diff options
author | Jo-Philipp Wich <jo@mein.io> | 2019-06-13 15:23:26 +0200 |
---|---|---|
committer | Jo-Philipp Wich <jo@mein.io> | 2019-07-07 15:36:26 +0200 |
commit | 9c16090780b7430ffe88c770732604f6eb6cfda6 (patch) | |
tree | 92be7e7eaf1995b08995ee817670e5f5e03265e6 /applications/luci-app-firewall/luasrc/model/cbi | |
parent | a13dba8071ce828ef75a30357f2a49bac6071c9a (diff) |
luci-app-firewall: switch to client side CBI views
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
Diffstat (limited to 'applications/luci-app-firewall/luasrc/model/cbi')
6 files changed, 0 insertions, 1266 deletions
diff --git a/applications/luci-app-firewall/luasrc/model/cbi/firewall/forward-details.lua b/applications/luci-app-firewall/luasrc/model/cbi/firewall/forward-details.lua deleted file mode 100644 index d51f8fb79b..0000000000 --- a/applications/luci-app-firewall/luasrc/model/cbi/firewall/forward-details.lua +++ /dev/null @@ -1,162 +0,0 @@ --- Copyright 2011 Jo-Philipp Wich <jow@openwrt.org> --- Licensed to the public under the Apache License 2.0. - -local sys = require "luci.sys" -local dsp = require "luci.dispatcher" -local ft = require "luci.tools.firewall" - -local m, s, o - -arg[1] = arg[1] or "" - -m = Map("firewall", - translate("Firewall - Port Forwards"), - translate("This page allows you to change advanced properties of the port \ - forwarding entry. In most cases there is no need to modify \ - those settings.")) - -m.redirect = dsp.build_url("admin/network/firewall/forwards") - -if m.uci:get("firewall", arg[1]) ~= "redirect" then - luci.http.redirect(m.redirect) - return -else - local name = m:get(arg[1], "name") or m:get(arg[1], "_name") - if not name or #name == 0 then - name = translate("(Unnamed Entry)") - end - m.title = "%s - %s" %{ translate("Firewall - Port Forwards"), name } -end - -s = m:section(NamedSection, arg[1], "redirect", "") -s.anonymous = true -s.addremove = false - -ft.opt_enabled(s, Button) -ft.opt_name(s, Value, translate("Name")) - - -o = s:option(Value, "proto", translate("Protocol")) -o:value("tcp udp", "TCP+UDP") -o:value("tcp", "TCP") -o:value("udp", "UDP") -o:value("icmp", "ICMP") - -function o.cfgvalue(...) - local v = Value.cfgvalue(...) - if not v or v == "tcpudp" then - return "tcp udp" - end - return v -end - - -o = s:option(Value, "src", translate("Source zone")) -o.nocreate = true -o.default = "wan" -o.template = "cbi/firewall_zonelist" -o.rmempty = false - - -o = s:option(DynamicList, "src_mac", - translate("Source MAC address"), - translate("Only match incoming traffic from these MACs.")) -o.rmempty = true -o.datatype = "neg(macaddr)" -o.placeholder = translate("any") - -luci.sys.net.mac_hints(function(mac, name) - o:value(mac, "%s (%s)" %{ mac, name }) -end) - - -o = s:option(Value, "src_ip", - translate("Source IP address"), - translate("Only match incoming traffic from this IP or range.")) -o.rmempty = true -o.datatype = "neg(ipmask4)" -o.placeholder = translate("any") - -luci.sys.net.ipv4_hints(function(ip, name) - o:value(ip, "%s (%s)" %{ ip, name }) -end) - - -o = s:option(Value, "src_port", - translate("Source port"), - translate("Only match incoming traffic originating from the given source port or port range on the client host")) -o.rmempty = true -o.datatype = "neg(portrange)" -o.placeholder = translate("any") - -o:depends("proto", "tcp") -o:depends("proto", "udp") -o:depends("proto", "tcp udp") -o:depends("proto", "tcpudp") - -o = s:option(Value, "src_dip", - translate("External IP address"), - translate("Only match incoming traffic directed at the given IP address.")) - -luci.sys.net.ipv4_hints(function(ip, name) - o:value(ip, "%s (%s)" %{ ip, name }) -end) - - -o.rmempty = true -o.datatype = "neg(ipmask4)" -o.placeholder = translate("any") - - -o = s:option(Value, "src_dport", translate("External port"), - translate("Match incoming traffic directed at the given " .. - "destination port or port range on this host")) -o.datatype = "neg(portrange)" - -o:depends("proto", "tcp") -o:depends("proto", "udp") -o:depends("proto", "tcp udp") -o:depends("proto", "tcpudp") - -o = s:option(Value, "dest", translate("Internal zone")) -o.nocreate = true -o.default = "lan" -o.template = "cbi/firewall_zonelist" - - -o = s:option(Value, "dest_ip", translate("Internal IP address"), - translate("Redirect matched incoming traffic to the specified \ - internal host")) -o.datatype = "ipmask4" - -luci.sys.net.ipv4_hints(function(ip, name) - o:value(ip, "%s (%s)" %{ ip, name }) -end) - - -o = s:option(Value, "dest_port", - translate("Internal port"), - translate("Redirect matched incoming traffic to the given port on \ - the internal host")) -o.placeholder = translate("any") -o.datatype = "portrange" - -o:depends("proto", "tcp") -o:depends("proto", "udp") -o:depends("proto", "tcp udp") -o:depends("proto", "tcpudp") - -o = s:option(Flag, "reflection", translate("Enable NAT Loopback")) -o.rmempty = true -o.default = o.enabled -o.cfgvalue = function(...) - return Flag.cfgvalue(...) or "1" -end - - -s:option(Value, "extra", - translate("Extra arguments"), - translate("Passes additional arguments to iptables. Use with care!")) - - -return m diff --git a/applications/luci-app-firewall/luasrc/model/cbi/firewall/forwards.lua b/applications/luci-app-firewall/luasrc/model/cbi/firewall/forwards.lua deleted file mode 100644 index 5d1ffe0913..0000000000 --- a/applications/luci-app-firewall/luasrc/model/cbi/firewall/forwards.lua +++ /dev/null @@ -1,133 +0,0 @@ --- Copyright 2008 Steven Barth <steven@midlink.org> --- Copyright 2010-2012 Jo-Philipp Wich <jow@openwrt.org> --- Licensed to the public under the Apache License 2.0. - -local ds = require "luci.dispatcher" -local ft = require "luci.tools.firewall" - -m = Map("firewall", translate("Firewall - Port Forwards"), - translate("Port forwarding allows remote computers on the Internet to \ - connect to a specific computer or service within the \ - private LAN.")) - --- --- Port Forwards --- - -s = m:section(TypedSection, "redirect", translate("Port Forwards")) -s.template = "cbi/tblsection" -s.addremove = true -s.anonymous = true -s.sortable = true -s.extedit = ds.build_url("admin/network/firewall/forwards/%s") -s.template_addremove = "firewall/cbi_addforward" - -function s.create(self, section) - local n = m:formvalue("_newfwd.name") - local p = m:formvalue("_newfwd.proto") - local E = m:formvalue("_newfwd.extzone") - local e = m:formvalue("_newfwd.extport") - local I = m:formvalue("_newfwd.intzone") - local a = m:formvalue("_newfwd.intaddr") - local i = m:formvalue("_newfwd.intport") - - if p == "other" or (p and a) then - created = TypedSection.create(self, section) - - self.map:set(created, "target", "DNAT") - self.map:set(created, "src", E or "wan") - self.map:set(created, "dest", I or "lan") - self.map:set(created, "proto", (p ~= "other") and p or "all") - self.map:set(created, "src_dport", e) - self.map:set(created, "dest_ip", a) - self.map:set(created, "dest_port", i) - self.map:set(created, "name", n) - end - - if p ~= "other" then - created = nil - end -end - -function s.parse(self, ...) - TypedSection.parse(self, ...) - if created then - m.uci:save("firewall") - luci.http.redirect(ds.build_url( - "admin/network/firewall/forwards", created - )) - end -end - -function s.filter(self, sid) - return (self.map:get(sid, "target") ~= "SNAT") -end - -function s.sectiontitle(self, sid) - return (self.map:get(sid, "name") or translate("Unnamed forward")) -end - - -local function forward_proto_txt(self, s) - return "%s-%s" %{ - translate("IPv4"), - ft.fmt_proto(self.map:get(s, "proto"), - self.map:get(s, "icmp_type")) or "TCP+UDP" - } -end - -local function forward_src_txt(self, s) - local z = ft.fmt_zone(self.map:get(s, "src"), translate("any zone")) - local a = ft.fmt_ip(self.map:get(s, "src_ip"), translate("any host")) - local p = ft.fmt_port(self.map:get(s, "src_port")) - local m = ft.fmt_mac(self.map:get(s, "src_mac")) - - if p and m then - return translatef("From %s in %s with source %s and %s", a, z, p, m) - elseif p or m then - return translatef("From %s in %s with source %s", a, z, p or m) - else - return translatef("From %s in %s", a, z) - end -end - -local function forward_via_txt(self, s) - local a = ft.fmt_ip(self.map:get(s, "src_dip"), translate("any router IP")) - local p = ft.fmt_port(self.map:get(s, "src_dport")) - - if p then - return translatef("Via %s at %s", a, p) - else - return translatef("Via %s", a) - end -end - -match = s:option(DummyValue, "match", translate("Match")) -match.rawhtml = true -function match.cfgvalue(self, s) - return "<small>%s<br />%s<br />%s</small>" % { - forward_proto_txt(self, s), - forward_src_txt(self, s), - forward_via_txt(self, s) - } -end - - -dest = s:option(DummyValue, "dest", translate("Forward to")) -dest.rawhtml = true -function dest.cfgvalue(self, s) - local z = ft.fmt_zone(self.map:get(s, "dest"), translate("any zone")) - local a = ft.fmt_ip(self.map:get(s, "dest_ip"), translate("any host")) - local p = ft.fmt_port(self.map:get(s, "dest_port")) or - ft.fmt_port(self.map:get(s, "src_dport")) - - if p then - return translatef("%s, %s in %s", a, p, z) - else - return translatef("%s in %s", a, z) - end -end - -ft.opt_enabled(s, Flag, translate("Enable")) - -return m diff --git a/applications/luci-app-firewall/luasrc/model/cbi/firewall/rule-details.lua b/applications/luci-app-firewall/luasrc/model/cbi/firewall/rule-details.lua deleted file mode 100644 index def01c6690..0000000000 --- a/applications/luci-app-firewall/luasrc/model/cbi/firewall/rule-details.lua +++ /dev/null @@ -1,365 +0,0 @@ --- Copyright 2008 Steven Barth <steven@midlink.org> --- Copyright 2010-2012 Jo-Philipp Wich <jow@openwrt.org> --- Licensed to the public under the Apache License 2.0. -local dsp = require "luci.dispatcher" -local ft = require "luci.tools.firewall" -local nw = require "luci.model.network" -local m, s, o, v, _ - -arg[1] = arg[1] or "" - -m = Map("firewall", - translate("Firewall - Traffic Rules"), - translate("This page allows you to change advanced properties of the \ - traffic rule entry, such as matched source and destination \ - hosts.")) - -m.redirect = dsp.build_url("admin/network/firewall/rules") - -nw.init(m.uci) - -local rule_type = m.uci:get("firewall", arg[1]) -if rule_type == "redirect" and m:get(arg[1], "target") ~= "SNAT" then - rule_type = nil -end - -if not rule_type then - luci.http.redirect(m.redirect) - return - --- --- SNAT --- -elseif rule_type == "redirect" then - - local name = m:get(arg[1], "name") or m:get(arg[1], "_name") - if not name or #name == 0 then - name = translate("(Unnamed SNAT)") - else - name = "SNAT %s" % name - end - - m.title = "%s - %s" %{ translate("Firewall - Traffic Rules"), name } - - s = m:section(NamedSection, arg[1], "redirect", "") - s.anonymous = true - s.addremove = false - - - ft.opt_enabled(s, Button) - ft.opt_name(s, Value, translate("Name")) - - - o = s:option(Value, "proto", - translate("Protocol"), - translate("You may specify multiple by selecting \"-- custom --\" and \ - then entering protocols separated by space.")) - - o:value("all", "All protocols") - o:value("tcp udp", "TCP+UDP") - o:value("tcp", "TCP") - o:value("udp", "UDP") - o:value("icmp", "ICMP") - - function o.cfgvalue(...) - local v = Value.cfgvalue(...) - if not v or v == "tcpudp" then - return "tcp udp" - end - return v - end - - - o = s:option(Value, "src", translate("Source zone")) - o.nocreate = true - o.default = "wan" - o.template = "cbi/firewall_zonelist" - - - o = s:option(Value, "src_ip", translate("Source IP address")) - o.rmempty = true - o.datatype = "neg(ipmask4)" - o.placeholder = translate("any") - - luci.sys.net.ipv4_hints(function(ip, name) - o:value(ip, "%s (%s)" %{ ip, name }) - end) - - - o = s:option(Value, "src_port", - translate("Source port"), - translate("Match incoming traffic originating from the given source \ - port or port range on the client host.")) - o.rmempty = true - o.datatype = "neg(portrange)" - o.placeholder = translate("any") - - o:depends("proto", "tcp") - o:depends("proto", "udp") - o:depends("proto", "tcp udp") - o:depends("proto", "tcpudp") - - o = s:option(Value, "dest", translate("Destination zone")) - o.nocreate = true - o.default = "lan" - o.template = "cbi/firewall_zonelist" - - - o = s:option(Value, "dest_ip", translate("Destination IP address")) - o.datatype = "neg(ipmask4)" - - luci.sys.net.ipv4_hints(function(ip, name) - o:value(ip, "%s (%s)" %{ ip, name }) - end) - - - o = s:option(Value, "dest_port", - translate("Destination port"), - translate("Match forwarded traffic to the given destination port or \ - port range.")) - - o.rmempty = true - o.placeholder = translate("any") - o.datatype = "neg(portrange)" - - o:depends("proto", "tcp") - o:depends("proto", "udp") - o:depends("proto", "tcp udp") - o:depends("proto", "tcpudp") - - o = s:option(Value, "src_dip", - translate("SNAT IP address"), - translate("Rewrite matched traffic to the given address.")) - o.rmempty = false - o.datatype = "ip4addr" - - for _, v in ipairs(nw:get_interfaces()) do - local a - for _, a in ipairs(v:ipaddrs()) do - o:value(a:host():string(), '%s (%s)' %{ - a:host():string(), v:shortname() - }) - end - end - - - o = s:option(Value, "src_dport", translate("SNAT port"), - translate("Rewrite matched traffic to the given source port. May be \ - left empty to only rewrite the IP address.")) - o.datatype = "portrange" - o.rmempty = true - o.placeholder = translate('Do not rewrite') - - o:depends("proto", "tcp") - o:depends("proto", "udp") - o:depends("proto", "tcp udp") - o:depends("proto", "tcpudp") - - s:option(Value, "extra", - translate("Extra arguments"), - translate("Passes additional arguments to iptables. Use with care!")) - - --- --- Rule --- -else - local name = m:get(arg[1], "name") or m:get(arg[1], "_name") - if not name or #name == 0 then - name = translate("(Unnamed Rule)") - end - - m.title = "%s - %s" %{ translate("Firewall - Traffic Rules"), name } - - - s = m:section(NamedSection, arg[1], "rule", "") - s.anonymous = true - s.addremove = false - - ft.opt_enabled(s, Button) - ft.opt_name(s, Value, translate("Name")) - - - o = s:option(ListValue, "family", translate("Restrict to address family")) - o.rmempty = true - o:value("", translate("IPv4 and IPv6")) - o:value("ipv4", translate("IPv4 only")) - o:value("ipv6", translate("IPv6 only")) - - - o = s:option(Value, "proto", translate("Protocol")) - o:value("all", translate("Any")) - o:value("tcp udp", "TCP+UDP") - o:value("tcp", "TCP") - o:value("udp", "UDP") - o:value("icmp", "ICMP") - - function o.cfgvalue(...) - local v = Value.cfgvalue(...) - if not v or v == "tcpudp" then - return "tcp udp" - end - return v - end - - - o = s:option(DropDown, "icmp_type", translate("Match ICMP type")) - o.multiple = true - o.display = 10 - o.dropdown = 10 - o.custom = true - o.cast = "table" - - o:value("", "any") - o:value("echo-reply") - o:value("destination-unreachable") - o:value("network-unreachable") - o:value("host-unreachable") - o:value("protocol-unreachable") - o:value("port-unreachable") - o:value("fragmentation-needed") - o:value("source-route-failed") - o:value("network-unknown") - o:value("host-unknown") - o:value("network-prohibited") - o:value("host-prohibited") - o:value("TOS-network-unreachable") - o:value("TOS-host-unreachable") - o:value("communication-prohibited") - o:value("host-precedence-violation") - o:value("precedence-cutoff") - o:value("source-quench") - o:value("redirect") - o:value("network-redirect") - o:value("host-redirect") - o:value("TOS-network-redirect") - o:value("TOS-host-redirect") - o:value("echo-request") - o:value("router-advertisement") - o:value("router-solicitation") - o:value("time-exceeded") - o:value("ttl-zero-during-transit") - o:value("ttl-zero-during-reassembly") - o:value("parameter-problem") - o:value("ip-header-bad") - o:value("required-option-missing") - o:value("timestamp-request") - o:value("timestamp-reply") - o:value("address-mask-request") - o:value("address-mask-reply") - - o:depends("proto", "icmp") - - - o = s:option(Value, "src", translate("Source zone")) - o.nocreate = true - o.allowany = true - o.allowlocal = "src" - o.template = "cbi/firewall_zonelist" - - - o = s:option(Value, "src_mac", translate("Source MAC address")) - o.datatype = "list(macaddr)" - o.placeholder = translate("any") - - luci.sys.net.mac_hints(function(mac, name) - o:value(mac, "%s (%s)" %{ mac, name }) - end) - - - o = s:option(Value, "src_ip", translate("Source address")) - o.datatype = "list(neg(ipmask))" - o.placeholder = translate("any") - - luci.sys.net.ipv4_hints(function(ip, name) - o:value(ip, "%s (%s)" %{ ip, name }) - end) - - - o = s:option(Value, "src_port", translate("Source port")) - o.datatype = "list(neg(portrange))" - o.placeholder = translate("any") - - o:depends("proto", "tcp") - o:depends("proto", "udp") - o:depends("proto", "tcp udp") - o:depends("proto", "tcpudp") - - o = s:option(Value, "dest_local", translate("Output zone")) - o.nocreate = true - o.allowany = true - o.template = "cbi/firewall_zonelist" - o.alias = "dest" - o:depends("src", "") - - o = s:option(Value, "dest_remote", translate("Destination zone")) - o.nocreate = true - o.allowany = true - o.allowlocal = true - o.template = "cbi/firewall_zonelist" - o.alias = "dest" - o:depends({["src"] = "", ["!reverse"] = true}) - - - o = s:option(Value, "dest_ip", translate("Destination address")) - o.datatype = "list(neg(ipmask))" - o.placeholder = translate("any") - - luci.sys.net.ipv4_hints(function(ip, name) - o:value(ip, "%s (%s)" %{ ip, name }) - end) - - - o = s:option(Value, "dest_port", translate("Destination port")) - o.datatype = "list(neg(portrange))" - o.placeholder = translate("any") - - o:depends("proto", "tcp") - o:depends("proto", "udp") - o:depends("proto", "tcp udp") - o:depends("proto", "tcpudp") - - o = s:option(ListValue, "target", translate("Action")) - o.default = "ACCEPT" - o:value("DROP", translate("drop")) - o:value("ACCEPT", translate("accept")) - o:value("REJECT", translate("reject")) - o:value("NOTRACK", translate("don't track")) - - - s:option(Value, "extra", - translate("Extra arguments"), - translate("Passes additional arguments to iptables. Use with care!")) -end - -o = s:option(DropDown, "weekdays", translate("Week Days")) -o.multiple = true -o.display = 5 -o:value("Sun", translate("Sunday")) -o:value("Mon", translate("Monday")) -o:value("Tue", translate("Tuesday")) -o:value("Wed", translate("Wednesday")) -o:value("Thu", translate("Thursday")) -o:value("Fri", translate("Friday")) -o:value("Sat", translate("Saturday")) - -o = s:option(DropDown, "monthdays", translate("Month Days")) -o.multiple = true -o.display = 15 -for i = 1,31 do - o:value(translate(i)) -end - -o = s:option(Value, "start_time", translate("Start Time (hh:mm:ss)")) -o.datatype = "timehhmmss" -o = s:option(Value, "stop_time", translate("Stop Time (hh:mm:ss)")) -o.datatype = "timehhmmss" -o = s:option(Value, "start_date", translate("Start Date (yyyy-mm-dd)")) -o.datatype = "dateyyyymmdd" -o = s:option(Value, "stop_date", translate("Stop Date (yyyy-mm-dd)")) -o.datatype = "dateyyyymmdd" - -o = s:option(Flag, "utc_time", translate("Time in UTC")) -o.default = o.disabled - -return m diff --git a/applications/luci-app-firewall/luasrc/model/cbi/firewall/rules.lua b/applications/luci-app-firewall/luasrc/model/cbi/firewall/rules.lua deleted file mode 100644 index f4b6b2a928..0000000000 --- a/applications/luci-app-firewall/luasrc/model/cbi/firewall/rules.lua +++ /dev/null @@ -1,273 +0,0 @@ --- Copyright 2008 Steven Barth <steven@midlink.org> --- Copyright 2010-2012 Jo-Philipp Wich <jow@openwrt.org> --- Licensed to the public under the Apache License 2.0. - -local ds = require "luci.dispatcher" -local ft = require "luci.tools.firewall" - -m = Map("firewall", - translate("Firewall - Traffic Rules"), - translate("Traffic rules define policies for packets traveling between \ - different zones, for example to reject traffic between certain hosts \ - or to open WAN ports on the router.")) - --- --- Rules --- - -s = m:section(TypedSection, "rule", translate("Traffic Rules")) -s.addremove = true -s.anonymous = true -s.sortable = true -s.template = "cbi/tblsection" -s.extedit = ds.build_url("admin/network/firewall/rules/%s") -s.defaults.target = "ACCEPT" -s.template_addremove = "firewall/cbi_addrule" - - -function s.create(self, section) - created = TypedSection.create(self, section) -end - -function s.parse(self, ...) - TypedSection.parse(self, ...) - - local i_n = m:formvalue("_newopen.name") - local i_p = m:formvalue("_newopen.proto") - local i_e = m:formvalue("_newopen.extport") - local i_x = m:formvalue("_newopen.submit") - - local f_n = m:formvalue("_newfwd.name") - local f_s = m:formvalue("_newfwd.src") - local f_d = m:formvalue("_newfwd.dest") - local f_x = m:formvalue("_newfwd.submit") - - if i_x then - created = TypedSection.create(self, section) - - self.map:set(created, "target", "ACCEPT") - self.map:set(created, "src", "wan") - self.map:set(created, "proto", (i_p ~= "other") and i_p or "all") - self.map:set(created, "dest_port", i_e) - self.map:set(created, "name", i_n) - - if i_p ~= "other" and i_e and #i_e > 0 then - created = nil - end - - elseif f_x then - created = TypedSection.create(self, section) - - self.map:set(created, "target", "ACCEPT") - self.map:set(created, "src", f_s) - self.map:set(created, "dest", f_d) - self.map:set(created, "name", f_n) - end - - if created then - m.uci:save("firewall") - luci.http.redirect(ds.build_url( - "admin/network/firewall/rules", created - )) - end -end - -function s.sectiontitle(self, sid) - return (self.map:get(sid, "name") or translate("Unnamed rule")) -end - -local function rule_proto_txt(self, s) - local f = self.map:get(s, "family") - local p = ft.fmt_proto(self.map:get(s, "proto"), - self.map:get(s, "icmp_type")) or translate("traffic") - - if f and f:match("4") then - return "%s-%s" %{ translate("IPv4"), p } - elseif f and f:match("6") then - return "%s-%s" %{ translate("IPv6"), p } - else - return "%s %s" %{ translate("Any"), p } - end -end - -local function rule_src_txt(self, s) - local z = ft.fmt_zone(self.map:get(s, "src")) - local p = ft.fmt_port(self.map:get(s, "src_port")) - local m = ft.fmt_mac(self.map:get(s, "src_mac")) - - -- Forward/Input - if z and #z > 0 then - local a = ft.fmt_ip(self.map:get(s, "src_ip"), translate("any host")) - if p and m then - return translatef("From %s in %s with source %s and %s", a, z, p, m) - elseif p or m then - return translatef("From %s in %s with source %s", a, z, p or m) - else - return translatef("From %s in %s", a, z) - end - - -- Output - else - local a = ft.fmt_ip(self.map:get(s, "src_ip"), translate("any router IP")) - if p and m then - return translatef("From %s on <var>this device</var> with source %s and %s", a, p, m) - elseif p or m then - return translatef("From %s on <var>this device</var> with source %s", a, p or m) - else - return translatef("From %s on <var>this device</var>", a) - end - end -end - -local function rule_dest_txt(self, s) - local z = ft.fmt_zone(self.map:get(s, "dest")) - local p = ft.fmt_port(self.map:get(s, "dest_port")) - - -- Forward - if z then - local a = ft.fmt_ip(self.map:get(s, "dest_ip"), translate("any host")) - if p then - return translatef("To %s, %s in %s", a, p, z) - else - return translatef("To %s in %s", a, z) - end - - -- Input - else - local a = ft.fmt_ip(self.map:get(s, "dest_ip"), - translate("any router IP")) - - if p then - return translatef("To %s at %s on <var>this device</var>", a, p) - else - return translatef("To %s on <var>this device</var>", a) - end - end -end - -local function snat_dest_txt(self, s) - local z = ft.fmt_zone(self.map:get(s, "dest"), translate("any zone")) - local a = ft.fmt_ip(self.map:get(s, "dest_ip"), translate("any host")) - local p = ft.fmt_port(self.map:get(s, "dest_port")) or - ft.fmt_port(self.map:get(s, "src_dport")) - - if p then - return translatef("To %s, %s in %s", a, p, z) - else - return translatef("To %s in %s", a, z) - end -end - - -match = s:option(DummyValue, "match", translate("Match")) -match.rawhtml = true -function match.cfgvalue(self, s) - return "<small>%s<br />%s<br />%s</small>" % { - rule_proto_txt(self, s), - rule_src_txt(self, s), - rule_dest_txt(self, s) - } -end - -target = s:option(DummyValue, "target", translate("Action")) -target.rawhtml = true -function target.cfgvalue(self, s) - local t = ft.fmt_target(self.map:get(s, "target"), self.map:get(s, "src"), self.map:get(s, "dest")) - local l = ft.fmt_limit(self.map:get(s, "limit"), - self.map:get(s, "limit_burst")) - - if l then - return translatef("<var>%s</var> and limit to %s", t, l) - else - return "<var>%s</var>" % t - end -end - -ft.opt_enabled(s, Flag, translate("Enable")) - - --- --- SNAT --- - -s = m:section(TypedSection, "redirect", - translate("Source NAT"), - translate("Source NAT is a specific form of masquerading which allows \ - fine grained control over the source IP used for outgoing traffic, \ - for example to map multiple WAN addresses to internal subnets.")) -s.template = "cbi/tblsection" -s.addremove = true -s.anonymous = true -s.sortable = true -s.extedit = ds.build_url("admin/network/firewall/rules/%s") -s.template_addremove = "firewall/cbi_addsnat" - -function s.create(self, section) - created = TypedSection.create(self, section) -end - -function s.parse(self, ...) - TypedSection.parse(self, ...) - - local n = m:formvalue("_newsnat.name") - local s = m:formvalue("_newsnat.src") - local d = m:formvalue("_newsnat.dest") - local a = m:formvalue("_newsnat.dip") - local p = m:formvalue("_newsnat.dport") - local x = m:formvalue("_newsnat.submit") - - if x and a and #a > 0 then - created = TypedSection.create(self, section) - - self.map:set(created, "target", "SNAT") - self.map:set(created, "src", s) - self.map:set(created, "dest", d) - self.map:set(created, "proto", "all") - self.map:set(created, "src_dip", a) - self.map:set(created, "src_dport", p) - self.map:set(created, "name", n) - end - - if created then - m.uci:save("firewall") - luci.http.redirect(ds.build_url( - "admin/network/firewall/rules", created - )) - end -end - -function s.filter(self, sid) - return (self.map:get(sid, "target") == "SNAT") -end - -function s.sectiontitle(self, sid) - return (self.map:get(sid, "name") or translate("Unnamed SNAT")) -end - -match = s:option(DummyValue, "match", translate("Match")) -match.rawhtml = true -function match.cfgvalue(self, s) - return "<small>%s<br />%s<br />%s</small>" % { - rule_proto_txt(self, s), - rule_src_txt(self, s), - snat_dest_txt(self, s) - } -end - -snat = s:option(DummyValue, "via", translate("Action")) -snat.rawhtml = true -function snat.cfgvalue(self, s) - local a = ft.fmt_ip(self.map:get(s, "src_dip")) - local p = ft.fmt_port(self.map:get(s, "src_dport")) - - if a and p then - return translatef("Rewrite to source %s, %s", a, p) - else - return translatef("Rewrite to source %s", a or p) - end -end - -ft.opt_enabled(s, Flag, translate("Enable")) - - -return m diff --git a/applications/luci-app-firewall/luasrc/model/cbi/firewall/zone-details.lua b/applications/luci-app-firewall/luasrc/model/cbi/firewall/zone-details.lua deleted file mode 100644 index e168c3c605..0000000000 --- a/applications/luci-app-firewall/luasrc/model/cbi/firewall/zone-details.lua +++ /dev/null @@ -1,229 +0,0 @@ --- Copyright 2008 Steven Barth <steven@midlink.org> --- Copyright 2010-2011 Jo-Philipp Wich <jow@openwrt.org> --- Licensed to the public under the Apache License 2.0. - -local nw = require "luci.model.network" -local fw = require "luci.model.firewall" -local ds = require "luci.dispatcher" -local ut = require "luci.util" - -local m, p, i, v -local s, name, net, family, msrc, mdest, log, lim -local s2, out, inp - - -m = Map("firewall", translate("Firewall - Zone Settings")) -m.redirect = luci.dispatcher.build_url("admin/network/firewall/zones") - -fw.init(m.uci) -nw.init(m.uci) - - -local zone = fw:get_zone(arg[1]) -if not zone then - luci.http.redirect(ds.build_url("admin/network/firewall/zones")) - return -else - m.title = "%s - %s" %{ - translate("Firewall - Zone Settings"), - translatef("Zone %q", zone:name() or "?") - } -end - - -s = m:section(NamedSection, zone.sid, "zone", - translatef("Zone %q", zone:name()), - translatef("This section defines common properties of %q. \ - The <em>input</em> and <em>output</em> options set the default \ - policies for traffic entering and leaving this zone while the \ - <em>forward</em> option describes the policy for forwarded traffic \ - between different networks within the zone. \ - <em>Covered networks</em> specifies which available networks are \ - members of this zone.", zone:name())) - -s.anonymous = true -s.addremove = false - -m.on_commit = function(map) - local zone = fw:get_zone(arg[1]) - if zone then - s.section = zone.sid - s2.section = zone.sid - end -end - - -s:tab("general", translate("General Settings")) -s:tab("advanced", translate("Advanced Settings")) - - -name = s:taboption("general", Value, "name", translate("Name")) -name.optional = false -name.forcewrite = true -name.datatype = "and(uciname,maxlength(11))" - -function name.write(self, section, value) - if zone:name() ~= value then - fw:rename_zone(zone:name(), value) - out.exclude = value - inp.exclude = value - end -end - -p = { - s:taboption("general", ListValue, "input", translate("Input")), - s:taboption("general", ListValue, "output", translate("Output")), - s:taboption("general", ListValue, "forward", translate("Forward")) -} - -for i, v in ipairs(p) do - v:value("REJECT", translate("reject")) - v:value("DROP", translate("drop")) - v:value("ACCEPT", translate("accept")) -end - -s:taboption("general", Flag, "masq", translate("Masquerading")) -s:taboption("general", Flag, "mtu_fix", translate("MSS clamping")) - -net = s:taboption("general", Value, "network", translate("Covered networks")) -net.template = "cbi/network_netlist" -net.widget = "checkbox" -net.cast = "string" - -function net.formvalue(self, section) - return Value.formvalue(self, section) or "-" -end - -function net.cfgvalue(self, section) - return Value.cfgvalue(self, section) or name:cfgvalue(section) -end - -function net.write(self, section, value) - zone:clear_networks() - - local net - for net in ut.imatch(value) do - local n = nw:get_network(net) or nw:add_network(net, { proto = "none" }) - if n then - zone:add_network(n:name()) - end - end -end - - -family = s:taboption("advanced", ListValue, "family", - translate("Restrict to address family")) - -family.rmempty = true -family:value("", translate("IPv4 and IPv6")) -family:value("ipv4", translate("IPv4 only")) -family:value("ipv6", translate("IPv6 only")) - -msrc = s:taboption("advanced", DynamicList, "masq_src", - translate("Restrict Masquerading to given source subnets")) - -msrc.optional = true -msrc.datatype = "list(neg(or(uciname,hostname,ipmask4)))" -msrc.placeholder = "0.0.0.0/0" -msrc:depends("family", "") -msrc:depends("family", "ipv4") - -mdest = s:taboption("advanced", DynamicList, "masq_dest", - translate("Restrict Masquerading to given destination subnets")) - -mdest.optional = true -mdest.datatype = "list(neg(or(uciname,hostname,ipmask4)))" -mdest.placeholder = "0.0.0.0/0" -mdest:depends("family", "") -mdest:depends("family", "ipv4") - -s:taboption("advanced", Flag, "conntrack", - translate("Force connection tracking")) - -log = s:taboption("advanced", Flag, "log", - translate("Enable logging on this zone")) - -log.rmempty = true -log.enabled = "1" - -lim = s:taboption("advanced", Value, "log_limit", - translate("Limit log messages")) - -lim.placeholder = "10/minute" -lim:depends("log", "1") - - -s2 = m:section(NamedSection, zone.sid, "fwd_out", - translate("Inter-Zone Forwarding"), - translatef("The options below control the forwarding policies between \ - this zone (%s) and other zones. <em>Destination zones</em> cover \ - forwarded traffic <strong>originating from %q</strong>. \ - <em>Source zones</em> match forwarded traffic from other zones \ - <strong>targeted at %q</strong>. The forwarding rule is \ - <em>unidirectional</em>, e.g. a forward from lan to wan does \ - <em>not</em> imply a permission to forward from wan to lan as well.", - zone:name(), zone:name(), zone:name() - - )) - -out = s2:option(Value, "out", - translate("Allow forward to <em>destination zones</em>:")) - -out.nocreate = true -out.widget = "checkbox" -out.exclude = zone:name() -out.template = "cbi/firewall_zonelist" - -inp = s2:option(Value, "in", - translate("Allow forward from <em>source zones</em>:")) - -inp.nocreate = true -inp.widget = "checkbox" -inp.exclude = zone:name() -inp.template = "cbi/firewall_zonelist" - -function out.cfgvalue(self, section) - local v = { } - local f - for _, f in ipairs(zone:get_forwardings_by("src")) do - v[#v+1] = f:dest() - end - return table.concat(v, " ") -end - -function inp.cfgvalue(self, section) - local v = { } - local f - for _, f in ipairs(zone:get_forwardings_by("dest")) do - v[#v+1] = f:src() - end - return v -end - -function out.formvalue(self, section) - return Value.formvalue(self, section) or "-" -end - -function inp.formvalue(self, section) - return Value.formvalue(self, section) or "-" -end - -function out.write(self, section, value) - zone:del_forwardings_by("src") - - local f - for f in ut.imatch(value) do - zone:add_forwarding_to(f) - end -end - -function inp.write(self, section, value) - zone:del_forwardings_by("dest") - - local f - for f in ut.imatch(value) do - zone:add_forwarding_from(f) - end -end - -return m diff --git a/applications/luci-app-firewall/luasrc/model/cbi/firewall/zones.lua b/applications/luci-app-firewall/luasrc/model/cbi/firewall/zones.lua deleted file mode 100644 index 46402a8fc1..0000000000 --- a/applications/luci-app-firewall/luasrc/model/cbi/firewall/zones.lua +++ /dev/null @@ -1,104 +0,0 @@ --- Copyright 2008 Steven Barth <steven@midlink.org> --- Licensed to the public under the Apache License 2.0. - -local ds = require "luci.dispatcher" -local fw = require "luci.model.firewall" -local fs = require "nixio.fs" - -local m, s, o, p, i, v - -m = Map("firewall", - translate("Firewall - Zone Settings"), - translate("The firewall creates zones over your network interfaces to control network traffic flow.")) - -fw.init(m.uci) - -s = m:section(TypedSection, "defaults", translate("General Settings")) -s.anonymous = true -s.addremove = false - -s:option(Flag, "syn_flood", translate("Enable SYN-flood protection")) - -o = s:option(Flag, "drop_invalid", translate("Drop invalid packets")) - -p = { - s:option(ListValue, "input", translate("Input")), - s:option(ListValue, "output", translate("Output")), - s:option(ListValue, "forward", translate("Forward")) -} - -for i, v in ipairs(p) do - v:value("REJECT", translate("reject")) - v:value("DROP", translate("drop")) - v:value("ACCEPT", translate("accept")) -end - --- Netfilter flow offload support - -local offload = fs.access("/sys/module/xt_FLOWOFFLOAD/refcnt") - -if offload then - s:option(DummyValue, "offload_advice", - translate("Routing/NAT Offloading"), - translate("Experimental feature. Not fully compatible with QoS/SQM.")) - - o = s:option(Flag, "flow_offloading", - translate("Software flow offloading"), - translate("Software based offloading for routing/NAT")) - o.optional = true - - o = s:option(Flag, "flow_offloading_hw", - translate("Hardware flow offloading"), - translate("Requires hardware NAT support. Implemented at least for mt7621")) - o.optional = true - o:depends( "flow_offloading", 1) -end - --- Firewall zones - -s = m:section(TypedSection, "zone", translate("Zones")) -s.template = "cbi/tblsection" -s.anonymous = true -s.addremove = true -s.extedit = ds.build_url("admin", "network", "firewall", "zones", "%s") - -function s.sectiontitle(self, sid) - local z = fw:get_zone(sid) - return z:name() -end - -function s.create(self) - local z = fw:new_zone() - if z then - luci.http.redirect( - ds.build_url("admin", "network", "firewall", "zones", z.sid) - ) - end -end - -function s.remove(self, section) - return fw:del_zone(section) -end - -o = s:option(DummyValue, "_info", translate("Zone ⇒ Forwardings")) -o.template = "cbi/firewall_zoneforwards" -o.cfgvalue = function(self, section) - return self.map:get(section, "name") -end - -p = { - s:option(ListValue, "input", translate("Input")), - s:option(ListValue, "output", translate("Output")), - s:option(ListValue, "forward", translate("Forward")) -} - -for i, v in ipairs(p) do - v:value("REJECT", translate("reject")) - v:value("DROP", translate("drop")) - v:value("ACCEPT", translate("accept")) -end - -s:option(Flag, "masq", translate("Masquerading")) -s:option(Flag, "mtu_fix", translate("MSS clamping")) - -return m |