#!/usr/bin/perl
#
# ACL Generator to prevent (IP protocol, destination port) from users ports at DLink switches
# Work only with switches that always tag packets (and move offset at 4 bytes right)
#
# Licensed under GNU GPL
# Written by Dyr, 2008-11-07
# v.1.0

use strict;
use warnings;
use diagnostics;

if ($#ARGV < 4 || $#ARGV > 5 ) {
     die "ACL Generator to prevent (IP protocol, destination port) from users ports at DLink switches\n"
        ."USAGE: $0 ip_protocol protocol_port profile_id switch_port action {access_id}\n"
        ."FORMAT:  x (ip_protocol, see /etc/protocol for names) \n"
        ."      1..65535 (protocol_port)\n"
        ."      1..255 (profile_id)\n"
        ."      1..26 (switch_port)\n"
        ."      permit|deny (action)\n"
        ."      {1-255} (access_id)\n"
        ."EXAMPLE: Permit (PERMIT) DHCP (UDP) request port (67) with create profile_id (3) at switch port (1)\n"
        ."      $0 UDP 67 3 1 PERMIT\n";
}


my $proto=$ARGV[0];
my $proto_port = $ARGV[1];
my $profile_id = $ARGV[2];
my $switch_port = $ARGV[3];
my $action = $ARGV[4];
my $access_id = $ARGV[5] || $switch_port;

chomp($action);
chomp($access_id);

die "Invalid profile id\n"      if ( $profile_id < 1 || $profile_id > 255 );
die "Invalid switch port\n"     if ( $switch_port < 1 || $switch_port > 26 );
die "Invalid protocol\n"        if ( $proto !~ /^\w+$/ );
die "Invalid protocol port\n"   if ( $proto_port < 1 || $proto_port > 65535);
die "Invalid action\n"          if ( $action !~ /[permit|deny]/i );
die "Invalid access_id\n"       if ( $access_id <  1 || $access_id > 255 );
$proto = getprotobyname($proto);
die "Protocol number unknown\n" if ( !defined($proto));

#Convert protocol number to hex
$proto = sprintf("%.2X",$proto);

#Convert protocol_port to hex
$proto_port = sprintf("%.4X",$proto_port);

print "#Create mask for blocking IP protocols and ports\n";
print "create access_profile packet_content_mask "
     ."offset_16-31 0xffff0000 0x0 0x000000ff 0x0 "
     ."offset_32-47 0x0 0x0 0xffff0000 0x0 "
     ."profile_id $profile_id\n";

print "config access_profile profile_id $profile_id add access_id $access_id packet_content_mask "
     ."offset_16-31 0x08000000 0x0 0x000000".$proto." 0x0 "
     ."offset_32-47 0x0 0x0 0x".$proto_port."0000 0x0 "
     ."port $switch_port $action\n";