NAT_PROTOCOL "Protocole (tcp, udp, tcp/udp)" "tcp"
|
|
prompt_default PFSENSE_NAT_INTERFACE "Interface pfSense" "wan"
|
|
prompt_default PFSENSE_NAT_DESCRIPTION "Description" "Port forward API"
|
|
prompt_default PFSENSE_NAT_ASSOCIATED_RULE "Regle firewall associee (new, pass, none)" "new"
|
|
prompt_bool PFSENSE_NAT_APPLY "Appliquer immediatement les changements" "true"
|
|
}
|
|
|
|
validate_inputs() {
|
|
require_var PFSENSE_URL
|
|
require_var PFSENSE_USER
|
|
require_var PFSENSE_PASSWORD
|
|
|
|
is_port "$PFSENSE_NAT_EXTERNAL_PORT" || die "--external-port doit etre un port entre 1 et 65535"
|
|
is_port "$PFSENSE_NAT_TARGET_PORT" || die "--target-port doit etre un port entre 1 et 65535"
|
|
is_ipv4 "$PFSENSE_NAT_TARGET" || die "--target doit etre une adresse IPv4 valide"
|
|
|
|
case "$PFSENSE_NAT_PROTOCOL" in
|
|
tcp|udp|tcp/udp) ;;
|
|
*) die "--protocol doit valoir tcp, udp ou tcp/udp" ;;
|
|
esac
|
|
|
|
case "$PFSENSE_NAT_ASSOCIATED_RULE" in
|
|
new|pass) ;;
|
|
none) PFSENSE_NAT_ASSOCIATED_RULE="" ;;
|
|
*) die "--associated-rule doit valoir new, pass ou none" ;;
|
|
esac
|
|
|
|
case "$PFSENSE_NAT_APPLY" in
|
|
true|false) ;;
|
|
*) die "PFSENSE_NAT_APPLY doit valoir true ou false" ;;
|
|
esac
|
|
}
|
|
|
|
build_payload() {
|
|
jq -n \
|
|
--arg interface "$PFSENSE_NAT_INTERFACE" \
|
|
--arg protocol "$PFSENSE_NAT_PROTOCOL" \
|
|
--arg destination "${PFSENSE_NAT_INTERFACE}:ip" \
|
|
--arg destination_port "$PFSENSE_NAT_EXTERNAL_PORT" \
|
|
--arg target "$PFSENSE_NAT_TARGET" \
|
|
--arg local_port "$PFSENSE_NAT_TARGET_PORT" \
|
|
--arg descr "$PFSENSE_NAT_DESCRIPTION" \
|
|
--arg associated_rule_id "$PFSENSE_NAT_ASSOCIATED_RULE" \
|
|
'{
|
|
interface: $interface,
|
|
ipprotocol: "inet",
|
|
protocol: $protocol,
|
|
source: "any",
|
|
source_port: null,
|
|
destination: $destination,
|
|
destination_port: $destination_port,
|
|
target: $target,
|
|
local_port: $local_port,
|
|
disabled: false,
|
|
descr: $descr,
|
|
associated_rule_id: $associated_rule_id
|
|
}'
|
|
}
|
|
|
|
apply_firewall_changes() {
|
|
local apply_url="$1"
|
|
local response_file="$2"
|
|
local -a curl_args=(
|
|
--silent
|
|
--show-error
|
|
--location
|
|
--connect-timeout 10
|
|
--max-time 60
|
|
--request POST
|
|
--user "${PFSENSE_USER}:${PFSENSE_PASSWORD}"
|
|
--header "Accept: application/json"
|
|
--header "Content-Type: application/json"
|
|
--data '{}'
|
|
--output "$response_file"
|
|
--write-out "%{http_code}"
|
|
"$apply_url"
|
|
)
|
|
|
|
if [[ "${PFSENSE_INSECURE:-false}" == "true" ]]; then
|
|
curl_args=(--insecure "${curl_args[@]}")
|
|
fi
|
|
|
|
printf 'Application des changements firewall...\n'
|
|
|
|
local http_code
|
|
if ! http_code="$(curl "${curl_args[@]}")"; then
|
|
die "appel curl impossible vers l'endpoint firewall/apply"
|
|
fi
|
|
|
|
if [[ "$http_code" =~ ^2[0-9][0-9]$ ]]; then
|
|
printf 'Changements firewall appliques, code HTTP %s.\n' "$http_code"
|
|
jq . "$response_file" 2>/dev/null || sed -n '1,40p' "$response_file"
|
|
return 0
|
|
fi
|
|
|
|
printf 'Application refusee, code HTTP %s.\n' "$http_code" >&2
|
|
sed -n '1,40p' "$response_file" >&2
|
|
exit 1
|
|
}
|
|
|
|
main() {
|
|
require_command curl
|
|
require_command jq
|
|
load_env_file
|
|
parse_args "$@"
|
|
prompt_missing_inputs
|
|
validate_inputs
|
|
|
|
local base_url
|
|
local create_url
|
|
local apply_url
|
|
base_url="$(normalize_url "$PFSENSE_URL")"
|
|
create_url="${base_url}/api/v2/firewall/nat/port_forward?apply=false"
|
|
apply_url="${base_url}/api/v2/firewall/apply"
|
|
|
|
local create_response_file="/tmp/pfsense-nat-port-forward-create.$$"
|
|
local apply_response_file="/tmp/pfsense-nat-port-forward-apply.$$"
|
|
trap 'rm -f "$create_response_file" "$apply_response_file"' EXIT
|
|
|
|
local -a curl_args=(
|
|
--silent
|
|
--show-error
|
|
--location
|
|
--connect-timeout 10
|
|
--max-time 30
|
|
--request POST
|
|
--user "${PFSENSE_USER}:${PFSENSE_PASSWORD}"
|
|
--header "Accept: application/json"
|
|
--header "Content-Type: application/json"
|
|
--data "$(build_payload)"
|
|
--output "$create_response_file"
|
|
--write-out "%{http_code}"
|
|
"$create_url"
|
|
)
|
|
|
|
if [[ "${PFSENSE_INSECURE:-false}" == "true" ]]; then
|
|
curl_args=(--insecure "${curl_args[@]}")
|
|
fi
|
|
|
|
printf 'Creation redirection: %s:%s -> %s:%s/%s\n' \
|
|
"$PFSENSE_NAT_INTERFACE" \
|
|
"$PFSENSE_NAT_EXTERNAL_PORT" \
|
|
"$PFSENSE_NAT_TARGET" \
|
|
"$PFSENSE_NAT_TARGET_PORT" \
|
|
"$PFSENSE_NAT_PROTOCOL"
|
|
|
|
local http_code
|
|
if ! http_code="$(curl "${curl_args[@]}")"; then
|
|
die "appel curl impossible vers pfSense"
|
|
fi
|
|
|
|
if [[ "$http_code" =~ ^2[0-9][0-9]$ ]]; then
|
|
printf 'Redirection creee, code HTTP %s.\n' "$http_code"
|
|
jq . "$create_response_file" 2>/dev/null || sed -n '1,40p' "$create_response_file"
|
|
if [[ "$PFSENSE_NAT_APPLY" == "true" ]]; then
|
|
apply_firewall_changes "$apply_url" "$apply_response_file"
|
|
else
|
|
printf 'Changements non appliques: option --no-apply active.\n'
|
|
fi
|
|
exit 0
|
|
fi
|
|
|
|
printf 'Creation refusee, code HTTP %s.\n' "$http_code" >&2
|
|
sed -n '1,40p' "$create_response_file" >&2
|
|
exit 1
|
|
}
|
|
|
|
main "$@"
|