summaryrefslogtreecommitdiffhomepage
path: root/applications/luci-firewall/luasrc/model/cbi/firewall/zone-details.lua
diff options
context:
space:
mode:
authorJo-Philipp Wich <jow@openwrt.org>2011-12-19 21:16:31 +0000
committerJo-Philipp Wich <jow@openwrt.org>2011-12-19 21:16:31 +0000
commit033de64a0f66e727cb97c54403614917a49cc577 (patch)
tree1e1908490a79fe2aad2dc30a0f6d3ecc7f53b781 /applications/luci-firewall/luasrc/model/cbi/firewall/zone-details.lua
parent24c4cce3ae278c0511a65aded38ef83b2e49d3d4 (diff)
applications/luci-firewall: complete rework firewall ui
- split zone setup, port forwards, traffic rules and firewall.user - add quickadd forms for various common rules like port forwards - add tool class for textual formatting and descriptions of rules - simplify controller, remove old mini admin remainders
Diffstat (limited to 'applications/luci-firewall/luasrc/model/cbi/firewall/zone-details.lua')
-rw-r--r--applications/luci-firewall/luasrc/model/cbi/firewall/zone-details.lua242
1 files changed, 242 insertions, 0 deletions
diff --git a/applications/luci-firewall/luasrc/model/cbi/firewall/zone-details.lua b/applications/luci-firewall/luasrc/model/cbi/firewall/zone-details.lua
new file mode 100644
index 0000000000..a8ae894417
--- /dev/null
+++ b/applications/luci-firewall/luasrc/model/cbi/firewall/zone-details.lua
@@ -0,0 +1,242 @@
+--[[
+LuCI - Lua Configuration Interface
+
+Copyright 2008 Steven Barth <steven@midlink.org>
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+$Id$
+]]--
+
+local nw = require "luci.model.network"
+local fw = require "luci.model.firewall"
+local ds = require "luci.dispatcher"
+local ut = require "luci.util"
+
+local m, p, i, v
+local s, name, net, family, msrc, mdest, log, lim
+local s2, out, inp
+
+
+m = Map("firewall", translate("Firewall - Zone Settings"))
+m.redirect = luci.dispatcher.build_url("admin/network/firewall/zones")
+
+fw.init(m.uci)
+nw.init(m.uci)
+
+
+local zone = fw:get_zone(arg[1])
+if not zone then
+ luci.http.redirect(dsp.build_url("admin/network/firewall/zones"))
+ return
+else
+ m.title = "%s - %s" %{
+ translate("Firewall - Zone Settings"),
+ translatef("Zone %q", zone:name() or "?")
+ }
+end
+
+
+s = m:section(NamedSection, zone.sid, "zone",
+ translatef("Zone %q", zone:name()),
+ translatef("This section defines common properties of %q. \
+ The <em>input</em> and <em>output</em> options set the default \
+ policies for traffic entering and leaving this zone while the \
+ <em>forward</em> option describes the policy for forwarded traffic \
+ between different networks within the zone. \
+ <em>Covered networks</em> specifies which available networks are \
+ member of this zone.", zone:name()))
+
+s.anonymous = true
+s.addremove = false
+
+m.on_commit = function(map)
+ local zone = fw:get_zone(arg[1])
+ if zone then
+ s.section = zone.sid
+ s2.section = zone.sid
+ end
+end
+
+
+s:tab("general", translate("General Settings"))
+s:tab("advanced", translate("Advanced Settings"))
+
+
+name = s:taboption("general", Value, "name", translate("Name"))
+name.optional = false
+name.forcewrite = true
+name.datatype = "uciname"
+
+function name.write(self, section, value)
+ if zone:name() ~= value then
+ fw:rename_zone(zone:name(), value)
+ out.exclude = value
+ inp.exclude = value
+ end
+
+ m.redirect = ds.build_url("admin/network/firewall/zones", value)
+ m.title = "%s - %s" %{
+ translate("Firewall - Zone Settings"),
+ translatef("Zone %q", value or "?")
+ }
+end
+
+p = {
+ s:taboption("general", ListValue, "input", translate("Input")),
+ s:taboption("general", ListValue, "output", translate("Output")),
+ s:taboption("general", ListValue, "forward", translate("Forward"))
+}
+
+for i, v in ipairs(p) do
+ v:value("REJECT", translate("reject"))
+ v:value("DROP", translate("drop"))
+ v:value("ACCEPT", translate("accept"))
+end
+
+s:taboption("general", Flag, "masq", translate("Masquerading"))
+s:taboption("general", Flag, "mtu_fix", translate("MSS clamping"))
+
+net = s:taboption("general", Value, "network", translate("Covered networks"))
+net.template = "cbi/network_netlist"
+net.widget = "checkbox"
+net.cast = "string"
+
+function net.formvalue(self, section)
+ return Value.formvalue(self, section) or "-"
+end
+
+function net.cfgvalue(self, section)
+ return Value.cfgvalue(self, section) or name:cfgvalue(section)
+end
+
+function net.write(self, section, value)
+ zone:clear_networks()
+
+ local n
+ for n in ut.imatch(value) do
+ zone:add_network(n)
+ end
+end
+
+
+family = s:taboption("advanced", ListValue, "family",
+ translate("Restrict to address family"))
+
+family.rmempty = true
+family:value("", translate("IPv4 and IPv6"))
+family:value("ipv4", translate("IPv4 only"))
+family:value("ipv6", translate("IPv6 only"))
+
+msrc = s:taboption("advanced", DynamicList, "masq_src",
+ translate("Restrict Masquerading to given source subnets"))
+
+msrc.optional = true
+msrc.datatype = "neg_network_ip4addr"
+msrc.placeholder = "0.0.0.0/0"
+msrc:depends("family", "")
+msrc:depends("family", "ipv4")
+
+mdest = s:taboption("advanced", DynamicList, "masq_dest",
+ translate("Restrict Masquerading to given destination subnets"))
+
+mdest.optional = true
+mdest.datatype = "neg_network_ip4addr"
+mdest.placeholder = "0.0.0.0/0"
+mdest:depends("family", "")
+mdest:depends("family", "ipv4")
+
+s:taboption("advanced", Flag, "conntrack",
+ translate("Force connection tracking"))
+
+log = s:taboption("advanced", Flag, "log",
+ translate("Enable logging on this zone"))
+
+log.rmempty = true
+log.enabled = "1"
+
+lim = s:taboption("advanced", Value, "log_limit",
+ translate("Limit log messages"))
+
+lim.placeholder = "10/minute"
+lim:depends("log", "1")
+
+
+s2 = m:section(NamedSection, zone.sid, "fwd_out",
+ translate("Inter-Zone Forwarding"),
+ translatef("The options below control the forwarding policies between \
+ this zone (%s) and other zones. <em>Destination zones</em> cover \
+ forwarded traffic <strong>originating from %q</strong>. \
+ <em>Source zones</em> match forwarded traffic from other zones \
+ <strong>targeted at %q</strong>. The forwarding rule is \
+ <em>unidirectional</em>, e.g. a forward from lan to wan does \
+ <em>not</em> imply a permission to forward from wan to lan as well.",
+ zone:name(), zone:name(), zone:name()
+
+ ))
+
+out = s2:option(Value, "out",
+ translate("Allow forward to <em>destination zones</em>:"))
+
+out.nocreate = true
+out.widget = "checkbox"
+out.exclude = zone:name()
+out.template = "cbi/firewall_zonelist"
+
+inp = s2:option(Value, "in",
+ translate("Allow forward from <em>source zones</em>:"))
+
+inp.nocreate = true
+inp.widget = "checkbox"
+inp.exclude = zone:name()
+inp.template = "cbi/firewall_zonelist"
+
+function out.cfgvalue(self, section)
+ local v = { }
+ local f
+ for _, f in ipairs(zone:get_forwardings_by("src")) do
+ v[#v+1] = f:dest()
+ end
+ return table.concat(v, " ")
+end
+
+function inp.cfgvalue(self, section)
+ local v = { }
+ local f
+ for _, f in ipairs(zone:get_forwardings_by("dest")) do
+ v[#v+1] = f:src()
+ end
+ return v
+end
+
+function out.formvalue(self, section)
+ return Value.formvalue(self, section) or "-"
+end
+
+function inp.formvalue(self, section)
+ return Value.formvalue(self, section) or "-"
+end
+
+function out.write(self, section, value)
+ zone:del_forwardings_by("src")
+
+ local f
+ for f in ut.imatch(value) do
+ zone:add_forwarding_to(f)
+ end
+end
+
+function inp.write(self, section, value)
+ zone:del_forwardings_by("dest")
+
+ local f
+ for f in ut.imatch(value) do
+ zone:add_forwarding_from(f)
+ end
+end
+
+return m