luci-app-firewall: switch to client side CBI views

Signed-off-by: Jo-Philipp Wich <jo@mein.io>

7 files changed, 3 insertions, 1272 deletions

diff --git a/applications/luci-app-firewall/luasrc/controller/firewall.lua b/applications/luci-app-firewall/luasrc/controller/firewall.lua
index 4fe7770efc..58a44c6018 100644
--- a/applications/luci-app-firewall/luasrc/controller/firewall.lua
+++ b/applications/luci-app-firewall/luasrc/controller/firewall.lua
@@ -6,16 +6,13 @@ function index()
 		_("Firewall"), 60)
 
 	entry({"admin", "network", "firewall", "zones"},
-		arcombine(cbi("firewall/zones"), cbi("firewall/zone-details")),
-		_("General Settings"), 10).leaf = true
+		view("firewall/zones"), _("General Settings"), 10)
 
 	entry({"admin", "network", "firewall", "forwards"},
-		arcombine(cbi("firewall/forwards"), cbi("firewall/forward-details")),
-		_("Port Forwards"), 20).leaf = true
+		view("firewall/forwards"), _("Port Forwards"), 20)
 
 	entry({"admin", "network", "firewall", "rules"},
-		arcombine(cbi("firewall/rules"), cbi("firewall/rule-details")),
-		_("Traffic Rules"), 30).leaf = true
+		view("firewall/rules"), _("Traffic Rules"), 30)
 
 	entry({"admin", "network", "firewall", "custom"},
 		form("firewall/custom"),
diff --git a/applications/luci-app-firewall/luasrc/model/cbi/firewall/forward-details.lua b/applications/luci-app-firewall/luasrc/model/cbi/firewall/forward-details.lua
deleted file mode 100644
index d51f8fb79b..0000000000
--- a/applications/luci-app-firewall/luasrc/model/cbi/firewall/forward-details.lua
+++ /dev/null
@@ -1,162 +0,0 @@
--- Copyright 2011 Jo-Philipp Wich <jow@openwrt.org>
--- Licensed to the public under the Apache License 2.0.
-
-local sys = require "luci.sys"
-local dsp = require "luci.dispatcher"
-local ft  = require "luci.tools.firewall"
-
-local m, s, o
-
-arg[1] = arg[1] or ""
-
-m = Map("firewall",
-	translate("Firewall - Port Forwards"),
-	translate("This page allows you to change advanced properties of the port \
-	           forwarding entry. In most cases there is no need to modify \
-			   those settings."))
-
-m.redirect = dsp.build_url("admin/network/firewall/forwards")
-
-if m.uci:get("firewall", arg[1]) ~= "redirect" then
-	luci.http.redirect(m.redirect)
-	return
-else
-	local name = m:get(arg[1], "name") or m:get(arg[1], "_name")
-	if not name or #name == 0 then
-		name = translate("(Unnamed Entry)")
-	end
-	m.title = "%s - %s" %{ translate("Firewall - Port Forwards"), name }
-end
-
-s = m:section(NamedSection, arg[1], "redirect", "")
-s.anonymous = true
-s.addremove = false
-
-ft.opt_enabled(s, Button)
-ft.opt_name(s, Value, translate("Name"))
-
-
-o = s:option(Value, "proto", translate("Protocol"))
-o:value("tcp udp", "TCP+UDP")
-o:value("tcp", "TCP")
-o:value("udp", "UDP")
-o:value("icmp", "ICMP")
-
-function o.cfgvalue(...)
-	local v = Value.cfgvalue(...)
-	if not v or v == "tcpudp" then
-		return "tcp udp"
-	end
-	return v
-end
-
-
-o = s:option(Value, "src", translate("Source zone"))
-o.nocreate = true
-o.default = "wan"
-o.template = "cbi/firewall_zonelist"
-o.rmempty = false
-
-
-o = s:option(DynamicList, "src_mac",
-	translate("Source MAC address"),
-	translate("Only match incoming traffic from these MACs."))
-o.rmempty = true
-o.datatype = "neg(macaddr)"
-o.placeholder = translate("any")
-
-luci.sys.net.mac_hints(function(mac, name)
-	o:value(mac, "%s (%s)" %{ mac, name })
-end)
-
-
-o = s:option(Value, "src_ip",
-	translate("Source IP address"),
-	translate("Only match incoming traffic from this IP or range."))
-o.rmempty = true
-o.datatype = "neg(ipmask4)"
-o.placeholder = translate("any")
-
-luci.sys.net.ipv4_hints(function(ip, name)
-	o:value(ip, "%s (%s)" %{ ip, name })
-end)
-
-
-o = s:option(Value, "src_port",
-	translate("Source port"),
-	translate("Only match incoming traffic originating from the given source port or port range on the client host"))
-o.rmempty = true
-o.datatype = "neg(portrange)"
-o.placeholder = translate("any")
-
-o:depends("proto", "tcp")
-o:depends("proto", "udp")
-o:depends("proto", "tcp udp")
-o:depends("proto", "tcpudp")
-
-o = s:option(Value, "src_dip",
-	translate("External IP address"),
-	translate("Only match incoming traffic directed at the given IP address."))
-
-luci.sys.net.ipv4_hints(function(ip, name)
-	o:value(ip, "%s (%s)" %{ ip, name })
-end)
-
-
-o.rmempty = true
-o.datatype = "neg(ipmask4)"
-o.placeholder = translate("any")
-
-
-o = s:option(Value, "src_dport", translate("External port"),
-	translate("Match incoming traffic directed at the given " ..
-		"destination port or port range on this host"))
-o.datatype = "neg(portrange)"
-
-o:depends("proto", "tcp")
-o:depends("proto", "udp")
-o:depends("proto", "tcp udp")
-o:depends("proto", "tcpudp")
-
-o = s:option(Value, "dest", translate("Internal zone"))
-o.nocreate = true
-o.default = "lan"
-o.template = "cbi/firewall_zonelist"
-
-
-o = s:option(Value, "dest_ip", translate("Internal IP address"),
-	translate("Redirect matched incoming traffic to the specified \
-		internal host"))
-o.datatype = "ipmask4"
-
-luci.sys.net.ipv4_hints(function(ip, name)
-	o:value(ip, "%s (%s)" %{ ip, name })
-end)
-
-
-o = s:option(Value, "dest_port",
-	translate("Internal port"),
-	translate("Redirect matched incoming traffic to the given port on \
-		the internal host"))
-o.placeholder = translate("any")
-o.datatype = "portrange"
-
-o:depends("proto", "tcp")
-o:depends("proto", "udp")
-o:depends("proto", "tcp udp")
-o:depends("proto", "tcpudp")
-
-o = s:option(Flag, "reflection", translate("Enable NAT Loopback"))
-o.rmempty = true
-o.default = o.enabled
-o.cfgvalue = function(...)
-	return Flag.cfgvalue(...) or "1"
-end
-
-
-s:option(Value, "extra",
-	translate("Extra arguments"),
-	translate("Passes additional arguments to iptables. Use with care!"))
-
-
-return m
diff --git a/applications/luci-app-firewall/luasrc/model/cbi/firewall/forwards.lua b/applications/luci-app-firewall/luasrc/model/cbi/firewall/forwards.lua
deleted file mode 100644
index 5d1ffe0913..0000000000
--- a/applications/luci-app-firewall/luasrc/model/cbi/firewall/forwards.lua
+++ /dev/null
@@ -1,133 +0,0 @@
--- Copyright 2008 Steven Barth <steven@midlink.org>
--- Copyright 2010-2012 Jo-Philipp Wich <jow@openwrt.org>
--- Licensed to the public under the Apache License 2.0.
-
-local ds = require "luci.dispatcher"
-local ft = require "luci.tools.firewall"
-
-m = Map("firewall", translate("Firewall - Port Forwards"),
-	translate("Port forwarding allows remote computers on the Internet to \
-	           connect to a specific computer or service within the \
-	           private LAN."))
-
---
--- Port Forwards
---
-
-s = m:section(TypedSection, "redirect", translate("Port Forwards"))
-s.template  = "cbi/tblsection"
-s.addremove = true
-s.anonymous = true
-s.sortable  = true
-s.extedit   = ds.build_url("admin/network/firewall/forwards/%s")
-s.template_addremove = "firewall/cbi_addforward"
-
-function s.create(self, section)
-	local n = m:formvalue("_newfwd.name")
-	local p = m:formvalue("_newfwd.proto")
-	local E = m:formvalue("_newfwd.extzone")
-	local e = m:formvalue("_newfwd.extport")
-	local I = m:formvalue("_newfwd.intzone")
-	local a = m:formvalue("_newfwd.intaddr")
-	local i = m:formvalue("_newfwd.intport")
-
-	if p == "other" or (p and a) then
-		created = TypedSection.create(self, section)
-
-		self.map:set(created, "target",    "DNAT")
-		self.map:set(created, "src",       E or "wan")
-		self.map:set(created, "dest",      I or "lan")
-		self.map:set(created, "proto",     (p ~= "other") and p or "all")
-		self.map:set(created, "src_dport", e)
-		self.map:set(created, "dest_ip",   a)
-		self.map:set(created, "dest_port", i)
-		self.map:set(created, "name",      n)
-	end
-
-	if p ~= "other" then
-		created = nil
-	end
-end
-
-function s.parse(self, ...)
-	TypedSection.parse(self, ...)
-	if created then
-		m.uci:save("firewall")
-		luci.http.redirect(ds.build_url(
-			"admin/network/firewall/forwards", created
-		))
-	end
-end
-
-function s.filter(self, sid)
-	return (self.map:get(sid, "target") ~= "SNAT")
-end
-
-function s.sectiontitle(self, sid)
-	return (self.map:get(sid, "name") or translate("Unnamed forward"))
-end
-
-
-local function forward_proto_txt(self, s)
-	return "%s-%s" %{
-		translate("IPv4"),
-		ft.fmt_proto(self.map:get(s, "proto"),
-	                 self.map:get(s, "icmp_type")) or "TCP+UDP"
-	}
-end
-
-local function forward_src_txt(self, s)
-	local z = ft.fmt_zone(self.map:get(s, "src"), translate("any zone"))
-	local a = ft.fmt_ip(self.map:get(s, "src_ip"), translate("any host"))
-	local p = ft.fmt_port(self.map:get(s, "src_port"))
-	local m = ft.fmt_mac(self.map:get(s, "src_mac"))
-
-	if p and m then
-		return translatef("From %s in %s with source %s and %s", a, z, p, m)
-	elseif p or m then
-		return translatef("From %s in %s with source %s", a, z, p or m)
-	else
-		return translatef("From %s in %s", a, z)
-	end
-end
-
-local function forward_via_txt(self, s)
-	local a = ft.fmt_ip(self.map:get(s, "src_dip"), translate("any router IP"))
-	local p = ft.fmt_port(self.map:get(s, "src_dport"))
-
-	if p then
-		return translatef("Via %s at %s", a, p)
-	else
-		return translatef("Via %s", a)
-	end
-end
-
-match = s:option(DummyValue, "match", translate("Match"))
-match.rawhtml = true
-function match.cfgvalue(self, s)
-	return "<small>%s<br />%s<br />%s</small>" % {
-		forward_proto_txt(self, s),
-		forward_src_txt(self, s),
-		forward_via_txt(self, s)
-	}
-end
-
-
-dest = s:option(DummyValue, "dest", translate("Forward to"))
-dest.rawhtml = true
-function dest.cfgvalue(self, s)
-	local z = ft.fmt_zone(self.map:get(s, "dest"), translate("any zone"))
-	local a = ft.fmt_ip(self.map:get(s, "dest_ip"), translate("any host"))
-	local p = ft.fmt_port(self.map:get(s, "dest_port")) or
-		ft.fmt_port(self.map:get(s, "src_dport"))
-
-	if p then
-		return translatef("%s, %s in %s", a, p, z)
-	else
-		return translatef("%s in %s", a, z)
-	end
-end
-
-ft.opt_enabled(s, Flag, translate("Enable"))
-
-return m
diff --git a/applications/luci-app-firewall/luasrc/model/cbi/firewall/rule-details.lua b/applications/luci-app-firewall/luasrc/model/cbi/firewall/rule-details.lua
deleted file mode 100644
index def01c6690..0000000000
--- a/applications/luci-app-firewall/luasrc/model/cbi/firewall/rule-details.lua
+++ /dev/null
@@ -1,365 +0,0 @@
--- Copyright 2008 Steven Barth <steven@midlink.org>
--- Copyright 2010-2012 Jo-Philipp Wich <jow@openwrt.org>
--- Licensed to the public under the Apache License 2.0.
-local dsp = require "luci.dispatcher"
-local ft = require "luci.tools.firewall"
-local nw = require "luci.model.network"
-local m, s, o, v, _
-
-arg[1] = arg[1] or ""
-
-m = Map("firewall",
-	translate("Firewall - Traffic Rules"),
-	translate("This page allows you to change advanced properties of the \
-	           traffic rule entry, such as matched source and destination \
-			   hosts."))
-
-m.redirect = dsp.build_url("admin/network/firewall/rules")
-
-nw.init(m.uci)
-
-local rule_type = m.uci:get("firewall", arg[1])
-if rule_type == "redirect" and m:get(arg[1], "target") ~= "SNAT" then
-	rule_type = nil
-end
-
-if not rule_type then
-	luci.http.redirect(m.redirect)
-	return
-
---
--- SNAT
---
-elseif rule_type == "redirect" then
-
-	local name = m:get(arg[1], "name") or m:get(arg[1], "_name")
-	if not name or #name == 0 then
-		name = translate("(Unnamed SNAT)")
-	else
-		name = "SNAT %s" % name
-	end
-
-	m.title = "%s - %s" %{ translate("Firewall - Traffic Rules"), name }
-
-	s = m:section(NamedSection, arg[1], "redirect", "")
-	s.anonymous = true
-	s.addremove = false
-
-
-	ft.opt_enabled(s, Button)
-	ft.opt_name(s, Value, translate("Name"))
-
-
-	o = s:option(Value, "proto",
-		translate("Protocol"),
-		translate("You may specify multiple by selecting \"-- custom --\" and \
-		           then entering protocols separated by space."))
-
-	o:value("all", "All protocols")
-	o:value("tcp udp", "TCP+UDP")
-	o:value("tcp", "TCP")
-	o:value("udp", "UDP")
-	o:value("icmp", "ICMP")
-
-	function o.cfgvalue(...)
-		local v = Value.cfgvalue(...)
-		if not v or v == "tcpudp" then
-			return "tcp udp"
-		end
-		return v
-	end
-
-
-	o = s:option(Value, "src", translate("Source zone"))
-	o.nocreate = true
-	o.default = "wan"
-	o.template = "cbi/firewall_zonelist"
-
-
-	o = s:option(Value, "src_ip", translate("Source IP address"))
-	o.rmempty = true
-	o.datatype = "neg(ipmask4)"
-	o.placeholder = translate("any")
-
-	luci.sys.net.ipv4_hints(function(ip, name)
-		o:value(ip, "%s (%s)" %{ ip, name })
-	end)
-
-
-	o = s:option(Value, "src_port",
-		translate("Source port"),
-		translate("Match incoming traffic originating from the given source \
-			port or port range on the client host."))
-	o.rmempty = true
-	o.datatype = "neg(portrange)"
-	o.placeholder = translate("any")
-
-	o:depends("proto", "tcp")
-	o:depends("proto", "udp")
-	o:depends("proto", "tcp udp")
-	o:depends("proto", "tcpudp")
-
-	o = s:option(Value, "dest", translate("Destination zone"))
-	o.nocreate = true
-	o.default = "lan"
-	o.template = "cbi/firewall_zonelist"
-
-
-	o = s:option(Value, "dest_ip", translate("Destination IP address"))
-	o.datatype = "neg(ipmask4)"
-
-	luci.sys.net.ipv4_hints(function(ip, name)
-		o:value(ip, "%s (%s)" %{ ip, name })
-	end)
-
-
-	o = s:option(Value, "dest_port",
-		translate("Destination port"),
-		translate("Match forwarded traffic to the given destination port or \
-			port range."))
-
-	o.rmempty = true
-	o.placeholder = translate("any")
-	o.datatype = "neg(portrange)"
-
-	o:depends("proto", "tcp")
-	o:depends("proto", "udp")
-	o:depends("proto", "tcp udp")
-	o:depends("proto", "tcpudp")
-
-	o = s:option(Value, "src_dip",
-		translate("SNAT IP address"),
-		translate("Rewrite matched traffic to the given address."))
-	o.rmempty = false
-	o.datatype = "ip4addr"
-
-	for _, v in ipairs(nw:get_interfaces()) do
-		local a
-		for _, a in ipairs(v:ipaddrs()) do
-			o:value(a:host():string(), '%s (%s)' %{
-				a:host():string(), v:shortname()
-			})
-		end
-	end
-
-
-	o = s:option(Value, "src_dport", translate("SNAT port"),
-		translate("Rewrite matched traffic to the given source port. May be \
-			left empty to only rewrite the IP address."))
-	o.datatype = "portrange"
-	o.rmempty = true
-	o.placeholder = translate('Do not rewrite')
-
-	o:depends("proto", "tcp")
-	o:depends("proto", "udp")
-	o:depends("proto", "tcp udp")
-	o:depends("proto", "tcpudp")
-
-	s:option(Value, "extra",
-		translate("Extra arguments"),
-		translate("Passes additional arguments to iptables. Use with care!"))
-
-
---
--- Rule
---
-else
-	local name = m:get(arg[1], "name") or m:get(arg[1], "_name")
-	if not name or #name == 0 then
-		name = translate("(Unnamed Rule)")
-	end
-
-	m.title = "%s - %s" %{ translate("Firewall - Traffic Rules"), name }
-
-
-	s = m:section(NamedSection, arg[1], "rule", "")
-	s.anonymous = true
-	s.addremove = false
-
-	ft.opt_enabled(s, Button)
-	ft.opt_name(s, Value, translate("Name"))
-
-
-	o = s:option(ListValue, "family", translate("Restrict to address family"))
-	o.rmempty = true
-	o:value("", translate("IPv4 and IPv6"))
-	o:value("ipv4", translate("IPv4 only"))
-	o:value("ipv6", translate("IPv6 only"))
-
-
-	o = s:option(Value, "proto", translate("Protocol"))
-	o:value("all", translate("Any"))
-	o:value("tcp udp", "TCP+UDP")
-	o:value("tcp", "TCP")
-	o:value("udp", "UDP")
-	o:value("icmp", "ICMP")
-
-	function o.cfgvalue(...)
-		local v = Value.cfgvalue(...)
-		if not v or v == "tcpudp" then
-			return "tcp udp"
-		end
-		return v
-	end
-
-
-	o = s:option(DropDown, "icmp_type", translate("Match ICMP type"))
-	o.multiple = true
-	o.display = 10
-	o.dropdown = 10
-	o.custom = true
-	o.cast = "table"
-
-	o:value("", "any")
-	o:value("echo-reply")
-	o:value("destination-unreachable")
-	o:value("network-unreachable")
-	o:value("host-unreachable")
-	o:value("protocol-unreachable")
-	o:value("port-unreachable")
-	o:value("fragmentation-needed")
-	o:value("source-route-failed")
-	o:value("network-unknown")
-	o:value("host-unknown")
-	o:value("network-prohibited")
-	o:value("host-prohibited")
-	o:value("TOS-network-unreachable")
-	o:value("TOS-host-unreachable")
-	o:value("communication-prohibited")
-	o:value("host-precedence-violation")
-	o:value("precedence-cutoff")
-	o:value("source-quench")
-	o:value("redirect")
-	o:value("network-redirect")
-	o:value("host-redirect")
-	o:value("TOS-network-redirect")
-	o:value("TOS-host-redirect")
-	o:value("echo-request")
-	o:value("router-advertisement")
-	o:value("router-solicitation")
-	o:value("time-exceeded")
-	o:value("ttl-zero-during-transit")
-	o:value("ttl-zero-during-reassembly")
-	o:value("parameter-problem")
-	o:value("ip-header-bad")
-	o:value("required-option-missing")
-	o:value("timestamp-request")
-	o:value("timestamp-reply")
-	o:value("address-mask-request")
-	o:value("address-mask-reply")
-
-	o:depends("proto", "icmp")
-
-
-	o = s:option(Value, "src", translate("Source zone"))
-	o.nocreate = true
-	o.allowany = true
-	o.allowlocal = "src"
-	o.template = "cbi/firewall_zonelist"
-
-
-	o = s:option(Value, "src_mac", translate("Source MAC address"))
-	o.datatype = "list(macaddr)"
-	o.placeholder = translate("any")
-
-	luci.sys.net.mac_hints(function(mac, name)
-		o:value(mac, "%s (%s)" %{ mac, name })
-	end)
-
-
-	o = s:option(Value, "src_ip", translate("Source address"))
-	o.datatype = "list(neg(ipmask))"
-	o.placeholder = translate("any")
-
-	luci.sys.net.ipv4_hints(function(ip, name)
-		o:value(ip, "%s (%s)" %{ ip, name })
-	end)
-
-
-	o = s:option(Value, "src_port", translate("Source port"))
-	o.datatype = "list(neg(portrange))"
-	o.placeholder = translate("any")
-
-	o:depends("proto", "tcp")
-	o:depends("proto", "udp")
-	o:depends("proto", "tcp udp")
-	o:depends("proto", "tcpudp")
-
-	o = s:option(Value, "dest_local", translate("Output zone"))
-	o.nocreate = true
-	o.allowany = true
-	o.template = "cbi/firewall_zonelist"
-	o.alias = "dest"
-	o:depends("src", "")
-
-	o = s:option(Value, "dest_remote", translate("Destination zone"))
-	o.nocreate = true
-	o.allowany = true
-	o.allowlocal = true
-	o.template = "cbi/firewall_zonelist"
-	o.alias = "dest"
-	o:depends({["src"] = "", ["!reverse"] = true})
-
-
-	o = s:option(Value, "dest_ip", translate("Destination address"))
-	o.datatype = "list(neg(ipmask))"
-	o.placeholder = translate("any")
-
-	luci.sys.net.ipv4_hints(function(ip, name)
-		o:value(ip, "%s (%s)" %{ ip, name })
-	end)
-
-
-	o = s:option(Value, "dest_port", translate("Destination port"))
-	o.datatype = "list(neg(portrange))"
-	o.placeholder = translate("any")
-
-	o:depends("proto", "tcp")
-	o:depends("proto", "udp")
-	o:depends("proto", "tcp udp")
-	o:depends("proto", "tcpudp")
-
-	o = s:option(ListValue, "target", translate("Action"))
-	o.default = "ACCEPT"
-	o:value("DROP", translate("drop"))
-	o:value("ACCEPT", translate("accept"))
-	o:value("REJECT", translate("reject"))
-	o:value("NOTRACK", translate("don't track"))
-
-
-	s:option(Value, "extra",
-		translate("Extra arguments"),
-		translate("Passes additional arguments to iptables. Use with care!"))
-end
-
-o = s:option(DropDown, "weekdays", translate("Week Days"))
-o.multiple = true
-o.display = 5
-o:value("Sun", translate("Sunday"))
-o:value("Mon", translate("Monday"))
-o:value("Tue", translate("Tuesday"))
-o:value("Wed", translate("Wednesday"))
-o:value("Thu", translate("Thursday"))
-o:value("Fri", translate("Friday"))
-o:value("Sat", translate("Saturday"))
-
-o = s:option(DropDown, "monthdays", translate("Month Days"))
-o.multiple = true
-o.display = 15
-for i = 1,31 do
-	o:value(translate(i))
-end
-
-o = s:option(Value, "start_time", translate("Start Time (hh:mm:ss)"))
-o.datatype = "timehhmmss"
-o = s:option(Value, "stop_time", translate("Stop Time (hh:mm:ss)"))
-o.datatype = "timehhmmss"
-o = s:option(Value, "start_date", translate("Start Date (yyyy-mm-dd)"))
-o.datatype = "dateyyyymmdd"
-o = s:option(Value, "stop_date", translate("Stop Date (yyyy-mm-dd)"))
-o.datatype = "dateyyyymmdd"
-
-o = s:option(Flag, "utc_time", translate("Time in UTC"))
-o.default = o.disabled
-
-return m
diff --git a/applications/luci-app-firewall/luasrc/model/cbi/firewall/rules.lua b/applications/luci-app-firewall/luasrc/model/cbi/firewall/rules.lua
deleted file mode 100644
index f4b6b2a928..0000000000
--- a/applications/luci-app-firewall/luasrc/model/cbi/firewall/rules.lua
+++ /dev/null
@@ -1,273 +0,0 @@
--- Copyright 2008 Steven Barth <steven@midlink.org>
--- Copyright 2010-2012 Jo-Philipp Wich <jow@openwrt.org>
--- Licensed to the public under the Apache License 2.0.
-
-local ds = require "luci.dispatcher"
-local ft = require "luci.tools.firewall"
-
-m = Map("firewall",
-	translate("Firewall - Traffic Rules"),
-	translate("Traffic rules define policies for packets traveling between \
-		different zones, for example to reject traffic between certain hosts \
-		or to open WAN ports on the router."))
-
---
--- Rules
---
-
-s = m:section(TypedSection, "rule", translate("Traffic Rules"))
-s.addremove = true
-s.anonymous = true
-s.sortable  = true
-s.template = "cbi/tblsection"
-s.extedit   = ds.build_url("admin/network/firewall/rules/%s")
-s.defaults.target = "ACCEPT"
-s.template_addremove = "firewall/cbi_addrule"
-
-
-function s.create(self, section)
-	created = TypedSection.create(self, section)
-end
-
-function s.parse(self, ...)
-	TypedSection.parse(self, ...)
-
-	local i_n = m:formvalue("_newopen.name")
-	local i_p = m:formvalue("_newopen.proto")
-	local i_e = m:formvalue("_newopen.extport")
-	local i_x = m:formvalue("_newopen.submit")
-
-	local f_n = m:formvalue("_newfwd.name")
-	local f_s = m:formvalue("_newfwd.src")
-	local f_d = m:formvalue("_newfwd.dest")
-	local f_x = m:formvalue("_newfwd.submit")
-
-	if i_x then
-		created = TypedSection.create(self, section)
-
-		self.map:set(created, "target",    "ACCEPT")
-		self.map:set(created, "src",       "wan")
-		self.map:set(created, "proto",     (i_p ~= "other") and i_p or "all")
-		self.map:set(created, "dest_port", i_e)
-		self.map:set(created, "name",      i_n)
-
-		if i_p ~= "other" and i_e and #i_e > 0 then
-			created = nil
-		end
-
-	elseif f_x then
-		created = TypedSection.create(self, section)
-
-		self.map:set(created, "target", "ACCEPT")
-		self.map:set(created, "src",    f_s)
-		self.map:set(created, "dest",   f_d)
-		self.map:set(created, "name",   f_n)
-	end
-
-	if created then
-		m.uci:save("firewall")
-		luci.http.redirect(ds.build_url(
-			"admin/network/firewall/rules", created
-		))
-	end
-end
-
-function s.sectiontitle(self, sid)
-	return (self.map:get(sid, "name") or translate("Unnamed rule"))
-end
-
-local function rule_proto_txt(self, s)
-	local f = self.map:get(s, "family")
-	local p = ft.fmt_proto(self.map:get(s, "proto"),
-	                       self.map:get(s, "icmp_type")) or translate("traffic")
-
-	if f and f:match("4") then
-		return "%s-%s" %{ translate("IPv4"), p }
-	elseif f and f:match("6") then
-		return "%s-%s" %{ translate("IPv6"), p }
-	else
-		return "%s %s" %{ translate("Any"), p }
-	end
-end
-
-local function rule_src_txt(self, s)
-	local z = ft.fmt_zone(self.map:get(s, "src"))
-	local p = ft.fmt_port(self.map:get(s, "src_port"))
-	local m = ft.fmt_mac(self.map:get(s, "src_mac"))
-
-	-- Forward/Input
-	if z and #z > 0 then
-		local a = ft.fmt_ip(self.map:get(s, "src_ip"), translate("any host"))
-		if p and m then
-			return translatef("From %s in %s with source %s and %s", a, z, p, m)
-		elseif p or m then
-			return translatef("From %s in %s with source %s", a, z, p or m)
-		else
-			return translatef("From %s in %s", a, z)
-		end
-
-	-- Output
-	else
-		local a = ft.fmt_ip(self.map:get(s, "src_ip"), translate("any router IP"))
-		if p and m then
-			return translatef("From %s on <var>this device</var> with source %s and %s", a, p, m)
-		elseif p or m then
-			return translatef("From %s on <var>this device</var> with source %s", a, p or m)
-		else
-			return translatef("From %s on <var>this device</var>", a)
-		end
-	end
-end
-
-local function rule_dest_txt(self, s)
-	local z = ft.fmt_zone(self.map:get(s, "dest"))
-	local p = ft.fmt_port(self.map:get(s, "dest_port"))
-
-	-- Forward
-	if z then
-		local a = ft.fmt_ip(self.map:get(s, "dest_ip"), translate("any host"))
-		if p then
-			return translatef("To %s, %s in %s", a, p, z)
-		else
-			return translatef("To %s in %s", a, z)
-		end
-
-	-- Input
-	else
-		local a = ft.fmt_ip(self.map:get(s, "dest_ip"),
-			translate("any router IP"))
-
-		if p then
-			return translatef("To %s at %s on <var>this device</var>", a, p)
-		else
-			return translatef("To %s on <var>this device</var>", a)
-		end
-	end
-end
-
-local function snat_dest_txt(self, s)
-	local z = ft.fmt_zone(self.map:get(s, "dest"), translate("any zone"))
-	local a = ft.fmt_ip(self.map:get(s, "dest_ip"), translate("any host"))
-	local p = ft.fmt_port(self.map:get(s, "dest_port")) or
-		ft.fmt_port(self.map:get(s, "src_dport"))
-
-	if p then
-		return translatef("To %s, %s in %s", a, p, z)
-	else
-		return translatef("To %s in %s", a, z)
-	end
-end
-
-
-match = s:option(DummyValue, "match", translate("Match"))
-match.rawhtml = true
-function match.cfgvalue(self, s)
-	return "<small>%s<br />%s<br />%s</small>" % {
-		rule_proto_txt(self, s),
-		rule_src_txt(self, s),
-		rule_dest_txt(self, s)
-	}
-end
-
-target = s:option(DummyValue, "target", translate("Action"))
-target.rawhtml = true
-function target.cfgvalue(self, s)
-	local t = ft.fmt_target(self.map:get(s, "target"), self.map:get(s, "src"), self.map:get(s, "dest"))
-	local l = ft.fmt_limit(self.map:get(s, "limit"),
-		self.map:get(s, "limit_burst"))
-
-	if l then
-		return translatef("<var>%s</var> and limit to %s", t, l)
-	else
-		return "<var>%s</var>" % t
-	end
-end
-
-ft.opt_enabled(s, Flag, translate("Enable"))
-
-
---
--- SNAT
---
-
-s = m:section(TypedSection, "redirect",
-	translate("Source NAT"),
-	translate("Source NAT is a specific form of masquerading which allows \
-		fine grained control over the source IP used for outgoing traffic, \
-		for example to map multiple WAN addresses to internal subnets."))
-s.template  = "cbi/tblsection"
-s.addremove = true
-s.anonymous = true
-s.sortable  = true
-s.extedit   = ds.build_url("admin/network/firewall/rules/%s")
-s.template_addremove = "firewall/cbi_addsnat"
-
-function s.create(self, section)
-	created = TypedSection.create(self, section)
-end
-
-function s.parse(self, ...)
-	TypedSection.parse(self, ...)
-
-	local n = m:formvalue("_newsnat.name")
-	local s = m:formvalue("_newsnat.src")
-	local d = m:formvalue("_newsnat.dest")
-	local a = m:formvalue("_newsnat.dip")
-	local p = m:formvalue("_newsnat.dport")
-	local x = m:formvalue("_newsnat.submit")
-
-	if x and a and #a > 0 then
-		created = TypedSection.create(self, section)
-
-		self.map:set(created, "target",    "SNAT")
-		self.map:set(created, "src",       s)
-		self.map:set(created, "dest",      d)
-		self.map:set(created, "proto",     "all")
-		self.map:set(created, "src_dip",   a)
-		self.map:set(created, "src_dport", p)
-		self.map:set(created, "name",      n)
-	end
-
-	if created then
-		m.uci:save("firewall")
-		luci.http.redirect(ds.build_url(
-			"admin/network/firewall/rules", created
-		))
-	end
-end
-
-function s.filter(self, sid)
-	return (self.map:get(sid, "target") == "SNAT")
-end
-
-function s.sectiontitle(self, sid)
-	return (self.map:get(sid, "name") or translate("Unnamed SNAT"))
-end
-
-match = s:option(DummyValue, "match", translate("Match"))
-match.rawhtml = true
-function match.cfgvalue(self, s)
-	return "<small>%s<br />%s<br />%s</small>" % {
-		rule_proto_txt(self, s),
-		rule_src_txt(self, s),
-		snat_dest_txt(self, s)
-	}
-end
-
-snat = s:option(DummyValue, "via", translate("Action"))
-snat.rawhtml = true
-function snat.cfgvalue(self, s)
-	local a = ft.fmt_ip(self.map:get(s, "src_dip"))
-	local p = ft.fmt_port(self.map:get(s, "src_dport"))
-
-	if a and p then
-		return translatef("Rewrite to source %s, %s", a, p)
-	else
-		return translatef("Rewrite to source %s", a or p)
-	end
-end
-
-ft.opt_enabled(s, Flag, translate("Enable"))
-
-
-return m
diff --git a/applications/luci-app-firewall/luasrc/model/cbi/firewall/zone-details.lua b/applications/luci-app-firewall/luasrc/model/cbi/firewall/zone-details.lua
deleted file mode 100644
index e168c3c605..0000000000
--- a/applications/luci-app-firewall/luasrc/model/cbi/firewall/zone-details.lua
+++ /dev/null
@@ -1,229 +0,0 @@
--- Copyright 2008 Steven Barth <steven@midlink.org>
--- Copyright 2010-2011 Jo-Philipp Wich <jow@openwrt.org>
--- Licensed to the public under the Apache License 2.0.
-
-local nw = require "luci.model.network"
-local fw = require "luci.model.firewall"
-local ds = require "luci.dispatcher"
-local ut = require "luci.util"
-
-local m, p, i, v
-local s, name, net, family, msrc, mdest, log, lim
-local s2, out, inp
-
-
-m = Map("firewall", translate("Firewall - Zone Settings"))
-m.redirect = luci.dispatcher.build_url("admin/network/firewall/zones")
-
-fw.init(m.uci)
-nw.init(m.uci)
-
-
-local zone = fw:get_zone(arg[1])
-if not zone then
-	luci.http.redirect(ds.build_url("admin/network/firewall/zones"))
-	return
-else
-	m.title = "%s - %s" %{
-		translate("Firewall - Zone Settings"),
-		translatef("Zone %q", zone:name() or "?")
-	}
-end
-
-
-s = m:section(NamedSection, zone.sid, "zone",
-	translatef("Zone %q", zone:name()),
-	translatef("This section defines common properties of %q. \
-		The <em>input</em> and <em>output</em> options set the default \
-		policies for traffic entering and leaving this zone while the \
-		<em>forward</em> option describes the policy for forwarded traffic \
-		between different networks within the zone. \
-		<em>Covered networks</em> specifies which available networks are \
-		members of this zone.", zone:name()))
-
-s.anonymous = true
-s.addremove = false
-
-m.on_commit = function(map)
-	local zone = fw:get_zone(arg[1])
-	if zone then
-		s.section  = zone.sid
-		s2.section = zone.sid
-	end
-end
-
-
-s:tab("general", translate("General Settings"))
-s:tab("advanced", translate("Advanced Settings"))
-
-
-name = s:taboption("general", Value, "name", translate("Name"))
-name.optional = false
-name.forcewrite = true
-name.datatype = "and(uciname,maxlength(11))"
-
-function name.write(self, section, value)
-	if zone:name() ~= value then
-		fw:rename_zone(zone:name(), value)
-		out.exclude = value
-		inp.exclude = value
-	end
-end
-
-p = {
-	s:taboption("general", ListValue, "input", translate("Input")),
-	s:taboption("general", ListValue, "output", translate("Output")),
-	s:taboption("general", ListValue, "forward", translate("Forward"))
-}
-
-for i, v in ipairs(p) do
-	v:value("REJECT", translate("reject"))
-	v:value("DROP", translate("drop"))
-	v:value("ACCEPT", translate("accept"))
-end
-
-s:taboption("general", Flag, "masq", translate("Masquerading"))
-s:taboption("general", Flag, "mtu_fix", translate("MSS clamping"))
-
-net = s:taboption("general", Value, "network", translate("Covered networks"))
-net.template = "cbi/network_netlist"
-net.widget = "checkbox"
-net.cast = "string"
-
-function net.formvalue(self, section)
-	return Value.formvalue(self, section) or "-"
-end
-
-function net.cfgvalue(self, section)
-	return Value.cfgvalue(self, section) or name:cfgvalue(section)
-end
-
-function net.write(self, section, value)
-	zone:clear_networks()
-
-	local net
-	for net in ut.imatch(value) do
-		local n = nw:get_network(net) or nw:add_network(net, { proto = "none" })
-		if n then
-			zone:add_network(n:name())
-		end
-	end
-end
-
-
-family = s:taboption("advanced", ListValue, "family",
-	translate("Restrict to address family"))
-
-family.rmempty = true
-family:value("", translate("IPv4 and IPv6"))
-family:value("ipv4", translate("IPv4 only"))
-family:value("ipv6", translate("IPv6 only"))
-
-msrc = s:taboption("advanced", DynamicList, "masq_src",
-	translate("Restrict Masquerading to given source subnets"))
-
-msrc.optional = true
-msrc.datatype = "list(neg(or(uciname,hostname,ipmask4)))"
-msrc.placeholder = "0.0.0.0/0"
-msrc:depends("family", "")
-msrc:depends("family", "ipv4")
-
-mdest = s:taboption("advanced", DynamicList, "masq_dest",
-	translate("Restrict Masquerading to given destination subnets"))
-
-mdest.optional = true
-mdest.datatype = "list(neg(or(uciname,hostname,ipmask4)))"
-mdest.placeholder = "0.0.0.0/0"
-mdest:depends("family", "")
-mdest:depends("family", "ipv4")
-
-s:taboption("advanced", Flag, "conntrack",
-	translate("Force connection tracking"))
-
-log = s:taboption("advanced", Flag, "log",
-	translate("Enable logging on this zone"))
-
-log.rmempty = true
-log.enabled = "1"
-
-lim = s:taboption("advanced", Value, "log_limit",
-	translate("Limit log messages"))
-
-lim.placeholder = "10/minute"
-lim:depends("log", "1")
-
-
-s2 = m:section(NamedSection, zone.sid, "fwd_out",
-	translate("Inter-Zone Forwarding"),
-	translatef("The options below control the forwarding policies between \
-		this zone (%s) and other zones. <em>Destination zones</em> cover \
-		forwarded traffic <strong>originating from %q</strong>. \
-		<em>Source zones</em> match forwarded traffic from other zones \
-		<strong>targeted at %q</strong>. The forwarding rule is \
-		<em>unidirectional</em>, e.g. a forward from lan to wan does \
-		<em>not</em> imply a permission to forward from wan to lan as well.",
-		zone:name(), zone:name(), zone:name()
-
-	))
-
-out = s2:option(Value, "out",
-	translate("Allow forward to <em>destination zones</em>:"))
-
-out.nocreate = true
-out.widget = "checkbox"
-out.exclude = zone:name()
-out.template = "cbi/firewall_zonelist"
-
-inp = s2:option(Value, "in",
-	translate("Allow forward from <em>source zones</em>:"))
-
-inp.nocreate = true
-inp.widget = "checkbox"
-inp.exclude = zone:name()
-inp.template = "cbi/firewall_zonelist"
-
-function out.cfgvalue(self, section)
-	local v = { }
-	local f
-	for _, f in ipairs(zone:get_forwardings_by("src")) do
-		v[#v+1] = f:dest()
-	end
-	return table.concat(v, " ")
-end
-
-function inp.cfgvalue(self, section)
-	local v = { }
-	local f
-	for _, f in ipairs(zone:get_forwardings_by("dest")) do
-		v[#v+1] = f:src()
-	end
-	return v
-end
-
-function out.formvalue(self, section)
-	return Value.formvalue(self, section) or "-"
-end
-
-function inp.formvalue(self, section)
-	return Value.formvalue(self, section) or "-"
-end
-
-function out.write(self, section, value)
-	zone:del_forwardings_by("src")
-
-	local f
-	for f in ut.imatch(value) do
-		zone:add_forwarding_to(f)
-	end
-end
-
-function inp.write(self, section, value)
-	zone:del_forwardings_by("dest")
-
-	local f
-	for f in ut.imatch(value) do
-		zone:add_forwarding_from(f)
-	end
-end
-
-return m
diff --git a/applications/luci-app-firewall/luasrc/model/cbi/firewall/zones.lua b/applications/luci-app-firewall/luasrc/model/cbi/firewall/zones.lua
deleted file mode 100644
index 46402a8fc1..0000000000
--- a/applications/luci-app-firewall/luasrc/model/cbi/firewall/zones.lua
+++ /dev/null
@@ -1,104 +0,0 @@
--- Copyright 2008 Steven Barth <steven@midlink.org>
--- Licensed to the public under the Apache License 2.0.
-
-local ds = require "luci.dispatcher"
-local fw = require "luci.model.firewall"
-local fs = require "nixio.fs"
-
-local m, s, o, p, i, v
-
-m = Map("firewall",
-	translate("Firewall - Zone Settings"),
-	translate("The firewall creates zones over your network interfaces to control network traffic flow."))
-
-fw.init(m.uci)
-
-s = m:section(TypedSection, "defaults", translate("General Settings"))
-s.anonymous = true
-s.addremove = false
-
-s:option(Flag, "syn_flood", translate("Enable SYN-flood protection"))
-
-o = s:option(Flag, "drop_invalid", translate("Drop invalid packets"))
-
-p = {
-	s:option(ListValue, "input", translate("Input")),
-	s:option(ListValue, "output", translate("Output")),
-	s:option(ListValue, "forward", translate("Forward"))
-}
-
-for i, v in ipairs(p) do
-	v:value("REJECT", translate("reject"))
-	v:value("DROP", translate("drop"))
-	v:value("ACCEPT", translate("accept"))
-end
-
--- Netfilter flow offload support
-
-local offload = fs.access("/sys/module/xt_FLOWOFFLOAD/refcnt")
-
-if offload then
-	s:option(DummyValue, "offload_advice",
-		translate("Routing/NAT Offloading"),
-		translate("Experimental feature. Not fully compatible with QoS/SQM."))
-
-	o = s:option(Flag, "flow_offloading",
-		translate("Software flow offloading"),
-		translate("Software based offloading for routing/NAT"))
-	o.optional = true
-
-	o = s:option(Flag, "flow_offloading_hw",
-		translate("Hardware flow offloading"),
-		translate("Requires hardware NAT support. Implemented at least for mt7621"))
-	o.optional = true
-	o:depends( "flow_offloading", 1)
-end
-
--- Firewall zones
-
-s = m:section(TypedSection, "zone", translate("Zones"))
-s.template = "cbi/tblsection"
-s.anonymous = true
-s.addremove = true
-s.extedit   = ds.build_url("admin", "network", "firewall", "zones", "%s")
-
-function s.sectiontitle(self, sid)
-	local z = fw:get_zone(sid)
-	return z:name()
-end
-
-function s.create(self)
-	local z = fw:new_zone()
-	if z then
-		luci.http.redirect(
-			ds.build_url("admin", "network", "firewall", "zones", z.sid)
-		)
-	end
-end
-
-function s.remove(self, section)
-	return fw:del_zone(section)
-end
-
-o = s:option(DummyValue, "_info", translate("Zone ⇒ Forwardings"))
-o.template = "cbi/firewall_zoneforwards"
-o.cfgvalue = function(self, section)
-	return self.map:get(section, "name")
-end
-
-p = {
-	s:option(ListValue, "input", translate("Input")),
-	s:option(ListValue, "output", translate("Output")),
-	s:option(ListValue, "forward", translate("Forward"))
-}
-
-for i, v in ipairs(p) do
-	v:value("REJECT", translate("reject"))
-	v:value("DROP", translate("drop"))
-	v:value("ACCEPT", translate("accept"))
-end
-
-s:option(Flag, "masq", translate("Masquerading"))
-s:option(Flag, "mtu_fix", translate("MSS clamping"))
-
-return m