1654 lines
50 KiB
Plaintext
1654 lines
50 KiB
Plaintext
{*******************************************************}
|
|
{ }
|
|
{ ThdFirewall }
|
|
{ }
|
|
{ Copyright (C) 2022 kku }
|
|
{ }
|
|
{*******************************************************}
|
|
|
|
unit ThdFirewall;
|
|
|
|
interface
|
|
|
|
uses
|
|
Tocsg.Thread, System.SysUtils, System.Classes, Winapi.Windows,
|
|
Tocsg.Firewall, NetFwTypeLib_TLB;
|
|
|
|
type
|
|
TVpnFwConfg = record
|
|
bBlkExcept,
|
|
bBlkDefPort: Boolean;
|
|
nBlkExtPortType: Integer;
|
|
sBlkPorts,
|
|
sNetCtrlType,
|
|
sNetCtrlList,
|
|
sNetBlkExcept: String;
|
|
end;
|
|
|
|
TSleepFwConfg = record
|
|
sSleepList,
|
|
sSleepBlockType: String;
|
|
end;
|
|
|
|
TNetCtrlType = (nctFalse, nctAppBlack, nctAppWhite, nctIpBlack, nctIpWhite);
|
|
|
|
TThdFirewall = class(TTgThread)
|
|
protected
|
|
procedure Execute; override;
|
|
public
|
|
Constructor Create;
|
|
end;
|
|
|
|
implementation
|
|
|
|
uses
|
|
Tocsg.Exception, Tocsg.Safe, Winapi.ActiveX, Tocsg.Strings,
|
|
ManagerService, Tocsg.WTS, Tocsg.Path, ManagerModel, Tocsg.Convert,
|
|
Tocsg.Process, GlobalDefine, Condition, Tocsg.Network,
|
|
System.Generics.Collections, System.IniFiles, Tocsg.Url, Tocsg.Trace,
|
|
System.DateUtils;
|
|
|
|
const
|
|
// DEF_INTERNAL_PORT = '8261,8262,8263';
|
|
TOCSG_GROUP = 'Tocsg Group';
|
|
|
|
FW_NAME_POLICY_DEFAULT_INDIR = 'TocsgInternalIn';
|
|
FW_NAME_POLICY_DEFAULT_OUTDIR = 'TocsgInternalOut';
|
|
FW_NAME_POLICY_DEFAULTBLOCK_PORT = 'eCrmHomeEditionDefault';
|
|
FW_NAME_POLICY_EXTRABLOCK_PORT = 'eCrmHomeEditionExtra';
|
|
FW_NAME_POLICY_IDLE = 'eCrmHomeEditionIdle';
|
|
FW_NAME_POLICY_IDLE_SITE = 'eCrmHomeEditionSiteIdle';
|
|
FW_NAME_POLICY_IDLE_SITE2 = 'eCrmHomeEditionSiteIdl2';
|
|
FW_NAME_POLICY_CTRL = 'eCrmHomeEdition';
|
|
// FW_NAME_POLICY_BROWSER_CHROME = 'eCrmHomeEditionBchrome';
|
|
// FW_NAME_POLICY_BROWSER_EDGE = 'eCrmHomeEditionBedge';
|
|
// FW_NAME_POLICY_BROWSER_FIREFOX = 'eCrmHomeEditionBFirefox';
|
|
// FW_NAME_POLICY_BROWSER_IEXPLORER1 = 'eCrmHomeEditionBExplorer1';
|
|
// FW_NAME_POLICY_BROWSER_IEXPLORER2 = 'eCrmHomeEditionBExplorer2';
|
|
// FW_NAME_POLICY_BROWSER_OPERA = 'eCrmHomeEditionBOpera';
|
|
FW_NAME_POLICY_BROWSER_VIVALDI = 'eCrmHomeEditionBVivaldi';
|
|
|
|
{ TThreadFirewall }
|
|
|
|
function Get_POLICY_OUTBLOCK(aProtocol: Integer = NET_FW_IP_PROTOCOL_TCP): TFwRule;
|
|
begin
|
|
ZeroMemory(@Result, SizeOf(Result));
|
|
with Result do
|
|
begin
|
|
sGroup := TOCSG_GROUP;
|
|
sDesc := 'Open Product default protocols over ';
|
|
case aProtocol of
|
|
NET_FW_IP_PROTOCOL_TCP : sDesc := sDesc + 'TCP';
|
|
NET_FW_IP_PROTOCOL_UDP : sDesc := sDesc + 'UDP';
|
|
NET_FW_IP_PROTOCOL_ANY : sDesc := sDesc + 'TCP/UDP';
|
|
end;
|
|
|
|
nProtocol := aProtocol;
|
|
nProfiles := FW_PROFILE_ANY;
|
|
nAction := NET_FW_ACTION_BLOCK;
|
|
nDirection := NET_FW_RULE_DIR_OUT;
|
|
bEnabled := true;
|
|
end;
|
|
end;
|
|
|
|
//function Get_POLICY_DEFAULT_INDIR: TFwRule;
|
|
//begin
|
|
// Result := Get_POLICY_OUTBLOCK;
|
|
// with Result do
|
|
// begin
|
|
// sName := FW_NAME_POLICY_DEFAULT_INDIR;
|
|
// sGroup := TOCSG_GROUP;
|
|
// nAction := NET_FW_ACTION_ALLOW;
|
|
// nDirection := NET_FW_RULE_DIR_IN;
|
|
// sLocalPorts := DEF_INTERNAL_PORT;
|
|
// sRemotePorts := DEF_INTERNAL_PORT;
|
|
// end;
|
|
//end;
|
|
//
|
|
//function Get_POLICY_DEFAULT_OUTDIR: TFwRule;
|
|
//begin
|
|
// Result := Get_POLICY_OUTBLOCK;
|
|
// with Result do
|
|
// begin
|
|
// sName := FW_NAME_POLICY_DEFAULT_OUTDIR;
|
|
// sGroup := TOCSG_GROUP;
|
|
// nAction := NET_FW_ACTION_ALLOW;
|
|
// sLocalPorts := DEF_INTERNAL_PORT;
|
|
// sRemotePorts := DEF_INTERNAL_PORT;
|
|
// end;
|
|
//end;
|
|
|
|
function Get_POLICY_DEFAULTBLOCK_PORT: TFwRule;
|
|
begin
|
|
Result := Get_POLICY_OUTBLOCK;
|
|
with Result do
|
|
begin
|
|
sName := FW_NAME_POLICY_DEFAULTBLOCK_PORT;
|
|
sRemotePorts := '20,21,23,25,69,110,119,123,143,989,990,2501,5001,9100,9101,9102,9600';
|
|
end;
|
|
TTgTrace.T('기본 포트 차단 등록. Port=%s', [Result.sRemotePorts], 2);
|
|
|
|
if gMgSvc <> nil then
|
|
gMgSvc.SendEventLogEx(LOG_REG_BASIC_PORT_BLOCK, Result.sRemotePorts, false);
|
|
end;
|
|
|
|
function StrListToList(aStrList: String; aList: TStringList): Integer;
|
|
var
|
|
StrList: TStringList;
|
|
sVal: String;
|
|
i: Integer;
|
|
begin
|
|
Result := 0;
|
|
aList.Clear;
|
|
if aStrList = '' then
|
|
exit;
|
|
|
|
Guard(StrList, TStringList.Create);
|
|
sVal := StringReplace(aStrList, ';', '|', [rfReplaceAll]);
|
|
sVal := StringReplace(sVal, ' ', '|', [rfReplaceAll]);
|
|
Result := SplitString(sVal, '|', aList);
|
|
end;
|
|
|
|
function Get_POLICY_EXTRABLOCK_PORT(bAllPortBlk: Boolean = false): TFwRule;
|
|
var
|
|
sPort,
|
|
sBlkPorts: String;
|
|
i, c, nPos, nPortPos, nPortEnd: Integer;
|
|
SvrList: TStringList;
|
|
begin
|
|
if not bAllPortBlk then
|
|
begin
|
|
sBlkPorts := '';
|
|
if gMgSvc.ModePolicy.ExtraPortEnableType = PREF_PORTEX_WHITE then
|
|
begin
|
|
var StrList: TStringList;
|
|
Guard(StrList, TStringList.Create);
|
|
SplitString(StrListToCommaStr(gMgSvc.ModePolicy.BlockPortList), ',', StrList);
|
|
|
|
var PortList: TList<Integer>;
|
|
Guard(PortList, TList<Integer>.Create);
|
|
|
|
// 서버 접속 포트 예외 등록 22_0729 10:58:44 kku
|
|
Guard(SvrList, TStringList.Create);
|
|
GetDestServerList(SvrList);
|
|
nPortPos := 0;
|
|
for i := 0 to SvrList.Count - 1 do
|
|
begin
|
|
sPort := StringReplace(SvrList[i], 'https://', '', [rfReplaceAll]);
|
|
sPort := StringReplace(sPort, 'http://', '', [rfReplaceAll]);
|
|
nPos := Pos(':', sPort);
|
|
if nPos = 0 then
|
|
continue;
|
|
|
|
Delete(sPort, 1, nPos);
|
|
|
|
nPos := Pos('/', sPort);
|
|
if nPos = 0 then
|
|
continue;
|
|
|
|
SetLength(sPort, nPos - 1);
|
|
c := StrToIntDef(sPort, -1);
|
|
if (c <> -1) and (PortList.IndexOf(c) = -1) then
|
|
begin
|
|
PortList.Add(c);
|
|
Inc(nPortPos);
|
|
end;
|
|
end;
|
|
|
|
// 서버 사용 포트가 없다면 80을 기본 추가해준다. 22_0803 08:17:44 kku
|
|
if (nPortPos = 0) and (PortList.IndexOf(80) = -1) then
|
|
PortList.Add(80);
|
|
|
|
for i := 0 to StrList.Count - 1 do
|
|
begin
|
|
sPort := StrList[i];
|
|
nPos := Pos('-', sPort);
|
|
if nPos > 0 then
|
|
begin
|
|
nPortPos := StrToIntDef(Copy(sPort, 1, nPos - 1), -1);
|
|
Delete(sPort, 1, nPos);
|
|
nPortEnd := StrToIntDef(sPort, -1);
|
|
if (nPortPos > -1) and (nPortEnd > -1) and
|
|
(nPortPos < nPortEnd) then
|
|
begin
|
|
while nPortPos <= nPortEnd do
|
|
begin
|
|
if PortList.IndexOf(nPortPos) = -1 then
|
|
PortList.Add(nPortPos);
|
|
Inc(nPortPos);
|
|
end;
|
|
end;
|
|
end else begin
|
|
nPortPos := StrToIntDef(StrList[i], -1);
|
|
if (nPortPos <> -1) and (PortList.IndexOf(nPortPos) = -1) then
|
|
PortList.Add(nPortPos);
|
|
end;
|
|
end;
|
|
PortList.Sort;
|
|
|
|
// 0-65535
|
|
nPos := 0;
|
|
nPortPos := 0;
|
|
for i := 0 to PortList.Count - 1 do
|
|
begin
|
|
if (i <> (PortList.Count - 1)) and
|
|
(PortList[i + 1] = (PortList[i] + 1)) then
|
|
begin
|
|
if nPos = 0 then
|
|
begin
|
|
SumString(sBlkPorts, Format('%d-%d', [nPortPos, PortList[i] - 1]), ',');
|
|
nPortPos := PortList[i];
|
|
end;
|
|
|
|
Inc(nPos);
|
|
continue;
|
|
end;
|
|
|
|
if nPos <> 0 then
|
|
begin
|
|
Inc(nPortPos, nPos + 1);
|
|
nPos := 0;
|
|
end else
|
|
begin
|
|
if (PortList[i] <> 0) and ((PortList[i] - nPortPos) <> 1) then
|
|
begin
|
|
SumString(sBlkPorts, Format('%d-%d', [nPortPos, PortList[i] - 1]), ',');
|
|
end else
|
|
SumString(sBlkPorts, IntToStr(nPortPos), ',');
|
|
nPortPos := PortList[i] + 1;
|
|
end;
|
|
end;
|
|
|
|
Inc(nPortPos, nPos);
|
|
if nPortPos < 65535 then
|
|
SumString(sBlkPorts, Format('%d-65535', [nPortPos]), ',');
|
|
end else
|
|
sBlkPorts := StrListToCommaStr(gMgSvc.ModePolicy.BlockPortList, ',', true);
|
|
|
|
if sBlkPorts = '' then
|
|
sBlkPorts := '21';
|
|
end else
|
|
sBlkPorts := '*';
|
|
|
|
Result := Get_POLICY_OUTBLOCK;
|
|
with Result do
|
|
begin
|
|
sName := FW_NAME_POLICY_EXTRABLOCK_PORT;
|
|
sDesc := 'Prevent extra protocols over TCP';
|
|
sRemotePorts := sBlkPorts;
|
|
end;
|
|
TTgTrace.T('추가 포트 차단 등록. Port=%s', [Result.sRemotePorts], 2);
|
|
|
|
if gMgSvc <> nil then
|
|
gMgSvc.SendEventLogEx(LOG_REG_USER_PORT_BLOCK, Result.sRemotePorts, false);
|
|
end;
|
|
|
|
function Get_POLICY_POLICY_IDLE: TFwRule;
|
|
begin
|
|
Result := Get_POLICY_OUTBLOCK;
|
|
with Result do
|
|
begin
|
|
sName := FW_NAME_POLICY_IDLE;
|
|
sRemotePorts := '80,135,445,902,912,1025,1026,1027,1028,1041,1688,3838,5357,8443,23401';
|
|
end;
|
|
end;
|
|
|
|
function Get_POLICY_IDLE_SITE: TFwRule;
|
|
begin
|
|
Result := Get_POLICY_OUTBLOCK;
|
|
with Result do
|
|
begin
|
|
sName := FW_NAME_POLICY_IDLE_SITE;
|
|
sRemotePorts := '443,3478,3479,5938,8801,8802';
|
|
sRemoteAddresses := '193.1.1.1-255.255.255.255';
|
|
end;
|
|
end;
|
|
|
|
function Get_POLICY_IDLE_SITE2: TFwRule;
|
|
begin
|
|
Result := Get_POLICY_OUTBLOCK;
|
|
with Result do
|
|
begin
|
|
sName := FW_NAME_POLICY_IDLE_SITE2;
|
|
sRemotePorts := '443,3478,3479,5938,8801,8802';
|
|
sRemoteAddresses := '20.10.10.10-110.255.255.255';
|
|
end;
|
|
end;
|
|
|
|
function Get_POLICY_APP(sPath: String): TFwRule;
|
|
begin
|
|
Result := Get_POLICY_OUTBLOCK(NET_FW_IP_PROTOCOL_ANY);
|
|
with Result do
|
|
begin
|
|
sName := 'eCrmHE-B_' + ExtractFileName(CutFileExt(sPath));
|
|
sAppName := sPath;
|
|
sDesc := 'Prevent Network Access';
|
|
// sRemotePorts := '443,80,8080,8443,135,445,902,912,1025,1026,1027,1028,1688,3838,5357,23401';
|
|
end;
|
|
end;
|
|
|
|
function Get_POLICY_BROWSER_VIVALDI: TFwRule;
|
|
begin
|
|
Result := Get_POLICY_OUTBLOCK(NET_FW_IP_PROTOCOL_ANY);
|
|
with Result do
|
|
begin
|
|
sName := FW_NAME_POLICY_BROWSER_VIVALDI;
|
|
sAppName := Format('C:\Users\%s\AppData\Local\Programs\Opera\launcher.exe', [WTS_GetCurrentUserName]);
|
|
sRemotePorts := '443,80,8080,8443,135,445,902,912,1025,1026,1027,1028,1688,3838,5357,23401';
|
|
end;
|
|
end;
|
|
|
|
function GetSvrDestIpCommaStr: String;
|
|
var
|
|
EntList: TStringList;
|
|
i, nPos: Integer;
|
|
sVal: String;
|
|
begin
|
|
Result := '';
|
|
Guard(EntList, TStringList.Create);
|
|
GetDestServerList(EntList);
|
|
for i := 0 to EntList.Count - 1 do
|
|
begin
|
|
sVal := StringReplace(EntList[i], 'http://', '', [rfReplaceAll]);
|
|
sVal := StringReplace(sVal, 'https://', '', [rfReplaceAll]);
|
|
nPos := Pos(':', sVal);
|
|
if nPos > 0 then
|
|
Delete(sVal, nPos, Length(sVal) - nPos + 1);
|
|
if IsValidIP(sVal) then
|
|
SumString(Result, sVal, ',');
|
|
end;
|
|
end;
|
|
|
|
procedure ConvBlockIp(sIpCommaStr: String; aDestList: TStringList; bIgrSvrDest: Boolean = true);
|
|
var
|
|
sIp, sStart, sVal, sEnd: String;
|
|
SrcList,
|
|
EntList: TStringList;
|
|
i, ii, nPos: Integer;
|
|
dwIp,
|
|
dwNextIp: DWORD;
|
|
IpList: TList<DWORD>;
|
|
DcIpEx: TDictionary<DWORD,DWORD>;
|
|
|
|
dwBeginIp,
|
|
dwEnd: DWORD;
|
|
|
|
function GetIpRangeEnd(aIp: DWORD): DWORD;
|
|
var
|
|
c: Integer;
|
|
begin
|
|
if (DcIpEx.Count > 0) and DcIpEx.ContainsKey(aIp) then
|
|
begin
|
|
Result := GetIpRangeEnd(DcIpEx[aIp]);
|
|
DcIpEx.Remove(aIp);
|
|
while i < IpList.Count do
|
|
begin
|
|
aIp := IpList[i];
|
|
if aIp > Result then
|
|
break;
|
|
Inc(i);
|
|
end;
|
|
exit;
|
|
end;
|
|
|
|
c := 0;
|
|
while (i + c) < IpList.Count do
|
|
begin
|
|
dwNextIp := IpList[i + c];
|
|
if (aIp + c + 1) <> dwNextIp then
|
|
break;
|
|
if (DcIpEx.Count > 0) and DcIpEx.ContainsKey(aIp) then
|
|
begin
|
|
Result := GetIpRangeEnd(DcIpEx[aIp]);
|
|
exit;
|
|
end;
|
|
Inc(c);
|
|
end;
|
|
|
|
if c > 0 then
|
|
Inc(i, c)
|
|
else
|
|
Inc(i);
|
|
Result := aIp + c;
|
|
end;
|
|
|
|
begin
|
|
aDestList.Clear;
|
|
if sIpCommaStr = '' then
|
|
exit;
|
|
|
|
Guard(SrcList, TStringList.Create);
|
|
Guard(EntList, TStringList.Create);
|
|
SrcList.CommaText := sIpCommaStr;
|
|
if SrcList.Count = 0 then
|
|
exit;
|
|
|
|
// 서버 IP 정보도 예외 추가 22_0526 09:32:04 kku
|
|
if bIgrSvrDest then
|
|
begin
|
|
GetDestServerList(EntList);
|
|
for i := 0 to EntList.Count - 1 do
|
|
begin
|
|
sVal := StringReplace(EntList[i], 'http://', '', [rfReplaceAll]);
|
|
sVal := StringReplace(sVal, 'https://', '', [rfReplaceAll]);
|
|
nPos := Pos(':', sVal);
|
|
if nPos > 0 then
|
|
Delete(sVal, nPos, Length(sVal) - nPos + 1);
|
|
if IsValidIP(sVal) and (SrcList.IndexOf(sVal) = -1) then
|
|
SrcList.Add(sVal);
|
|
end;
|
|
end;
|
|
|
|
Guard(IpList, TList<DWORD>.Create);
|
|
Guard(DcIpEx, TDictionary<DWORD,DWORD>.Create);
|
|
for i := 0 to SrcList.Count - 1 do
|
|
begin
|
|
sIp := SrcList[i];
|
|
nPos := Pos('-', sIp);
|
|
if nPos > 0 then
|
|
begin
|
|
sEnd := Copy(sIp, nPos + 1, Length(sIp) - nPos);
|
|
Delete(sIp, nPos, Length(sIp) - nPos + 1);
|
|
if IsValidIP(sIp, false) and IsValidIP(sEnd) and
|
|
(IPToDWORD(sIp) < IPToDWORD(sEnd)) then
|
|
begin
|
|
dwIp := IPToDWORD(sIp);
|
|
if (IpList.IndexOf(dwIp) = -1) and not DcIpEx.ContainsKey(dwIp) then
|
|
begin
|
|
DcIpEx.Add(dwIp, IPToDWORD(sEnd));
|
|
IpList.Add(dwIp);
|
|
end;
|
|
end;
|
|
end else begin
|
|
dwIp := IPToDWORD(SrcList[i]);
|
|
if (dwIp <> 0) and (IpList.IndexOf(dwIp) = -1) then
|
|
IpList.Add(dwIp);
|
|
end;
|
|
end;
|
|
IpList.Sort;
|
|
|
|
sVal := '';
|
|
dwBeginIp := 0;
|
|
i := 0;
|
|
while i < IpList.Count do
|
|
begin
|
|
dwIp := IpList[i];
|
|
|
|
if dwBeginIp = dwIp then
|
|
begin
|
|
dwBeginIp := GetIpRangeEnd(dwIp) + 1;
|
|
continue;
|
|
end;
|
|
|
|
dwEnd := dwIp - 1;
|
|
|
|
if dwEnd = 0 then
|
|
sVal := DWORDToIP(dwBeginIp)
|
|
else
|
|
sVal := DWORDToIP(dwBeginIp) + '-' + DWORDToIP(dwEnd);
|
|
if aDestList.IndexOf(sVal) = -1 then
|
|
aDestList.Add(sVal);
|
|
|
|
dwBeginIp := GetIpRangeEnd(dwIp) + 1;
|
|
end;
|
|
|
|
sVal := DWORDToIP(dwBeginIp) + '-255.255.255.255';
|
|
if aDestList.IndexOf(sVal) = -1 then
|
|
aDestList.Add(sVal);
|
|
end;
|
|
|
|
{ TThdFirewall }
|
|
|
|
Constructor TThdFirewall.Create;
|
|
begin
|
|
Inherited Create;
|
|
if IsFirewallLowCheck then
|
|
Priority := tpLowest;
|
|
end;
|
|
|
|
procedure TThdFirewall.Execute;
|
|
const
|
|
SEC_URLIP_API = 5;
|
|
SEC_URLIP_NSLOOKUP = 300;
|
|
var
|
|
fwPolicy2: INetFwPolicy2;
|
|
fwRules: INetFwRules;
|
|
FwRuleList: TFwRuleEntList;
|
|
PrevVpnCfg, NewVpnCfg: TVpnFwConfg;
|
|
PrevSlpCfg, NewSlpCfg: TSleepFwConfg;
|
|
ExcpAppIpList,
|
|
FwRegAppList: TStringList;
|
|
ProcList: TProcessEntList;
|
|
CtrlType: TNetCtrlType;
|
|
bWhiteIp: Boolean; // APP 차단, APP만 허용에서 예외 IP 처리 시 화이트 리스트로 처리하도록 체크 22_0721 14:24:09 kku
|
|
|
|
// 도메인차단
|
|
dwUrlIpApiTick,
|
|
dwUrlIpNslookupTick: DWORD;
|
|
bUrlIpAdded: Boolean;
|
|
DcUrlIps: TDictionary<String,String>;
|
|
|
|
procedure ExtractUrlIps;
|
|
var
|
|
enum: TEnumerator<String>;
|
|
IpList,
|
|
ChkList: TStringList;
|
|
i: Integer;
|
|
dwTick: DWORD;
|
|
bDoNslookup: Boolean;
|
|
begin
|
|
try
|
|
if DcUrlIps.Count = 0 then
|
|
exit;
|
|
|
|
dwTick := GetTickCount;
|
|
if dwUrlIpApiTick = 0 then
|
|
begin
|
|
dwUrlIpApiTick := dwTick;
|
|
dwUrlIpNslookupTick := dwTick;
|
|
exit;
|
|
end;
|
|
|
|
bDoNslookup := ((dwTick - dwUrlIpNslookupTick) div 1000) >= SEC_URLIP_NSLOOKUP;
|
|
if bDoNslookup then
|
|
begin
|
|
dwUrlIpApiTick := dwTick;
|
|
dwUrlIpNslookupTick := dwTick;
|
|
end else begin
|
|
if ((dwTick - dwUrlIpApiTick) div 1000) < SEC_URLIP_API then
|
|
exit;
|
|
|
|
dwUrlIpApiTick := dwTick;
|
|
end;
|
|
|
|
Guard(IpList, TStringList.Create);
|
|
Guard(ChkList, TStringList.Create);
|
|
|
|
Guard(enum, DcUrlIps.Keys.GetEnumerator);
|
|
while enum.MoveNext do
|
|
begin
|
|
SplitString(DcUrlIps[enum.Current], ',', IpList);
|
|
|
|
if bDoNslookup then
|
|
SplitString(ExtractIPsFromUrl(enum.Current), ',', ChkList)
|
|
else
|
|
SplitString(GetHostIPsFromDomain(enum.Current), ',', ChkList);
|
|
|
|
for i := 0 to ChkList.Count - 1 do
|
|
if IpList.IndexOf(ChkList[i]) = -1 then
|
|
begin
|
|
DcUrlIps[enum.Current] := DcUrlIps[enum.Current] + ',' + ChkList[i];
|
|
_Trace('CatchIP .. URL=%s, IP=%s', [enum.Current, ChkList[i]], 2);
|
|
bUrlIpAdded := true;
|
|
end;
|
|
end;
|
|
except
|
|
on E: Exception do
|
|
ETgException.TraceException(Self, E, 'Fail .. ExtractUrlIps()');
|
|
end;
|
|
end;
|
|
|
|
function IsSameVpnCfg: Boolean;
|
|
begin
|
|
Result := false;
|
|
with PrevVpnCfg do
|
|
begin
|
|
if bBlkExcept <> NewVpnCfg.bBlkExcept then exit;
|
|
if bBlkDefPort <> NewVpnCfg.bBlkDefPort then exit;
|
|
if nBlkExtPortType <> NewVpnCfg.nBlkExtPortType then exit;
|
|
if sBlkPorts <> NewVpnCfg.sBlkPorts then exit;
|
|
if sNetCtrlType <> NewVpnCfg.sNetCtrlType then exit;
|
|
if sNetCtrlList <> NewVpnCfg.sNetCtrlList then exit;
|
|
if sNetBlkExcept <> NewVpnCfg.sNetBlkExcept then exit;
|
|
end;
|
|
Result := true;
|
|
end;
|
|
|
|
function IsSameSlpCfg: Boolean;
|
|
begin
|
|
Result := false;
|
|
with PrevSlpCfg do
|
|
begin
|
|
if sSleepList <> NewSlpCfg.sSleepList then exit;
|
|
if sSleepBlockType <> NewSlpCfg.sSleepBlockType then exit;
|
|
end;
|
|
Result := true;
|
|
end;
|
|
|
|
function CheckRuleState(aEnt: PFwRuleEnt; bIsOrgBlock: Boolean): Boolean;
|
|
begin
|
|
// 규칙이 있지만 꺼져있거나 연결 허용, 차단이 제대로 되어 있는 체크 22_0516 16:29:02 kku
|
|
Result := false;
|
|
if not aEnt.bEnabled then
|
|
exit;
|
|
|
|
if (aEnt.nAction = NET_FW_ACTION_ALLOW) and bIsOrgBlock then
|
|
exit;
|
|
|
|
if (aEnt.nAction = NET_FW_ACTION_BLOCK) and not bIsOrgBlock then
|
|
exit;
|
|
|
|
Result := true;
|
|
end;
|
|
|
|
function CheckRuleState2(aEnt: PFwRuleEnt; sIp: String): Boolean;
|
|
begin
|
|
// IP 차단 체크 전용
|
|
Result := false;
|
|
if not aEnt.bEnabled then
|
|
exit;
|
|
|
|
if aEnt.nAction <> NET_FW_ACTION_BLOCK then
|
|
exit;
|
|
|
|
if aEnt.sRemoteAddr <> sIp then
|
|
exit;
|
|
|
|
Result := true;
|
|
end;
|
|
|
|
procedure CheckAndRegApp;
|
|
var
|
|
i, c, n: Integer;
|
|
sPath,
|
|
sPName, sName,
|
|
sNameHead: String;
|
|
pEnt: PFwRuleEnt;
|
|
FwRule: TFwRule;
|
|
// DestList: TStringList;
|
|
begin
|
|
try
|
|
if FwRegAppList.Count = 0 then
|
|
exit;
|
|
|
|
// Guard(DestList, TStringList.Create);
|
|
sNameHead := 'eCrmHE-B_';
|
|
|
|
ProcList.UpdateProcessList;
|
|
case CtrlType of
|
|
nctAppBlack :
|
|
begin
|
|
for i := FwRegAppList.Count - 1 downto 0 do
|
|
begin
|
|
if Terminated or GetWorkStop then
|
|
exit;
|
|
|
|
sPName := FwRegAppList[i];
|
|
if CompareText(EXE_HE, sPName) = 0 then
|
|
continue;
|
|
|
|
pEnt := FwRuleList.GetFwRuleByName(sNameHead + CutFileExt(sPName));
|
|
if pEnt = nil then
|
|
begin
|
|
sPath := ProcList.GetProcPathByName(sPName);
|
|
if (sPath <> '') and FileExists(sPath) then
|
|
begin
|
|
FwRule := Get_POLICY_APP(sPath);
|
|
|
|
if ExcpAppIpList.Count > 0 then
|
|
FwRule.sRemoteAddresses := ExcpAppIpList.CommaText;
|
|
|
|
if AddFwRule(fwRules, FwRule) <> nil then
|
|
FwRuleList.AddAddedRule(FwRule); // 중복 실행된 프로세스가 있기 때문에 이렇게 추가 성공할 룰은 체크를 위해 바로 넣어줌
|
|
// FwRegAppList.Delete(i); // 계속 체크되도록 놔둠 22_0516 16:24:58 kku
|
|
Finalize(FwRule);
|
|
end;
|
|
end else begin
|
|
// FwRegAppList.Delete(i); // 계속 체크되도록 놔둠 22_0516 16:24:58 kku
|
|
|
|
// 설정이 훼손되었다면 지운다. 그러면 반복되며 다시 설정 됨 22_0516 16:37:10 kku
|
|
if not CheckRuleState(pEnt, true) then
|
|
RemoveFwRule(fwRules, pEnt.sName);
|
|
end;
|
|
end;
|
|
end;
|
|
nctAppWhite :
|
|
begin
|
|
for c := 0 to ProcList.Count - 1 do
|
|
begin
|
|
if Terminated or GetWorkStop then
|
|
exit;
|
|
|
|
sPName := ProcList[c].sModuleBaseName;
|
|
if FwRegAppList.IndexOf(sPName) = -1 then
|
|
begin
|
|
pEnt := FwRuleList.GetFwRuleByName(sNameHead + CutFileExt(sPName));
|
|
if pEnt = nil then
|
|
begin
|
|
sPath := ProcList[c].sModuleFileName;
|
|
if (sPath <> '') and FileExists(sPath) then
|
|
begin
|
|
FwRule := Get_POLICY_APP(sPath);
|
|
|
|
if bWhiteIp then
|
|
begin
|
|
if ExcpAppIpList.Count > 0 then
|
|
FwRule.sRemoteAddresses := ExcpAppIpList.CommaText;
|
|
end;
|
|
|
|
if AddFwRule(fwRules, FwRule) <> nil then
|
|
FwRuleList.AddAddedRule(FwRule); // 중복 실행된 프로세스가 있기 때문에 이렇게 추가 성공할 룰은 체크를 위해 바로 넣어줌
|
|
Finalize(FwRule);
|
|
end;
|
|
end else begin
|
|
// 설정이 훼손되었다면 지운다. 그러면 반복되며 다시 설정 됨 22_0516 16:37:10 kku
|
|
if not CheckRuleState(pEnt, true) then
|
|
RemoveFwRule(fwRules, pEnt.sName);
|
|
end;
|
|
end else
|
|
if not bWhiteIp and
|
|
(ExcpAppIpList.Count > 0) and
|
|
(CompareText(EXE_HE, sPName) <> 0) then
|
|
begin
|
|
// 예외 IP가 있다면 차단 등록한다 22_0602 17:46:05 kku
|
|
for n := 0 to ExcpAppIpList.Count - 1 do
|
|
begin
|
|
sName := StringReplace(ExcpAppIpList[n], '.', '', [rfReplaceAll]);
|
|
sName := StringReplace(sName, '-', '', [rfReplaceAll]);
|
|
sName := sNameHead + CutFileExt(sPName) + sName;
|
|
pEnt := FwRuleList.GetFwRuleByName(sName);
|
|
if pEnt = nil then
|
|
begin
|
|
sPath := ProcList[c].sModuleFileName;
|
|
if (sPath <> '') and FileExists(sPath) then
|
|
begin
|
|
FwRule := Get_POLICY_APP(sPath);
|
|
FwRule.sName := sName;
|
|
FwRule.sRemoteAddresses := ExcpAppIpList[n];
|
|
if AddFwRule(fwRules, FwRule) <> nil then
|
|
FwRuleList.AddAddedRule(FwRule);
|
|
Finalize(FwRule);
|
|
end;
|
|
end;
|
|
end;
|
|
end;
|
|
end;
|
|
end;
|
|
nctIpBlack :
|
|
begin
|
|
for c := 0 to ProcList.Count - 1 do
|
|
begin
|
|
if Terminated or GetWorkStop then
|
|
exit;
|
|
|
|
sPName := ProcList[c].sModuleBaseName;
|
|
if FwRegAppList.IndexOf(sPName) = -1 then
|
|
begin
|
|
for n := 0 to ExcpAppIpList.Count - 1 do
|
|
begin
|
|
sName := StringReplace(ExcpAppIpList[n], '.', '', [rfReplaceAll]);
|
|
sName := StringReplace(sName, '-', '', [rfReplaceAll]);
|
|
sName := sNameHead + CutFileExt(sPName) + sName;
|
|
pEnt := FwRuleList.GetFwRuleByName(sName);
|
|
if pEnt = nil then
|
|
begin
|
|
sPath := ProcList[c].sModuleFileName;
|
|
if (sPath <> '') and FileExists(sPath) then
|
|
begin
|
|
FwRule := Get_POLICY_APP(sPath);
|
|
FwRule.sName := sName;
|
|
FwRule.sRemoteAddresses := ExcpAppIpList[n];
|
|
if AddFwRule(fwRules, FwRule) <> nil then
|
|
FwRuleList.AddAddedRule(FwRule);
|
|
Finalize(FwRule);
|
|
end;
|
|
end;
|
|
end;
|
|
end;
|
|
end;
|
|
end;
|
|
nctIpWhite :
|
|
begin
|
|
for i := FwRegAppList.Count - 1 downto 0 do
|
|
begin
|
|
if Terminated or GetWorkStop then
|
|
exit;
|
|
|
|
sPName := FwRegAppList[i];
|
|
if CompareText(EXE_HE, sPName) = 0 then
|
|
continue;
|
|
|
|
pEnt := FwRuleList.GetFwRuleByName(sNameHead + CutFileExt(sPName));
|
|
if pEnt = nil then
|
|
begin
|
|
sPath := ProcList.GetProcPathByName(sPName);
|
|
if (sPath <> '') and FileExists(sPath) then
|
|
begin
|
|
FwRule := Get_POLICY_APP(sPath);
|
|
if AddFwRule(fwRules, FwRule) <> nil then
|
|
FwRuleList.AddAddedRule(FwRule);
|
|
Finalize(FwRule);
|
|
end;
|
|
end else begin
|
|
if not CheckRuleState(pEnt, true) then
|
|
RemoveFwRule(fwRules, pEnt.sName);
|
|
end;
|
|
end;
|
|
end;
|
|
end;
|
|
except
|
|
on E: Exception do
|
|
begin
|
|
ExcpAppIpList.Clear;
|
|
FwRegAppList.Clear;
|
|
ETgException.TraceException(E, 'Fail .. CheckAndRegApp()');
|
|
end;
|
|
end;
|
|
end;
|
|
|
|
procedure AddIpRangeToStrings(sRangeIp: String; aList: TStrings);
|
|
var
|
|
nPos, nRange: Integer;
|
|
i, nBegin: Integer;
|
|
IpClass: TStringList;
|
|
sIp: String;
|
|
begin
|
|
nPos := Pos('/', sRangeIp);
|
|
if nPos = 0 then
|
|
exit;
|
|
|
|
nRange := StrToIntDef(Copy(sRangeIp, nPos + 1, Length(sRangeIp) - nPos), 0);
|
|
|
|
Delete(sRangeIp, nPos, Length(sRangeIp) - nPos + 1);
|
|
if not IsValidIP(sRangeIp) then
|
|
exit;
|
|
|
|
if nRange = 0 then
|
|
begin
|
|
if aList.IndexOf(sRangeIp) = -1 then
|
|
aList.Add(sRangeIp);
|
|
exit;
|
|
end;
|
|
|
|
if nRange > 255 then
|
|
nRange := 255;
|
|
|
|
Guard(IpClass, TStringList.Create);
|
|
if SplitString(sRangeIp, '.', IpClass) > 3 then
|
|
begin
|
|
nBegin := StrToIntDef(IpClass[3], 999);
|
|
if nBegin >= nRange then
|
|
begin
|
|
// 범위 체크
|
|
if aList.IndexOf(sRangeIp) = -1 then
|
|
aList.Add(sRangeIp);
|
|
exit;
|
|
end;
|
|
|
|
for i := 0 to (nRange - nBegin) do
|
|
begin
|
|
sIp := Format('%s.%s.%s.%d', [IpClass[0], IpClass[1], IpClass[2], nBegin + i]);
|
|
if aList.IndexOf(sIp) = -1 then
|
|
aList.Add(sIp);
|
|
|
|
if (nBegin + i) = 255 then
|
|
break;
|
|
end;
|
|
end;
|
|
end;
|
|
|
|
function ConvIpRangeToFwIps(sRangeIp: String; bIgrSvrIp: Boolean = false): String;
|
|
var
|
|
nPos, nRange: Integer;
|
|
i, nBegin: Integer;
|
|
IpClass: TStringList;
|
|
sIp, sSvrIp: String;
|
|
begin
|
|
Result := '';
|
|
|
|
nPos := Pos('/', sRangeIp);
|
|
if nPos = 0 then
|
|
exit;
|
|
|
|
nRange := StrToIntDef(Copy(sRangeIp, nPos + 1, Length(sRangeIp) - nPos), 0);
|
|
Delete(sRangeIp, nPos, Length(sRangeIp) - nPos + 1);
|
|
if not IsValidIP(sRangeIp) then
|
|
exit;
|
|
|
|
if nRange = 0 then
|
|
begin
|
|
Result := sRangeIp;
|
|
exit;
|
|
end;
|
|
|
|
if nRange > 255 then
|
|
nRange := 255;
|
|
|
|
Guard(IpClass, TStringList.Create);
|
|
if SplitString(sRangeIp, '.', IpClass) > 3 then
|
|
begin
|
|
if StrToIntDef(IpClass[3], 999) < nRange then
|
|
begin
|
|
Result := sRangeIp + '-' + Format('%s.%s.%s.%d', [IpClass[0], IpClass[1], IpClass[2], nRange])
|
|
end else
|
|
Result := sRangeIp;
|
|
|
|
if bIgrSvrIp then
|
|
begin
|
|
// 현재 접속중인 서버 IP만 빼주자 22_0607 13:17:18 kku
|
|
sSvrIp := StringReplace(gMgSvc.DestServerUrl, 'http://', '', [rfReplaceAll]);
|
|
sSvrIp := StringReplace(sSvrIp, 'https://', '', [rfReplaceAll]);
|
|
nPos := Pos(':', sSvrIp);
|
|
if nPos > 0 then
|
|
Delete(sSvrIp, nPos, Length(sSvrIp) - nPos + 1);
|
|
|
|
if IsValidIP(sSvrIp) then
|
|
begin
|
|
nBegin := StrToIntDef(IpClass[3], 999);
|
|
if nBegin >= nRange then
|
|
begin
|
|
Result := sRangeIp;
|
|
exit;
|
|
end;
|
|
|
|
for i := 0 to (nRange - nBegin) do
|
|
begin
|
|
sIp := Format('%s.%s.%s.%d', [IpClass[0], IpClass[1], IpClass[2], nBegin + i]);
|
|
if sIp = sSvrIp then
|
|
begin
|
|
if i = 0 then
|
|
begin
|
|
Result := Format('%s.%s.%s.%d-%s.%s.%s.%d',
|
|
[IpClass[0], IpClass[1], IpClass[2], nBegin + 1,
|
|
IpClass[0], IpClass[1], IpClass[2], nRange]);
|
|
end else
|
|
if i = (nRange - nBegin) then
|
|
begin
|
|
Result := Format('%s.%s.%s.%d-%s.%s.%s.%d',
|
|
[IpClass[0], IpClass[1], IpClass[2], nBegin,
|
|
IpClass[0], IpClass[1], IpClass[2], nRange - 1]);
|
|
end else
|
|
begin
|
|
Result := Format('%s.%s.%s.%d-%s.%s.%s.%d,',
|
|
[IpClass[0], IpClass[1], IpClass[2], nBegin,
|
|
IpClass[0], IpClass[1], IpClass[2], nBegin + i - 1]);
|
|
Result := Result + Format('%s.%s.%s.%d-%s.%s.%s.%d',
|
|
[IpClass[0], IpClass[1], IpClass[2], nBegin +i + 1,
|
|
IpClass[0], IpClass[1], IpClass[2], nRange]);
|
|
end;
|
|
break;
|
|
end;
|
|
|
|
if (nBegin + i) = 255 then
|
|
begin
|
|
Result := sRangeIp + '-' + Format('%s.%s.%s.%d', [IpClass[0], IpClass[1], IpClass[2], nRange]);
|
|
break;
|
|
end;
|
|
end;
|
|
end;
|
|
end;
|
|
end;
|
|
end;
|
|
|
|
procedure ProcessNetCtrl(aCtrlList, aExcpList: String);
|
|
var
|
|
FwRule: TFwRule;
|
|
sIp,
|
|
sEnt,
|
|
sEnd,
|
|
sName,
|
|
sFwName: String;
|
|
pEnt: PFwRuleEnt;
|
|
|
|
TempList,
|
|
DestList,
|
|
ExcpList: TStringList;
|
|
i, c, n: Integer;
|
|
begin
|
|
Guard(TempList, TStringList.Create);
|
|
Guard(ExcpList, TStringList.Create);
|
|
bWhiteIp := aExcpList.StartsWith('@WHITEIP:');
|
|
ExcpList.CommaText := StrListToCommaStr(aExcpList);
|
|
|
|
case CtrlType of
|
|
nctFalse : ;
|
|
nctAppBlack,
|
|
nctAppWhite :
|
|
begin
|
|
if FwRegAppList.Count > 0 then
|
|
exit;
|
|
|
|
FwRegAppList.CommaText := StrListToCommaStr(aCtrlList);
|
|
if CtrlType = nctAppWhite then
|
|
begin
|
|
FwRegAppList.Add(EXE_HE); // 나 추가
|
|
FwRegAppList.Add(EXE_MG); // 나 추가
|
|
FwRegAppList.Add('svchost.exe'); // 이거까지 차단하면 DNS 서비스 동작이 멈춘다 22_0524 13:10:30 kku
|
|
FwRegAppList.Add('MsMpEng.exe'); // 디펜더 관련
|
|
|
|
for i := 0 to ExcpList.Count - 1 do
|
|
begin
|
|
sEnt := ExcpList[i];
|
|
if (UpperCase(GetFileExt(sEnt)) = 'EXE') and
|
|
(FwRegAppList.IndexOf(sEnt) = -1) then
|
|
begin
|
|
FwRegAppList.Add(sEnt)
|
|
end else
|
|
if sEnt.Contains('/') then
|
|
begin
|
|
// IP 범위 체크, 추가
|
|
AddIpRangeToStrings(sEnt, ExcpAppIpList);
|
|
end else
|
|
if IsValidIpRange(sEnt) then
|
|
begin
|
|
// IP 범위 체크, 추가 22_0825 15:57:05 kku
|
|
if ExcpAppIpList.IndexOf(sEnt) = -1 then
|
|
ExcpAppIpList.Add(sEnt);
|
|
end else begin
|
|
if IsValidIP(sEnt) then
|
|
begin
|
|
if ExcpAppIpList.IndexOf(sEnt) = -1 then
|
|
ExcpAppIpList.Add(sEnt);
|
|
end else begin
|
|
// URL에서 IP 추출 22_0915 08:54:12 kku
|
|
if not DcUrlIps.ContainsKey(sEnt) then
|
|
begin
|
|
sIp := ExtractIPsFromUrl(sEnt);
|
|
DcUrlIps.Add(sEnt, sIp);
|
|
end else
|
|
sIp := DcUrlIps[sEnt];
|
|
|
|
if sIp <> '' then
|
|
begin
|
|
SplitString(sIp, ',', TempList);
|
|
for c := 0 to TempList.Count - 1 do
|
|
if ExcpAppIpList.IndexOf(TempList[c]) = -1 then
|
|
ExcpAppIpList.Add(TempList[c]);
|
|
end;
|
|
end;
|
|
end;
|
|
end;
|
|
|
|
// 후처리 22_0804 14:48:41 kku
|
|
if bWhiteIp and (ExcpAppIpList.Count > 0) then
|
|
ConvBlockIp(ExcpAppIpList.CommaText, ExcpAppIpList, false);
|
|
end else
|
|
if CtrlType = nctAppBlack then
|
|
begin
|
|
for i := 0 to ExcpList.Count - 1 do
|
|
begin
|
|
sEnt := ExcpList[i];
|
|
if UpperCase(GetFileExt(sEnt)) = 'EXE' then
|
|
begin
|
|
c := FwRegAppList.IndexOf(sEnt);
|
|
if c <> -1 then
|
|
FwRegAppList.Delete(c);
|
|
end else
|
|
if sEnt.Contains('/') then
|
|
begin
|
|
// IP 범위 체크, 추가
|
|
AddIpRangeToStrings(sEnt, ExcpAppIpList);
|
|
end else
|
|
if IsValidIpRange(sEnt) then
|
|
begin
|
|
// IP 범위 체크, 추가 22_0825 15:57:05 kku
|
|
if ExcpAppIpList.IndexOf(sEnt) = -1 then
|
|
ExcpAppIpList.Add(sEnt);
|
|
end else
|
|
begin
|
|
if IsValidIP(sEnt) then
|
|
begin
|
|
if ExcpAppIpList.IndexOf(sEnt) = -1 then
|
|
ExcpAppIpList.Add(sEnt);
|
|
end else begin
|
|
// URL에서 IP 추출 22_0915 08:54:12 kku
|
|
if not DcUrlIps.ContainsKey(sEnt) then
|
|
begin
|
|
sIp := ExtractIPsFromUrl(sEnt);
|
|
DcUrlIps.Add(sEnt, sIp);
|
|
end else
|
|
sIp := DcUrlIps[sEnt];
|
|
|
|
if sIp <> '' then
|
|
begin
|
|
SplitString(sIp, ',', TempList);
|
|
for c := 0 to TempList.Count - 1 do
|
|
if ExcpAppIpList.IndexOf(TempList[c]) = -1 then
|
|
ExcpAppIpList.Add(TempList[c]);
|
|
end;
|
|
end;
|
|
end;
|
|
end;
|
|
|
|
c := FwRegAppList.IndexOf(EXE_HE);
|
|
if c <> -1 then
|
|
FwRegAppList.Delete(c);
|
|
|
|
// 후처리 22_0804 14:48:41 kku
|
|
if ExcpAppIpList.Count > 0 then
|
|
ConvBlockIp(ExcpAppIpList.CommaText, ExcpAppIpList, false);
|
|
end;
|
|
CheckAndRegApp;
|
|
end;
|
|
nctIpBlack :
|
|
begin
|
|
Guard(DestList, TStringList.Create);
|
|
DestList.CommaText := StrListToCommaStr(aCtrlList);
|
|
|
|
if (aExcpList <> '') and aExcpList.ToUpper.Contains('.EXE') then
|
|
begin
|
|
// APP 예외 정책이 있으면
|
|
if FwRegAppList.Count = 0 then
|
|
begin
|
|
ExcpAppIpList.Clear;
|
|
for i := 0 to DestList.Count - 1 do
|
|
begin
|
|
sEnt := DestList[i];
|
|
if sEnt.Contains('/') then
|
|
begin
|
|
sIp := ConvIpRangeToFwIps(sEnt);
|
|
if sIp <> '' then
|
|
ExcpAppIpList.Add(sIp);
|
|
end else
|
|
if IsValidIpRange(sEnt) then
|
|
begin
|
|
sIp := sEnt;
|
|
n := Pos('-', sIp);
|
|
if n > 0 then
|
|
begin
|
|
sEnd := Copy(sIp, n + 1, Length(sIp) - n);
|
|
Delete(sIp, n, Length(sIp) - n + 1);
|
|
if IsValidIP(sIp, false) and IsValidIP(sEnd) and
|
|
(IPToDWORD(sIp) < IPToDWORD(sEnd)) then
|
|
ExcpAppIpList.Add(sEnt);
|
|
end;
|
|
end else begin
|
|
if IsValidIP(sEnt) then
|
|
begin
|
|
if ExcpAppIpList.IndexOf(sEnt) = -1 then
|
|
ExcpAppIpList.Add(sEnt);
|
|
end else begin
|
|
// URL에서 IP 추출 22_0915 08:54:12 kku
|
|
if not DcUrlIps.ContainsKey(sEnt) then
|
|
begin
|
|
sIp := ExtractIPsFromUrl(sEnt);
|
|
DcUrlIps.Add(sEnt, sIp);
|
|
end else
|
|
sIp := DcUrlIps[sEnt];
|
|
|
|
if sIp <> '' then
|
|
begin
|
|
SplitString(sIp, ',', TempList);
|
|
for c := 0 to TempList.Count - 1 do
|
|
if ExcpAppIpList.IndexOf(TempList[c]) = -1 then
|
|
ExcpAppIpList.Add(TempList[c]);
|
|
end;
|
|
end;
|
|
end;
|
|
end;
|
|
|
|
FwRegAppList.Add(EXE_HE);
|
|
FwRegAppList.Add(EXE_MG);
|
|
DestList.CommaText := StrListToCommaStr(aExcpList);
|
|
for i := 0 to DestList.Count - 1 do
|
|
begin
|
|
if DestList[i].ToUpper.Contains('.EXE') and
|
|
(FwRegAppList.IndexOf(DestList[i]) = -1) then
|
|
FwRegAppList.Add(DestList[i]);
|
|
end;
|
|
CheckAndRegApp;
|
|
end;
|
|
exit;
|
|
end;
|
|
|
|
sName := FW_NAME_POLICY_CTRL + 'B_Ips';
|
|
// pEnt := FwRuleList.GetFwRuleByName(sName);
|
|
|
|
for i := 0 to ExcpList.Count - 1 do
|
|
begin
|
|
c := DestList.IndexOf(ExcpList[i]);
|
|
if c <> -1 then
|
|
DestList.Delete(c);
|
|
end;
|
|
|
|
for i := 0 to DestList.Count - 1 do
|
|
begin
|
|
sIp := DestList[i];
|
|
if sIp.Contains('/') then
|
|
begin
|
|
sIp := ConvIpRangeToFwIps(sIp, true);
|
|
if sIp = '' then
|
|
continue;
|
|
end else
|
|
if IsValidIpRange(sIp) then
|
|
begin
|
|
// IsValidIpRange() 여기서 체크하는걸로 수정 22_1011 14:05:04 kku
|
|
// 아래에서 할거 없음
|
|
|
|
// n := Pos('-', sIp);
|
|
// if n > 0 then
|
|
// begin
|
|
// sEnd := Copy(sIp, n + 1, Length(sIp) - n);
|
|
// Delete(sIp, n, Length(sIp) - n + 1);
|
|
// if not IsValidIP(sIp, false) or not IsValidIP(sEnd) or
|
|
// (IPToDWORD(sIp) >= IPToDWORD(sEnd)) then
|
|
// continue;
|
|
//
|
|
// sIp := DestList[i];
|
|
// end;
|
|
end else begin
|
|
if not IsValidIP(sIp) then
|
|
begin
|
|
sEnt := sIp;
|
|
|
|
if not DcUrlIps.ContainsKey(sEnt) then
|
|
begin
|
|
sIp := ExtractIPsFromUrl(sEnt);
|
|
DcUrlIps.Add(sEnt, sIp);
|
|
end else
|
|
sIp := DcUrlIps[sEnt];
|
|
|
|
if sIp = '' then
|
|
continue;
|
|
end;
|
|
end;
|
|
|
|
sFwName := sName + IntToStr(i + 1);
|
|
pEnt := FwRuleList.GetFwRuleByName(sFwName);
|
|
if (pEnt = nil) or not CheckRuleState(pEnt, true) then
|
|
begin
|
|
if pEnt <> nil then
|
|
begin
|
|
RemoveFwRule(fwRules, sFwName);
|
|
FwRuleList.RemoveAddedRule(sFwName);
|
|
end;
|
|
|
|
FwRule := Get_POLICY_OUTBLOCK(NET_FW_IP_PROTOCOL_ANY);
|
|
FwRule.sName := sFwName;
|
|
FwRule.sRemoteAddresses := sIp; // StrListToCommaStr(aCtrlList);
|
|
if AddFwRule(fwRules, FwRule) <> nil then
|
|
FwRuleList.AddAddedRule(FwRule);
|
|
Finalize(FwRule);
|
|
end;
|
|
end;
|
|
end;
|
|
nctIpWhite :
|
|
begin
|
|
var DestTempList, ExcpTempList: TStringList;
|
|
Guard(DestTempList, TStringList.Create);
|
|
Guard(ExcpTempList, TStringList.Create);
|
|
Guard(DestList, TStringList.Create);
|
|
DestList.CommaText := StrListToCommaStr(aCtrlList);
|
|
|
|
for i := 0 to DestList.Count - 1 do
|
|
begin
|
|
// 범위 지정 처리등
|
|
sIp := DestList[i];
|
|
if sIp.Contains('/') then
|
|
begin
|
|
AddIpRangeToStrings(sIp, DestTempList);
|
|
end else
|
|
if IsValidIpRange(sIp) then
|
|
begin
|
|
// IP 범위 체크, 추가 22_0825 15:57:05 kku
|
|
if DestTempList.IndexOf(sIp) = -1 then
|
|
DestTempList.Add(sIp);
|
|
end else begin
|
|
if IsValidIP(sIp) then
|
|
begin
|
|
if DestTempList.IndexOf(sIp) = -1 then
|
|
DestTempList.Add(sIp);
|
|
end else begin
|
|
// URL에서 IP 추출 22_0915 08:54:12 kku
|
|
sEnt := sIp;
|
|
if not DcUrlIps.ContainsKey(sEnt) then
|
|
begin
|
|
sIp := ExtractIPsFromUrl(sEnt);
|
|
DcUrlIps.Add(sEnt, sIp);
|
|
end else
|
|
sIp := DcUrlIps[sEnt];
|
|
|
|
if sIp <> '' then
|
|
begin
|
|
SplitString(sIp, ',', TempList);
|
|
for c := 0 to TempList.Count - 1 do
|
|
if DestTempList.IndexOf(TempList[c]) = -1 then
|
|
DestTempList.Add(TempList[c]);
|
|
end;
|
|
end;
|
|
end;
|
|
end;
|
|
|
|
for i := 0 to ExcpList.Count - 1 do
|
|
begin
|
|
// 예외처리
|
|
sIp := ExcpList[i];
|
|
if sIp.Contains('/') then
|
|
begin
|
|
AddIpRangeToStrings(sIp, ExcpTempList);
|
|
for c := 0 to ExcpTempList.Count - 1 do
|
|
begin
|
|
n := DestTempList.IndexOf(ExcpTempList[c]);
|
|
if n <> -1 then
|
|
DestTempList.Delete(n);
|
|
end;
|
|
end else
|
|
if IsValidIpRange(sIp) then
|
|
begin
|
|
if ExcpTempList.IndexOf(sIp) = -1 then
|
|
ExcpTempList.Add(sIp);
|
|
end else
|
|
begin
|
|
n := DestTempList.IndexOf(sIp);
|
|
if n <> -1 then
|
|
DestTempList.Delete(n);
|
|
end;
|
|
end;
|
|
|
|
ConvBlockIp(DestTempList.CommaText, DestList);
|
|
if DestList.Count = 0 then
|
|
exit;
|
|
|
|
// FwRule.sRemoteAddresses := DestList.CommaText; 이렇게 한꺼번에 지정해도 된다.
|
|
// 일단 원안대로 이렇게 따로 등록함. 22_0517 08:33:23 kku
|
|
for i := 0 to DestList.Count - 1 do
|
|
begin
|
|
sIp := DestList[i];
|
|
sName := StringReplace(sIp, '-', '', [rfReplaceAll]);
|
|
sName := StringReplace(sName, '.', '', [rfReplaceAll]);
|
|
sName := 'eCrmHE-' + sName;
|
|
pEnt := FwRuleList.GetFwRuleByName(sName);
|
|
if (pEnt = nil) or not CheckRuleState2(pEnt, sIp) then
|
|
begin
|
|
if pEnt <> nil then
|
|
begin
|
|
RemoveFwRule(fwRules, pEnt.sName);
|
|
FwRuleList.RemoveAddedRule(pEnt.sName);
|
|
end;
|
|
|
|
FwRule := Get_POLICY_OUTBLOCK(NET_FW_IP_PROTOCOL_ANY);
|
|
FwRule.sName := sName;
|
|
FwRule.nAction := NET_FW_ACTION_BLOCK;
|
|
FwRule.sRemoteAddresses := sIp;
|
|
if AddFwRule(fwRules, FwRule) <> nil then
|
|
FwRuleList.AddAddedRule(FwRule);
|
|
Finalize(FwRule);
|
|
end;
|
|
end;
|
|
|
|
if (aExcpList <> '') and aExcpList.ToUpper.Contains('.EXE') then
|
|
begin
|
|
// APP 예외 정책이 있으면
|
|
if FwRegAppList.Count = 0 then
|
|
begin
|
|
ExcpAppIpList.Clear;
|
|
DestList.CommaText := StrListToCommaStr(aExcpList);
|
|
for i := 0 to DestList.Count - 1 do
|
|
begin
|
|
if DestList[i].ToUpper.Contains('.EXE') and
|
|
(FwRegAppList.IndexOf(DestList[i]) = -1) and
|
|
(CompareText(EXE_HE, DestList[i]) <> 0) and
|
|
(CompareText(EXE_MG, DestList[i]) <> 0) then
|
|
FwRegAppList.Add(DestList[i]);
|
|
end;
|
|
CheckAndRegApp;
|
|
end;
|
|
end;
|
|
end;
|
|
end;
|
|
end;
|
|
|
|
var
|
|
pCheckEnt: PFwRuleEnt;
|
|
i: Integer;
|
|
bPrevUnsafeMode: Boolean;
|
|
dwTick,
|
|
dwFwCheckTick,
|
|
dwSleepMSec,
|
|
dwSleepLowMSec: DWORD;
|
|
PO: TPrefModel;
|
|
|
|
procedure LoadForceSetting;
|
|
var
|
|
ini: TIniFile;
|
|
sPath: String;
|
|
begin
|
|
try
|
|
sPath := GetProgramFilesDir + DIR_TG + INI_FORCEHE;
|
|
if FileExists(sPath) then
|
|
begin
|
|
Guard(ini, TIniFile.Create(sPath));
|
|
dwSleepMSec := ini.ReadInteger('Force', 'FwInterval', 2) * 1000;
|
|
dwSleepLowMSec := ini.ReadInteger('Force', 'FwLowDelay', 180) * 1000;
|
|
end;
|
|
except
|
|
dwSleepMSec := 2000;
|
|
dwSleepLowMSec := 180000;
|
|
end;
|
|
end;
|
|
|
|
begin
|
|
ZeroMemory(@PrevVpnCfg, SizeOf(PrevVpnCfg));
|
|
ZeroMemory(@NewVpnCfg, SizeOf(NewVpnCfg));
|
|
Guard(ExcpAppIpList, TStringList.Create);
|
|
ExcpAppIpList.CaseSensitive := false;
|
|
Guard(FwRegAppList, TStringList.Create);
|
|
FwRegAppList.CaseSensitive := false;
|
|
Guard(ProcList, TProcessEntList.Create);
|
|
ProcList.DetailInfo := false;
|
|
Guard(DcUrlIps, TDictionary<String,String>.Create);
|
|
dwUrlIpApiTick := 0;
|
|
dwUrlIpNslookupTick := 0;
|
|
|
|
if IsFirewallLowCheck then
|
|
dwSleepMSec := 5000
|
|
else
|
|
dwSleepMSec := 2000;
|
|
dwSleepLowMSec := 180000;
|
|
LoadForceSetting;
|
|
|
|
CoInitialize(nil);
|
|
try
|
|
fwPolicy2 := CoNetFwPolicy2.Create;
|
|
if fwPolicy2 = nil then
|
|
begin
|
|
{$IFDEF DEBUG}
|
|
ASSERT(false);
|
|
{$ELSE}
|
|
nLastError_ := 1;
|
|
_Trace('Fail .. Windows Defender - No Firewall Setting Info 11');
|
|
{$ENDIF}
|
|
exit;
|
|
end;
|
|
|
|
fwRules := fwPolicy2.Rules;
|
|
if fwRules = nil then
|
|
begin
|
|
{$IFDEF DEBUG}
|
|
ASSERT(false);
|
|
{$ELSE}
|
|
nLastError_ := 2;
|
|
_Trace('Fail .. Windows Defender - No Firewall Setting Info 22');
|
|
{$ENDIF}
|
|
exit;
|
|
end;
|
|
|
|
ClearCrmFwPolicy(fwRules);
|
|
Guard(FwRuleList, TFwRuleEntList.Create);
|
|
|
|
dwFwCheckTick := 0;
|
|
bPrevUnsafeMode := false;
|
|
while not Terminated and not GetWorkStop do
|
|
begin
|
|
try
|
|
PO := gMgSvc.ModePolicy;
|
|
NewVpnCfg.sNetBlkExcept := PO.NetworkExceptList;
|
|
NewVpnCfg.bBlkExcept := (PO.NetworkExceptType <> '') and
|
|
(PO.NetworkExceptType <> 'false') and
|
|
(NewVpnCfg.sNetBlkExcept <> '');
|
|
NewVpnCfg.bBlkDefPort := PO.IsDefPortBlock;
|
|
NewVpnCfg.nBlkExtPortType := PO.ExtraPortEnableType;
|
|
NewVpnCfg.sBlkPorts := PO.BlockPortList;
|
|
NewVpnCfg.sNetCtrlType := PO.NetworkBlockType;
|
|
NewVpnCfg.sNetCtrlList := PO.NetworkBlockList;
|
|
|
|
if PO.IsNetBlockDay then
|
|
begin
|
|
var sChk: String := NewVpnCfg.sNetCtrlType.ToUpper;
|
|
if (sChk <> PREF_NETAPP_WHITELIST) and (sChk <> PREF_NETAPP_BLACKLIST) then
|
|
begin
|
|
if not ((CompareDateTime(PO.NetBlockDayB, Now) = -1 ) and
|
|
(CompareDateTime(PO.NetBlockDayE, Now) = 1)) then
|
|
NewVpnCfg.sNetCtrlType := '';
|
|
end;
|
|
end;
|
|
|
|
ExtractUrlIps;
|
|
|
|
if not IsSameVpnCfg or gMgSvc.NicService.IsChangeNetCfg or bUrlIpAdded then
|
|
begin
|
|
_Trace('방화벽 규칙 초기화', 2);
|
|
// 방화벽 규칙 초기화, 셋팅
|
|
PrevVpnCfg := NewVpnCfg;
|
|
|
|
ExcpAppIpList.Clear;
|
|
FwRegAppList.Clear;
|
|
|
|
// 도메인에서 새로운 IP 추출로 초기화 하는 경우 초기화 하지 않는다 22_1011 14:21:23 kku
|
|
// 아에 프로그램 재시작전까지 초기화 안하는 방법도..?
|
|
// 그럼 ExtractUrlIps() 이게 계속 실행되겠지..
|
|
if not bUrlIpAdded then
|
|
DcUrlIps.Clear;
|
|
bUrlIpAdded := false;
|
|
dwUrlIpApiTick := 0;
|
|
dwUrlIpNslookupTick := 0;
|
|
|
|
ClearCrmFwPolicy(fwRules);
|
|
|
|
gMgSvc.NicService.IsChangeNetCfg := false;
|
|
dwFwCheckTick := 0;
|
|
end;
|
|
|
|
if not PrevVpnCfg.bBlkDefPort and
|
|
(PrevVpnCfg.nBlkExtPortType = PREF_PORTEX_FALSE) and
|
|
( (PrevVpnCfg.sNetCtrlType = '') or
|
|
(PrevVpnCfg.sNetCtrlType = 'false') or
|
|
(PrevVpnCfg.sNetCtrlList = '') ) then
|
|
begin
|
|
Sleep(dwSleepMSec);
|
|
continue;
|
|
end;
|
|
|
|
GetFwRulesToList(fwRules, FwRuleList);
|
|
// 이거 점유율 체크 밑으로 내리면 새로운 프로세스 방화벽 등록이 느려짐 22_0721 15:05:00 kku
|
|
// APP 방화벽 체크
|
|
CheckAndRegApp;
|
|
|
|
// 저사양 PC에서 CPU 점유율을 낮추기 위해 느슨하게 체크 22_0719 16:49:20 kku
|
|
if IsFirewallLowCheck then
|
|
begin
|
|
dwTick := GetTickCount;
|
|
if ((dwFwCheckTick > 0) and ((dwTick - dwFwCheckTick) < dwSleepLowMSec)) then // 3분에 한번
|
|
begin
|
|
Sleep(dwSleepMSec);
|
|
continue;
|
|
end;
|
|
dwFwCheckTick := dwTick;
|
|
end;
|
|
|
|
// 기본 MG <--> HE 통신 포트 등록/체크
|
|
// MG.exe 사용하지 않음 22_1124 13:52:29 kku
|
|
// pCheckEnt := FwRuleList.GetFwRuleByName(FW_NAME_POLICY_DEFAULT_INDIR);
|
|
// if (pCheckEnt = nil) or not CheckRuleState(pCheckEnt, false) then
|
|
// begin
|
|
// if pCheckEnt <> nil then
|
|
// RemoveFwRule(fwRules, pCheckEnt.sName);
|
|
// AddFwRule(fwRules, Get_POLICY_DEFAULT_INDIR);
|
|
// end;
|
|
//
|
|
// pCheckEnt := FwRuleList.GetFwRuleByName(FW_NAME_POLICY_DEFAULT_OUTDIR);
|
|
// if (pCheckEnt = nil) or not CheckRuleState(pCheckEnt, false) then
|
|
// begin
|
|
// if pCheckEnt <> nil then
|
|
// RemoveFwRule(fwRules, pCheckEnt.sName);
|
|
// AddFwRule(fwRules, Get_POLICY_DEFAULT_OUTDIR);
|
|
// end;
|
|
|
|
try
|
|
// 방화벽 on/off 체크 후 on으로 복구
|
|
if not fwPolicy2.FirewallEnabled[FW_PROFILE_PERSONAL] then
|
|
begin
|
|
fwPolicy2.FirewallEnabled[FW_PROFILE_PERSONAL] := true;
|
|
_Trace('방화벽 설정 복구. (개인 네트워크)', 2);
|
|
if gMgSvc <> nil then
|
|
gMgSvc.SendEventLogEx(LOG_RESTORE_FIREWALL_SET, 'Private Network', false);
|
|
end;
|
|
|
|
if not fwPolicy2.FirewallEnabled[FW_PROFILE_PUBLIC] then
|
|
begin
|
|
fwPolicy2.FirewallEnabled[FW_PROFILE_PUBLIC] := true;
|
|
_Trace('방화벽 설정 복구. (공용 네트워크)', 2);
|
|
if gMgSvc <> nil then
|
|
gMgSvc.SendEventLogEx(LOG_RESTORE_FIREWALL_SET, 'Public Network', false);
|
|
end;
|
|
|
|
if not fwPolicy2.FirewallEnabled[FW_PROFILE_DOMAIN] then
|
|
begin
|
|
fwPolicy2.FirewallEnabled[FW_PROFILE_DOMAIN] := true;
|
|
_Trace('방화벽 설정 복구. (도메인 네트워크)', 2);
|
|
if gMgSvc <> nil then
|
|
gMgSvc.SendEventLogEx(LOG_RESTORE_FIREWALL_SET, 'Domain Network', false);
|
|
end;
|
|
except
|
|
// ..
|
|
end;
|
|
|
|
if PrevVpnCfg.bBlkDefPort then
|
|
begin
|
|
pCheckEnt := FwRuleList.GetFwRuleByName(FW_NAME_POLICY_DEFAULTBLOCK_PORT);
|
|
if (pCheckEnt = nil) or not CheckRuleState(pCheckEnt, true) then
|
|
begin
|
|
if pCheckEnt <> nil then
|
|
RemoveFwRule(fwRules, pCheckEnt.sName);
|
|
AddFwRule(fwRules, Get_POLICY_DEFAULTBLOCK_PORT);
|
|
end;
|
|
end;
|
|
|
|
if PrevVpnCfg.nBlkExtPortType <> PREF_PORTEX_FALSE then
|
|
begin
|
|
pCheckEnt := FwRuleList.GetFwRuleByName(FW_NAME_POLICY_EXTRABLOCK_PORT);
|
|
if (pCheckEnt = nil) or not CheckRuleState(pCheckEnt, true) then
|
|
begin
|
|
if pCheckEnt <> nil then
|
|
RemoveFwRule(fwRules, pCheckEnt.sName);
|
|
AddFwRule(fwRules, Get_POLICY_EXTRABLOCK_PORT);
|
|
end;
|
|
end;
|
|
|
|
if (PrevVpnCfg.sNetCtrlType <> '') and
|
|
(PrevVpnCfg.sNetCtrlType <> 'false') and
|
|
(PrevVpnCfg.sNetCtrlList <> '') then
|
|
begin
|
|
CtrlType := nctFalse;
|
|
|
|
if NewVpnCfg.sNetCtrlType.ToUpper = PREF_NETAPP_WHITELIST then
|
|
CtrlType := nctAppWhite
|
|
else if NewVpnCfg.sNetCtrlType.ToUpper = PREF_NETAPP_BLACKLIST then
|
|
CtrlType := nctAppBlack
|
|
else
|
|
if NewVpnCfg.sNetCtrlType.ToUpper = PREF_NETIP_WHITELIST then
|
|
CtrlType := nctIpWhite
|
|
else
|
|
if NewVpnCfg.sNetCtrlType.ToUpper = PREF_NETIP_BLACKLIST then
|
|
CtrlType := nctIpBlack;
|
|
|
|
if PrevVpnCfg.bBlkExcept then
|
|
ProcessNetCtrl(NewVpnCfg.sNetCtrlList, NewVpnCfg.sNetBlkExcept)
|
|
else
|
|
ProcessNetCtrl(NewVpnCfg.sNetCtrlList, '');
|
|
end;
|
|
except
|
|
on E: Exception do
|
|
ETgException.TraceException(Self, E, 'Fail .. Execute()');
|
|
end;
|
|
Sleep(dwSleepMSec);
|
|
end;
|
|
finally
|
|
fwRules := nil;
|
|
fwPolicy2 := nil;
|
|
CoUninitialize;
|
|
end;
|
|
end;
|
|
|
|
end.
|